Ilmari Karonen
Reputation
16,021
76/100 score
 May 5 comment How to calculate if probability is negligible or not @henry: See this post on meta.math.SE, and the linked posts in the sidebar, for some information about that message. However, I'm actually retracting my close vote, since, on a closer look, your question does contain a key term ("negligible probability") that is used in a somewhat specialized manner in crypto. (I've also posted an answer below that hopefully clarifies the meaning somewhat.) Apr 30 comment What does ⊕ mean in cryptography? BTW, questions like this are probably better suited for Cryptography Stack Exchange than for Stack Overflow. I've flagged this one for moderator attention, and asked them to migrate it there. Apr 30 comment What do $0^n$ and $1^n$ mean in cryptography? Related (but, despite what I first assumed, probably not really duplicate) question: What does the expression $1^n$ mean as a function argument? Apr 22 comment Multiple AES/ECB encryptions of different data with same key all end with same pattern Apr 18 comment Is MCrypt's 8-bit OFB mode secure? That's a good point, and I'd be grateful for any references to actual peer-reviewed articles proving (or disproving!) this claim. As far as I can tell myself, the proofs by Wooding do look reasonable at a glance, but I must admit that I didn't go over them in full detail, and they do involve a bunch of subtle details and corner cases one could easily stub one's toe against. Hence why I haven't accepted my own answer yet. Apr 16 comment AES plaintext is smaller than 128 bits - how to expand? Also note that key expansion does not actually mean what you seem to think it means. Apr 15 comment why are both ipad and opad required for HMAC? We could always replace one of the constants with 0, and the other with ipad ⊕ opad; all this would do is permute the keyspace. Apr 14 comment RFID Protocol Cryptanalysis After your edit, it's no longer clear what the actual scheme you're asking about is. You should either revert your question to its original state, or rewrite it to clearly describe the one specific scheme (or family of schemes) that you're interested in analyzing. If you wish to ask about a family of schemes, please try to limit the variation as much as possible, preferably to a small finite number of variants and/or a few adjustable numeric parameters like key length. Do not include parameters like "where $F$ is any function"; nobody can analyze a scheme at that level of generality. Apr 14 comment RFID Protocol Cryptanalysis XORing all the keys actually makes is worse: as soon as an attacker intercepts one $(k_i,r_i)$ pair, they can compute $k_{i+1} = k_i \oplus r_i$ and so impersonate the tag as many times as they want. Edit: The same holds also for $k_{i+1} = F(k_i)$, if anybody can compute $F$. If $F$ is secret (say, encryption with a secret key) then the first attack I describe won't apply, but the second may. Apr 14 comment Are there equivalent IVs in DES/CBC? If the key and the ciphertext are fixed, then no. If $P_1 = IV_1 \oplus D_K(C)$ and $P_2 = IV_2 \oplus D_K(C)$, then $P_1 \oplus P_2 = IV_1 \oplus D_K(C) \oplus IV_2 \oplus D_K(C) = IV_1 \oplus IV_2$. Thus, $P_1 = P_2$ if and only if $IV_1 = IV_2$. Apr 14 comment KDFs for symmetric encryption master key & serial number The length of the "info" parameter does not matter; it just needs to be unique for each derived key. Or, to put it the other way around, if you feed the same PRK and info parameters to HKDF-Expand, you get the same key out. As for using separate keys for encryption and authentication, many authenticated encryption schemes (including, notably, those based on generic composition of a cipher and a MAC) require it, for their security proofs to be valid. Apr 9 comment Randomness in generation of Virtual Machines from pre-built Image I suspect this is more of a question for Super User, or maybe Stack Overflow. But yes, in a sensible VM implementation, the guest OS ought to have some way to obtain entropy from the host (or at least have a seed file provided at start-up). Apr 9 comment Should I use ECB or CBC encryption mode for my block cipher? Let's not expand this answer too much, though -- the fact that it's so short is what lets it be shown in our site tour. Apr 9 comment KDFs for symmetric encryption master key & serial number @RichieFrame: Might as well use HKDF-SHA512, so you can say you're using a real standardized KDF. (HKDF is basically just a standardized answer to "How do I use HMAC as a KDF?") Apr 9 comment What do I use as the encryption key and initialization vector in AES cfb128 Does this answer your question? crypto.stackexchange.com/questions/3965/… Apr 8 comment Any efficient text-based steganographic schemes? Hi, Manish, and welcome to Crypto Stack Exchange. I took a quick look at your scheme, and it looks pretty clever. On the other hand (and with no fault on your part implied), your answer did make me start to wonder if this question might not be a bit too broad for a Q&A site like this one; while your project seems interesting enough, we'd really rather not see dozens of other people following your example and also coming here to post links to their own steganography tools. Thus, I've decided to vote to close this question; we'll see if other people here agree. Mar 28 comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message? ... Essentially, this holds whenever the ciphertext we're trying to decrypt is longer than the unicity-distance of the cipher. Mar 28 comment How can I do a brute force (ciphertext only) attack on an CBC-encrypted message? @RenéG: If there are only $2^{24}$ possible keys, as in the question above, the it's very unlikely that any of those keys would, just by chance, decrypt an 11-byte ciphertext to "black white". (The details depend on the cipher, but for, say, a modern additive stream cipher, the probability of this happening is about one in $2^{64}$, or about one in 18 quintillion (= billion billion).) Indeed, since there are far fewer than $2^{64}$ 11-character combinations of English words, it's extremely unlikely that a wrong key would decrypt your ciphertext to anything that looks like English. Mar 21 comment Is it safe to prefix the a key with a known value? @CodesInChaos: I would. HMAC does have its quirks (like the ability to easily construct equivalent keys of different length), but it's still a secure MAC with keys of any length (even if the nominal security level is capped by the hash output length), as long as they have enough entropy to resist brute force attacks. (That said, if you're using multiple HMAC keys derived from each other, you should probably ensure that they're all the same length, or otherwise that they cannot be equivalent. Using a proper KDF to derive your keys from a single master key is generally enough.) Mar 19 comment Deciphering text encrypted with a changing cipher @Paŭlo: Specifically, it's equivalent to the rarely used shift-register variant of CFB, where the encryption unit is smaller than a full cipher block. There are security proofs for that variant, too, although the IV requirements are slightly stricter. (Also, just noticed that my link was broken; fixed.)