1,176 reputation
618
bio website
location
age
visits member for 2 years, 8 months
seen Mar 20 at 4:52

Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
Thanks. Actually in my application there is a digest for every 4MiB, so the resend-problem isn't a problem. I wrote my question in a simplified form to focus on the essential issue.
Jul
21
asked Can I jettison MAC if I already have SHA1(M)?
Jun
7
comment Is there a simple hash function that one can compute without a computer?
The 6k$\pm$1 rule doesn't help much: every integer is between -2 and 3 mod 6. Half of these are even and therefore obviously composite; one is an odd divisible by 3, which is quickly found out. The last 2 satisfy the 6k$\pm$1 rule, so it tells you nothing further.
May
15
comment Exposing RSA private-key data… bad?
The $d$ is the RSA private exponent. Have a look at any exposition on RSA encryption for more details.
Feb
22
comment Exposing RSA private-key data… bad?
Thanks. I had never seen this attack on $n$ when we know $e$ and $d$.
Feb
22
comment Exposing RSA private-key data… bad?
Can you explain how you arrived at this (nice) solution? What was the motivation?
Feb
22
accepted Exposing RSA private-key data… bad?
Feb
20
asked Exposing RSA private-key data… bad?
Dec
2
accepted Why is MixColumns omitted from the last round of AES?
Nov
29
comment Why is MixColumns omitted from the last round of AES?
Thanks for your response, PulpSpy. However, my question is not so much about security implications, but rather "how does omissions of MixColumns make the inverse cipher similar to the cipher?" and "how does this help in implementing the cipher?" For the latter, I have always found it a pain to implement this special-case in AES where you have to omit MixColumns in the final round: for example, you can't use the precomputed tables.
Nov
29
answered What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
Nov
28
asked Why is MixColumns omitted from the last round of AES?
Nov
27
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Moving to chat.
Nov
26
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann: Normally public-inputs are given a priori then we (want to) say there is no efficient algorithm to compute a desired output. You cannot say that here since the algorithm is to simply output a correct preimage. When you have a block cipher (for example), the public inputs are the cipher and any pt/ct pairs. But the key is not public, so any algorithm that attacks the block cipher (usually the cipher's semantic security) must actually query its oracle(s) and produce a distinguisher. This cannot be efficiently done for good block ciphers.
Nov
19
asked What are the consequences of a MAC tag collision?
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann The essence of the problem is this: given a hash function $h$ (which has NO KEY!) and a digest $d=h(m)$, the hash function is "preimage resistant" iff there exists no efficient algorithm that outputs a preimage of $d$ under $h$. But this is silly! Of course there is an algorithm: Output m; works. The point is this: there is no hidden information for an algorithm to try and extract, so how can we define "hard" here? We don't have this problem with keyed algorithms like block-ciphers or public-key schemes... they are keyed.
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Rogaway is talking about collision resistance because it's the "weakest" notion of security for hash functions that people care about. In other words, collision resistance implies preimage resistance (I'm being informal here; Rogaway-Shrimpton formalizes all this).
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Your added comment addresses the issue, but it's not quite right. I'm afraid it would take more space than this comment box to point out why this (subtle) issue is difficult. If you're interested, see the introduction in Rogaway's paper on this topic (cs.ucdavis.edu/~rogaway/papers/ignorance.pdf).
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
It's important to note that none of the answers you get will be "definitions" of Preimage Resistance. That's because it doesn't have a good one for a given hash function (you can define it on families of hash functions, but I doubt anyone here will do that).
Nov
6
revised Is there a simple hash function that one can compute without a computer?
added 1308 characters in body