1,176 reputation
618
bio website
location
age
visits member for 2 years, 7 months
seen Mar 20 at 4:52

Aug
2
comment Recent attacks on RSA
That post refers to the Blackhat speakers as "experts in cryptography." I have been a professional cryptographer for 20 years... I have never heard of these guys...
Aug
2
revised Recent attacks on RSA
added 4 characters in body
Aug
2
asked Recent attacks on RSA
Jul
26
answered Now that quantum computers have been out for a while, has RSA been cracked?
May
23
awarded  Popular Question
Apr
24
answered Are cryptographic hash functions perfect hash functions?
Jan
24
awarded  Nice Question
Jan
24
comment Why is MixColumns omitted from the last round of AES?
@PaŭloEbermann Yes, but you need a separate set of precomputed table just for the final round. This is onerous in environments where memory is tight.
Dec
13
awarded  Popular Question
Dec
4
revised What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
added 114 characters in body
Dec
4
awarded  Necromancer
Oct
31
awarded  Nice Question
Aug
24
awarded  Yearling
Aug
1
awarded  Critic
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. I'm not sure why I would care about perturbing the ciphertext if the underlying message is immutable; padding attacks rely on being able to change the message (in order to decrypt it based on padding-validity rules). Anyway, thanks for your input.
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. My assertion that adversarial messages will (almost certainly) be rejected is based on the assumption that any perturbation to a string whose SHA1-digest is fixed-and-known is effectively immutable. Gave you give an example where this is false (choose any padding scheme you like).
Jul
24
comment Can I jettison MAC if I already have SHA1(M)?
It's standard in CCA security to give the adversary a decryption oracle (that's what every definition of CCA security does, that I've seen). You of course don't give the adversary credit for decrypting a message he's encrypted with the corresponding encryption oracle. (en.wikipedia.org/wiki/…)
Jul
22
comment Can I jettison MAC if I already have SHA1(M)?
Yeah, I know the padding attacks well.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
Thanks for the reply. Your "secure" above works even without encryption(!). My intent was to preserve privacy even in some "reasonable" attack model, meaning the adversary cannot decrypt C=E_K(M) even with access to a decryption oracle and subject to the usual complexity-theoretic limits.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
I thought about padding oracles, by the way, but any adversarial message is overwhelmingly likely to just be rejected (the same effect a MAC would cause). Another concern is extension attacks, but I think I've ruled those out as well.