Reputation
15,004
Next tag badge:
320/400 score
61/80 answers
Badges
1 21 67
Newest
 Enlightened
Impact
~330k people reached

Feb
14
comment Which characters to take into account when calculating unicity distance?
The math is correct, as far as it goes, but the unicity distance is measured in characters, not in bits (at least if $D$ is measured in bits / character; if you measured $D$ in, say, bits / cipher block, then $U$ would be in cipher blocks). So the correct answer should be $U\approx 23.27$ characters (except that this assumes 7-bit bytes, even though pretty much every digital cipher ever works on 8-bit bytes, so $D$ should be around $6.5$, not $5.5$, giving $U\approx19.69$ characters -- pretty close to @poncho's 20 characters).
Feb
9
comment Is there any advantage on encrypting the CMAC together with the message?
If you have any influence on this scheme, I would strongly suggest replacing it with AES-SIV, which is based on the same primitives (AES, CTR mode and CMAC), but is stronger (128-bit tag), less vulnerable to misuse (can be used even without an nonce), may have less overhead (assuming your scheme transmits an IV/nonce for CTR mode) and has an actual security proof.
Feb
9
comment Noisiest RF band for random number generation
+1 Besides, using RF noise for random numbers is wide open to active attacks: an attacker can just transmit on the frequency your RNG is tuned to.
Feb
8
comment RSA with composite numbers
Related: crypto.stackexchange.com/questions/5170/…
Feb
8
comment Simple multiplication as an encryption method
See the part below the horizontal line.
Feb
3
comment CPA security of a stateless and deterministic encryption system
Essentially the same argument also works for symmetric ciphers, since the definition of IND-CPA security assumes that the attacker has access to an encryption oracle.
Jan
14
comment Specification of the Megamos crypto algorithm
Just for posterity, let me note that the protocol description that you quote above, via the cybergibbons website, appears to be originally quoted (without attribution, alas) from my answer to this question. (The cybergibbons version also has what appears to be a minor editing mistake in the second-to-last step, where it reads ${\rm T \to C}: r,G$ instead of ${\rm T \to C}: G'$, but you seem to have fixed that.)
Jan
6
comment Encryption for a short packet size
@BaruchEven: Yes, counter mode is safe even with predictable IVs, as long as they're never repeated. Generally, only CBC mode (and certain variants of CFB) requires unpredictable IVs.
Jan
5
comment Why is the private key generated first in public key crypto?
@yyyyyyy: In fact, many RSA implementations do store $p$ and $q$ as part of the private key, since doing so allows using the Chinese remainder theorem to speed up the algorithm.
Jan
3
comment Why are there no MACs inspired by block cipher modes other than CBC and CFB?
Please clarify your question, especially the statement quoted by Ricky. None of the traditional cipher modes (ECB, CBC, CFB, OFB and CTR) include a MAC, nor can they be (directly) used as one. There are MAC constructions that do bear some resemblance to these modes, such as CBC-MAC and its modern replacement CMAC, but those are separate constructions (although CBC and CBC-MAC do work very similarly). (Also, MAC usually stands for message authentication code; if you really mean mutual, please clarify that too.)
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Thanks, @Gilles! (Ps. I have no idea why I typed "Ability" instead of "Attribute" above. Must've been a brain fart.)
Dec
30
comment Is the DES F-function injective for a given subkey?
We just had a very similar (but apparently not duplicate) question less than 24 hours earlier. Just out of idle curiosity, are these coming from some online course or something, or is it just a remarkable coincidence?
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Also, I think we could use a broadcast-encryption tag. Would anyone more familiar with the topic than me want to create one (and look for some old posts to tag it with)?
Dec
30
comment Attribute-based broadcast encryption with respect to ABE
Based on a quick Google search, I assume those acronyms stand for Ability Based (Broadcast) Encryption?
Dec
29
comment Do I have to transfer the private key to digitally sign a remote document?
Also, one specific issue that puzzled me: if the user uploads the document to your server, is there some reason why they can't simply sign it before they upload it? Your server could then verify that the document has been properly signed, using the user's public key.
Dec
29
comment Do I have to transfer the private key to digitally sign a remote document?
Hi, rtan, and welcome to Crypto Stack Exchange. I tried to edit your question to make it a bit clearer, but I'm not 100% sure I interpreted all of it correctly. Could you please check that I didn't introduce any mistakes, and if you find some, edit the question to fix them? Thanks!
Dec
29
comment Embedded devices Authentication, Integrity and Confidentiality
@DmitryKhovratovich: A per device AES-GCM key can take place of public/private key pairs but what happens if the server was hacked and all the keys go with it? But your point about needing a RNG is quite important, which I really didn't take into account. [Note: This was posted by the OP as a non-answer, because they've apparently lost access to their original account.]
Dec
29
comment Embedded devices Authentication, Integrity and Confidentiality
@RobertNACIRI: When the devices are programmed with public/private key pairs. The public keys are recorded and sent to the server by the admin. The devices are programmed in batches. The server certificate will be CA issued(for revocation and easy verification etc). The client key pair is generated at the factory. A bit like generating GPG key pairs. [Note: This was posted by the OP as a non-answer, because they've apparently lost access to their original account.]
Dec
28
comment How are random numbers for RSA generated?
Related: crypto.stackexchange.com/questions/71/…, crypto.stackexchange.com/questions/1970/…, crypto.stackexchange.com/questions/690/…, crypto.stackexchange.com/questions/2532/…. In fact, I'd say the first two are essentially dupes.
Dec
28
comment How are random numbers for RSA generated?
Ensuring that the number is odd will not save much time testing it, but it will save you some RNG calls. It's not a huge optimization, but it's trivial to make and does provide some benefit.