Reputation
18,546
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
1 28 75
Impact
~444k people reached

Sep
17
comment Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?
@fgrieu: That's a good suggestion. I've edited the question and my answer to do just that.
Sep
17
comment Symmetric stream cipher, is it known?
I can't really know, but I do have a hunch. We do, with some regularity, get "questions" here that basically go "Hey everybody! I've invented this awesome new cipher, isn't it great?" Usually, those get downvoted (and often closed, since we have a policy against asking for cryptanalysis of homebrew ciphers). I don't really think your question is one of those, or at least not a typical member of the bunch, but it does look similar at a glance. I can see how someone might have downvoted it on that basis. Anyway, voting (both up and down) is really up to each individual voter.
Sep
17
comment Symmetric stream cipher, is it known?
It's basically a combination of several (binary) Vigenère ciphers, applied consecutively. I don't know if it has a specific name, though.
Sep
17
comment Does $(u_1=r_1\cdot x,\ \ w_1=r_1\cdot z, \ \ u_2=r_2\cdot x,\ \ w_2=r_2\cdot z)$ Leak Information?
What are you trying to accomplish with this? In particular, which of the values $x$, $z$, $r_1$ and $r_2$ do you wish to keep secret, and why?
Sep
17
comment Obtain 384 bits from a 256bit MasterSecret
Yes, or derive the IV from something unique that you do send with the message, such as a message ID. (In fact, GCM accepts IVs of any size, so you can just use the message ID directly as the IV if you want.) Also, if two (or more) users are using the same key to encrypt messages, you'll need to ensure that they don't use the same IVs, e.g. by having one of them only use even IVs, and having the other use only odd IVs.
Sep
17
comment Obtain 384 bits from a 256bit MasterSecret
That's a good choice. That said, HKDF is pretty easy to implement yourself.
Sep
16
comment Picking a nonce in the context of CCM (CTR with CBC-MAC) mode
There is no need to encrypt the nonce.
Sep
16
comment Picking a nonce in the context of CCM (CTR with CBC-MAC) mode
Typically, you would either send the nonce along with the message, or derive it from other unique information associated with the message, such as a message ID.
Sep
16
comment apprSVP in lattices
Hi, preethi, and welcome to Crypto Stack Exchange. I've copyedited your question a bit to hopefully make it clearer and easier to understand. Could you please check that I didn't accidentally introduce any errors while doing so? If you do find anything that you think should be corrected, please feel free to edit your question further yourself. Thanks!
Sep
14
comment Comparing two definitions of one-way function
You can pick a specific model of computation to implement your algorithm, and measure the precise time that way. But the nice thing about "polynomial time" is that we don't really need to worry about such details, since, for example, a polynomial multiplied by any constant factor (or any other polynomial!) is still a polynomial. (The trade off here is that "polynomial time" is kind of a loose concept; an algorithm that scales as, say, $O(n^{1000})$ is technically polynomial-time, but unlikely to be practical for very large $n$.)
Sep
10
comment Fast 128-bit MAC with second preimage resistance?
Are you sure you don't need (at least some form of) collision resistance? If the person generating the messages thinks they might want to find a second preimage later, they could plan ahead and only send messages for which they already have a second colliding message prepared.
Sep
9
comment Is it safe to exchange cryptographic salt and initialization vector in messages?
As Yehuda Lindell notes below, re-running PBKDF2 for every message is very inefficient. The fewer times you need to run PBKDF2, the less computation time you waste on it (and the more you can increase the iteration count, in turn, making it more secure).
Sep
9
comment Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?
Also, Baradwaj, I edited your question to clean up the formatting and style a bit. I tried to avoid changing it too much, but if you feel that my edits lost something relevant, or made it say something that you didn't intend, please feel free to edit it back yourself. Oh, and welcome to crypto.SE!
Sep
9
comment Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?
I'm not sure that this really counts as a crypto question, since it's really more about pure math. But it's a follow-up to an existing question on this site, and in any case already has an answer here, so I guess I should give it the benefit of the doubt. There's a pretty wide overlap in scope between crypto and Mathematics here, anyway.
Sep
7
comment How does FileVault2 Recovery actually work?
@mephisto: I think this question is on-topic here at crypto.SE. It could perhaps use some editing to clarify it, but the basic question is about crypto (key wrapping), even if it's at a fairly high abstraction level.
Sep
3
comment CBC-MAC just to verify integrity
Read the Wikipedia article I linked to. The main issue is that the inputs to CBC-MAC need to be prefix-free, i.e. no valid message can be a prefix of another valid message. (One way to achieve this is to prepend a length field to the messages.)
Aug
29
comment Generate RSA-2048 private key for a VERY fast decryption (don't care if it will be unsecure)
Of course, once you've got your certificate approved, you can just configure your server to use $e=1$, too!
Aug
26
comment Can RSA be securely used for “blind decryption”?
I might well be missing a reasonable use case for this protocol, though; it's getting late here and I really should get some sleep. What does seem clear to me, though, is that the ability to use Charlie as a decryption oracle is a major and rather fundamental security issue here.
Aug
25
comment What is matrix branching program?
It might help if you could make your question a bit more specific. Good questions here on Stack Exchange should be reasonably scoped, so that they can be answered in a few pages of text (or less). While I really don't know anything about the subject, I'd guess there's a good chance that "explain matrix branching programs to me" may be too broad a question for this site.
Aug
24
comment How can I handle the situation if key size is less than 64 bits in DES?
@poncho: Fair enough. Corrected.