Ilmari Karonen
Reputation
19,455
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
 Dec 28 comment Information theoretical security of an inefficient Shamir based access structure It might be easier to understand (and answer) your question if you started it by telling us just what, exactly, your scheme is supposed to accomplish (i.e. allow legitimate users to do, and prevent attackers from doing). Dec 24 comment How to check the integrity of a key received through mail using symmetric encryption? Hi, nalini, and welcome to Crypto Stack Exchange. I've edited your question to hopefully make it easier to read, but there's always a chance that I might have made some mistakes while doing so. Please take a look at the edited text to see if it still matches what you meant to ask, and if not, please edit it yourself to correct any mistakes. Thanks! Dec 20 comment If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack? Or perhaps you should in fact be using some other multiplicative structure for $\{0,1\}^*$; in particular, one that doesn't have a zero element. There is a fairly simple and commonly used bijective map from $\{0,1\}^*$ to the positive integers, obtained by first prepending a "1" to the bitstring and then reading the bits as base-2 digits. But that's not, IMO, quite so obvious that it should be assumed without being stated. Dec 20 comment If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack? Technically, since $G$ is a group, all its elements must have inverses. In particular, $H(0)\in G$, so it has an inverse $H(0)^{-1}$. But since $0\cdot m=0$ for all $m$, it follows that $H(0)=H(0\cdot m)=H(0)\cdot H(m)$. Multiplying both sides by $H(0)^{-1}$ then yields $H(m)=1_G$, where $1_G$ is the identity element of $G$, for all $m$. Thus $H$ maps all inputs to $1_G$, and so finding preimages is either trivial (for $1_G$) or impossible (for any other elements of $G$). But I assume that's not the real answer; it seems more likely that your transcription of the exercise has a mistake. Dec 20 comment If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack? OK, and how do you map bitstrings to integers (and back)? Just by treating the bits as base-2 digits? If so, note that this map is not one-to-one, because it ignores leading zeros. Does your hash also ignore leading zeros? If so, that's a second-preimage attack right there. Of course, you seem to be asking for a first preimage, so it's not quite enough, but still... Dec 20 comment If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack? How do you define multiplication in $\{0,1\}^*$? Dec 20 comment Homomorphic OR operations Perhaps more usefully, as Ricky Demer suggests in his answer, if you invert the representation so that false = 1 and true = 0, then $x \lor y$ is simply $xy$. Dec 19 comment Hardware Random Numbers - How to convert Voltage signal into binary? I suspect you don't really want to use an ADC for this at all, since normal ADCs are designed to reject as much noise as possible. Instead, you could perhaps use an analog high-pass filter followed by a threshold detector, and sample the resulting digital signal directly. But that would really be a question for Electrical Engineering. Dec 19 comment Is (1 bit HW signal) XOR (8 bits PRNG output) sufficient for a HWRNG? @PaulUszak: Yes, at a minimum. Even then, while the randomness of the XORed output won't be less than the randomness of the stronger input, if both inputs are weak (e.g. the HWRNG is biased/correlated and the PRNG is not cryptographically secure) then the output might still be weak too. Dec 18 comment What do numbers in a crypto algorithm stand for? Is there a convention? It's perhaps worth remarking that Ed25519 (and Curve12219) was developed (and presumably named) by D.J. Bernstein, who's also responsible for the Salsa20 cipher mentioned in my answer, as well as the Poly1305 MAC (where the 1305 similarly stands for $2^{130}-5$). As remarkable a cryptographer as he is, his naming choices do seem to be rather, um, idiosyncratic sometimes. Dec 18 comment Is (1 bit HW signal) XOR (8 bits PRNG output) sufficient for a HWRNG? How do you define "(1 bit) XOR (8 bits)"? For example, what is 1 XOR 01001110? Is it 01001111, 10110001, 1, or something else? Dec 17 comment Can I store the initialisation vector (IV) in the filename? If you lose your decryption software, and don't have any documentation to let you rebuild it, you're kind of SOL anyway. Dec 17 comment How do we arrive to the equation for solving D in RSA? Dec 17 comment Factorizing N to derive D Dec 17 comment What is the difference between RCCA and CCA2? Relevant paper: eprint.iacr.org/2003/174.pdf Dec 17 comment Combining a block cipher with a (pseudo) OTP This scheme is not information-theoretically secure, thus losing the only advantage of OTP over conventional block/stream ciphers. Dec 14 comment Hash functions vs Stream Ciphers in terms of Speed Actually, as the person who asked the question you link to, I'm inclined to disagree with your premise that "We know that it's possible to create a hash using a stream cipher". As far as I can tell, none of the answers to the linked question actually present a construction that has been proven to turn a secure (i.e. indistinguishable for random) stream cipher into a secure (i.e. collision/preimage resistant) hash function. Dec 14 comment Test vectors for PRESENT algorithm? While the phrasing in the question may be a bit ambiguous, the way I interpret it is that the OP would like some other test vectors than these "usual" ones, for further testing. Dec 14 comment How to apply linear cryptanalysis to PRESENT? Ps. You might find this paper useful to skim, and maybe this as well. Dec 14 comment How to apply linear cryptanalysis to PRESENT? Your question seems quite broad to me, and you might want to narrow it down a bit. While I might be wrong, I don't think anyone's likely to post a complete walkthrough of cryptanalysing PRESENT here, and in any case, it might not even fit in our answer length limit. However, if you could tell us how much you've figured out on your own, and where specifically you're getting stuck, that might increase your chance of getting useful answers.