meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 9 months |
| seen | Apr 24 at 2:36 | |
| stats | profile views | 29 |
|
Feb 22 |
comment |
Exposing RSA private-key data… bad? Thanks. I had never seen this attack on $n$ when we know $e$ and $d$. |
|
Feb 22 |
comment |
Exposing RSA private-key data… bad? Can you explain how you arrived at this (nice) solution? What was the motivation? |
|
Feb 22 |
accepted | Exposing RSA private-key data… bad? |
|
Feb 20 |
asked | Exposing RSA private-key data… bad? |
|
Dec 2 |
accepted | Why is MixColumns omitted from the last round of AES? |
|
Nov 29 |
comment |
Why is MixColumns omitted from the last round of AES? Thanks for your response, PulpSpy. However, my question is not so much about security implications, but rather "how does omissions of MixColumns make the inverse cipher similar to the cipher?" and "how does this help in implementing the cipher?" For the latter, I have always found it a pain to implement this special-case in AES where you have to omit MixColumns in the final round: for example, you can't use the precomputed tables. |
|
Nov 29 |
answered | What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption? |
|
Nov 28 |
asked | Why is MixColumns omitted from the last round of AES? |
|
Nov 27 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? @PaŭloEbermann Moving to chat. |
|
Nov 26 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? @PaŭloEbermann: Normally public-inputs are given a priori then we (want to) say there is no efficient algorithm to compute a desired output. You cannot say that here since the algorithm is to simply output a correct preimage. When you have a block cipher (for example), the public inputs are the cipher and any pt/ct pairs. But the key is not public, so any algorithm that attacks the block cipher (usually the cipher's semantic security) must actually query its oracle(s) and produce a distinguisher. This cannot be efficiently done for good block ciphers. |
|
Nov 19 |
asked | What are the consequences of a MAC tag collision? |
|
Nov 12 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? @PaŭloEbermann The essence of the problem is this: given a hash function $h$ (which has NO KEY!) and a digest $d=h(m)$, the hash function is "preimage resistant" iff there exists no efficient algorithm that outputs a preimage of $d$ under $h$. But this is silly! Of course there is an algorithm: Output m; works. The point is this: there is no hidden information for an algorithm to try and extract, so how can we define "hard" here? We don't have this problem with keyed algorithms like block-ciphers or public-key schemes... they are keyed. |
|
Nov 12 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? @PaŭloEbermann Rogaway is talking about collision resistance because it's the "weakest" notion of security for hash functions that people care about. In other words, collision resistance implies preimage resistance (I'm being informal here; Rogaway-Shrimpton formalizes all this). |
|
Nov 12 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? @PaŭloEbermann Your added comment addresses the issue, but it's not quite right. I'm afraid it would take more space than this comment box to point out why this (subtle) issue is difficult. If you're interested, see the introduction in Rogaway's paper on this topic (cs.ucdavis.edu/~rogaway/papers/ignorance.pdf). |
|
Nov 12 |
comment |
What is pre-image resistance, and how can the lack thereof be exploited? It's important to note that none of the answers you get will be "definitions" of Preimage Resistance. That's because it doesn't have a good one for a given hash function (you can define it on families of hash functions, but I doubt anyone here will do that). |
|
Nov 6 |
revised |
Is there a simple hash function that one can compute without a computer? added 1308 characters in body |
|
Nov 5 |
answered | Is there a simple hash function that one can compute without a computer? |
|
Oct 17 |
comment |
Does AES have any fixed-points? By the way, finding a fixed-point in AES-128 is equivalent to inverting one round of Davies-Meyer built on AES; showing how to do this efficiently would be a startling result. |
|
Oct 17 |
accepted | Does AES have any fixed-points? |
|
Oct 15 |
comment |
Does AES have any fixed-points? Do you consider the proof that all AES permutations are even to be "suspicious" as well then? |
