Reputation
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
1 30 79
Newest
 encryption
Impact
~500k people reached

Sep
16
comment apprSVP in lattices
Hi, preethi, and welcome to Crypto Stack Exchange. I've copyedited your question a bit to hopefully make it clearer and easier to understand. Could you please check that I didn't accidentally introduce any errors while doing so? If you do find anything that you think should be corrected, please feel free to edit your question further yourself. Thanks!
Sep
14
comment Comparing two definitions of one-way function
You can pick a specific model of computation to implement your algorithm, and measure the precise time that way. But the nice thing about "polynomial time" is that we don't really need to worry about such details, since, for example, a polynomial multiplied by any constant factor (or any other polynomial!) is still a polynomial. (The trade off here is that "polynomial time" is kind of a loose concept; an algorithm that scales as, say, $O(n^{1000})$ is technically polynomial-time, but unlikely to be practical for very large $n$.)
Sep
10
comment Fast 128-bit MAC with second preimage resistance?
Are you sure you don't need (at least some form of) collision resistance? If the person generating the messages thinks they might want to find a second preimage later, they could plan ahead and only send messages for which they already have a second colliding message prepared.
Sep
9
comment Is it safe to exchange cryptographic salt and initialization vector in messages?
As Yehuda Lindell notes below, re-running PBKDF2 for every message is very inefficient. The fewer times you need to run PBKDF2, the less computation time you waste on it (and the more you can increase the iteration count, in turn, making it more secure).
Sep
9
comment Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?
Also, Baradwaj, I edited your question to clean up the formatting and style a bit. I tried to avoid changing it too much, but if you feel that my edits lost something relevant, or made it say something that you didn't intend, please feel free to edit it back yourself. Oh, and welcome to crypto.SE!
Sep
9
comment Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?
I'm not sure that this really counts as a crypto question, since it's really more about pure math. But it's a follow-up to an existing question on this site, and in any case already has an answer here, so I guess I should give it the benefit of the doubt. There's a pretty wide overlap in scope between crypto and Mathematics here, anyway.
Sep
7
comment How does FileVault2 Recovery actually work?
@mephisto: I think this question is on-topic here at crypto.SE. It could perhaps use some editing to clarify it, but the basic question is about crypto (key wrapping), even if it's at a fairly high abstraction level.
Sep
3
comment CBC-MAC just to verify integrity
Read the Wikipedia article I linked to. The main issue is that the inputs to CBC-MAC need to be prefix-free, i.e. no valid message can be a prefix of another valid message. (One way to achieve this is to prepend a length field to the messages.)
Aug
29
comment Generate RSA-2048 private key for a VERY fast decryption (don't care if it will be unsecure)
Of course, once you've got your certificate approved, you can just configure your server to use $e=1$, too!
Aug
26
comment Can RSA be securely used for “blind decryption”?
I might well be missing a reasonable use case for this protocol, though; it's getting late here and I really should get some sleep. What does seem clear to me, though, is that the ability to use Charlie as a decryption oracle is a major and rather fundamental security issue here.
Aug
25
comment What is matrix branching program?
It might help if you could make your question a bit more specific. Good questions here on Stack Exchange should be reasonably scoped, so that they can be answered in a few pages of text (or less). While I really don't know anything about the subject, I'd guess there's a good chance that "explain matrix branching programs to me" may be too broad a question for this site.
Aug
24
comment How can I handle the situation if key size is less than 64 bits in DES?
@poncho: Fair enough. Corrected.
Aug
24
comment Encryption of 8 bit of block data
@SEJPM: That's a very good point. I originally meant to suggest using a MAC for integrity protection, but forgot that while writing the answer. I've corrected that omission now.
Aug
24
comment Encryption of 8 bit of block data
In particular, if random access is needed, using a (conventional, e.g. 128-bit) block cipher in CTR mode as your stream cipher could be a good choice. But do note that CTR mode, like stream ciphers in general, may be insecure if the data can change.
Aug
2
comment Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $
@dylan7: If the two values are equal, you'll need to discard them both, and get two new values. Basically, you're taking in two random values A and B (from any distribution) and returning either 1 (if A > B), 0 (if A < B) or no value (if A = B). Otherwise, you may end up with biased results. For reference, this is basically a variant of von Neumann whitening, extended to non-binary input distributions.
Aug
2
comment Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $
@dylan7: Ah, no. You don't need the mean for anything. What Chris is saying is that you should take two random values, and see which one is greater. Assuming that they're independent and identically distributed, and that they don't happen to be equal, that will give you one unbiased bit. Then take two more values and compare them to get another bit, and so on.
Aug
2
comment Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $
@dylan7: You may have just demonstrated that your pseudo-RNG isn't as random as you think it is. In fact, serial correlation between successive samples is a common flaw in popular LCRNGs.
Aug
2
comment Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $
Note that, for this method to really generate unbiased bits, you'll have to discard both $A$ and $B$ and repeat the process if $A=B$. In fact, such rejection sampling is unavoidable in general: for input distributions having less than 0.5 bits of entropy, there's no way to get an unbiased output bit without sometimes consuming more than two input samples. Also note that this scheme relies on the samples being independent; if subsequent samples may be linked (as they, inevitably, are for PRNGs; good PRNGs try to hide this dependence, more or less successfully), the output can easily be biased.
Aug
2
comment Extend OTP on random data?
@MaartenBodewes: This seems related, at least.
Jun
29
comment Establishing encryption key using shared secret
You might not actually need a hash for authentication either, if you e.g. replace HMAC with CMAC. If you're using public key signatures, though, those probably do require a hash (among other machinery).