Fixee

877 reputation

214

bio	website
	location
	age
visits	member for	1 year, 10 months
	seen	Apr 24 at 2:36
stats	profile views	29

	877 reputation	bio	website		visits	member for	1 year, 10 months
214 badges		location			seen	Apr 24 at 2:36

summary answers questions tags badges favorites bounties reputation activity

110 Actions

suggestions reviews revisions comments badges posts accepts all

May 23	awarded	Popular Question
Apr 24	answered	Are cryptographic hash functions perfect hash functions?
Jan 24	awarded	Nice Question
Jan 24	comment	Why is MixColumns omitted from the last round of AES? @PaŭloEbermann Yes, but you need a separate set of precomputed table just for the final round. This is onerous in environments where memory is tight.
Dec 13	awarded	Popular Question
Dec 4	revised	What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption? added 114 characters in body
Dec 4	awarded	Necromancer
Oct 31	awarded	Nice Question
Aug 24	awarded	Yearling
Aug 1	awarded	Critic
Jul 29	comment	Can I jettison MAC if I already have SHA1(M)? @D.W. I'm not sure why I would care about perturbing the ciphertext if the underlying message is immutable; padding attacks rely on being able to change the message (in order to decrypt it based on padding-validity rules). Anyway, thanks for your input.
Jul 29	comment	Can I jettison MAC if I already have SHA1(M)? @D.W. My assertion that adversarial messages will (almost certainly) be rejected is based on the assumption that any perturbation to a string whose SHA1-digest is fixed-and-known is effectively immutable. Gave you give an example where this is false (choose any padding scheme you like).
Jul 24	comment	Can I jettison MAC if I already have SHA1(M)? It's standard in CCA security to give the adversary a decryption oracle (that's what every definition of CCA security does, that I've seen). You of course don't give the adversary credit for decrypting a message he's encrypted with the corresponding encryption oracle. (en.wikipedia.org/wiki/…)
Jul 22	comment	Can I jettison MAC if I already have SHA1(M)? Yeah, I know the padding attacks well.
Jul 21	comment	Can I jettison MAC if I already have SHA1(M)? Thanks for the reply. Your "secure" above works even without encryption(!). My intent was to preserve privacy even in some "reasonable" attack model, meaning the adversary cannot decrypt C=E_K(M) even with access to a decryption oracle and subject to the usual complexity-theoretic limits.
Jul 21	comment	Can I jettison MAC if I already have SHA1(M)? I thought about padding oracles, by the way, but any adversarial message is overwhelmingly likely to just be rejected (the same effect a MAC would cause). Another concern is extension attacks, but I think I've ruled those out as well.
Jul 21	comment	Can I jettison MAC if I already have SHA1(M)? Thanks. Actually in my application there is a digest for every 4MiB, so the resend-problem isn't a problem. I wrote my question in a simplified form to focus on the essential issue.
Jul 21	asked	Can I jettison MAC if I already have SHA1(M)?
Jun 7	comment	Is there a simple hash function that one can compute without a computer? The 6k$\pm$1 rule doesn't help much: every integer is between -2 and 3 mod 6. Half of these are even and therefore obviously composite; one is an odd divisible by 3, which is quickly found out. The last 2 satisfy the 6k$\pm$1 rule, so it tells you nothing further.
May 15	comment	Exposing RSA private-key data… bad? The $d$ is the RSA private exponent. Have a look at any exposition on RSA encryption for more details.