1,273 reputation
721
bio website
location
age
visits member for 3 years, 2 months
seen Oct 9 at 20:45

Oct
31
awarded  Nice Question
Aug
24
awarded  Yearling
Aug
1
awarded  Critic
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. I'm not sure why I would care about perturbing the ciphertext if the underlying message is immutable; padding attacks rely on being able to change the message (in order to decrypt it based on padding-validity rules). Anyway, thanks for your input.
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. My assertion that adversarial messages will (almost certainly) be rejected is based on the assumption that any perturbation to a string whose SHA1-digest is fixed-and-known is effectively immutable. Gave you give an example where this is false (choose any padding scheme you like).
Jul
24
comment Can I jettison MAC if I already have SHA1(M)?
It's standard in CCA security to give the adversary a decryption oracle (that's what every definition of CCA security does, that I've seen). You of course don't give the adversary credit for decrypting a message he's encrypted with the corresponding encryption oracle. (en.wikipedia.org/wiki/…)
Jul
22
comment Can I jettison MAC if I already have SHA1(M)?
Yeah, I know the padding attacks well.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
Thanks for the reply. Your "secure" above works even without encryption(!). My intent was to preserve privacy even in some "reasonable" attack model, meaning the adversary cannot decrypt C=E_K(M) even with access to a decryption oracle and subject to the usual complexity-theoretic limits.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
I thought about padding oracles, by the way, but any adversarial message is overwhelmingly likely to just be rejected (the same effect a MAC would cause). Another concern is extension attacks, but I think I've ruled those out as well.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
Thanks. Actually in my application there is a digest for every 4MiB, so the resend-problem isn't a problem. I wrote my question in a simplified form to focus on the essential issue.
Jul
21
asked Can I jettison MAC if I already have SHA1(M)?
Jun
7
comment Is there a simple hash function that one can compute without a computer?
The 6k$\pm$1 rule doesn't help much: every integer is between -2 and 3 mod 6. Half of these are even and therefore obviously composite; one is an odd divisible by 3, which is quickly found out. The last 2 satisfy the 6k$\pm$1 rule, so it tells you nothing further.
May
15
comment Exposing RSA private-key data… bad?
The $d$ is the RSA private exponent. Have a look at any exposition on RSA encryption for more details.
Feb
22
comment Exposing RSA private-key data… bad?
Thanks. I had never seen this attack on $n$ when we know $e$ and $d$.
Feb
22
comment Exposing RSA private-key data… bad?
Can you explain how you arrived at this (nice) solution? What was the motivation?
Feb
22
accepted Exposing RSA private-key data… bad?
Feb
20
asked Exposing RSA private-key data… bad?
Dec
2
accepted Why is MixColumns omitted from the last round of AES?
Nov
29
comment Why is MixColumns omitted from the last round of AES?
Thanks for your response, PulpSpy. However, my question is not so much about security implications, but rather "how does omissions of MixColumns make the inverse cipher similar to the cipher?" and "how does this help in implementing the cipher?" For the latter, I have always found it a pain to implement this special-case in AES where you have to omit MixColumns in the final round: for example, you can't use the precomputed tables.
Nov
29
answered What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?