1,246 reputation
621
bio website
location
age
visits member for 2 years, 11 months
seen May 9 at 0:59

Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Your added comment addresses the issue, but it's not quite right. I'm afraid it would take more space than this comment box to point out why this (subtle) issue is difficult. If you're interested, see the introduction in Rogaway's paper on this topic (cs.ucdavis.edu/~rogaway/papers/ignorance.pdf).
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
It's important to note that none of the answers you get will be "definitions" of Preimage Resistance. That's because it doesn't have a good one for a given hash function (you can define it on families of hash functions, but I doubt anyone here will do that).
Nov
6
revised Is there a simple hash function that one can compute without a computer?
added 1308 characters in body
Nov
5
answered Is there a simple hash function that one can compute without a computer?
Oct
17
comment Does AES have any fixed-points?
By the way, finding a fixed-point in AES-128 is equivalent to inverting one round of Davies-Meyer built on AES; showing how to do this efficiently would be a startling result.
Oct
17
accepted Does AES have any fixed-points?
Oct
15
comment Does AES have any fixed-points?
Do you consider the proof that all AES permutations are even to be "suspicious" as well then?
Oct
15
comment Does AES have any fixed-points?
@Paŭlo In all fairness, this is probably a research question (ie, it's open and probably hard) and your answer above is quite sound as long as you emphasize that you must make this unproven (but reasonable) assumption about AES's randomness.
Oct
15
comment Does AES have any fixed-points?
But AES is not a random subset of the $2^{128}!$ permutations on 128 bits; for example, it generates only even permutations. How do we know it doesn't select only from the derangements?
Oct
15
asked Does AES have any fixed-points?
Oct
15
comment Now that quantum computers have been out for a while, has RSA been cracked?
"Their claimed speedup over classical algorithms appears to be based on a misunderstanding of a paper my colleagues van Dam, Mosca and I wrote on "The power of adiabatic quantum computing." That speed up unfortunately does not hold in the setting at hand, and therefore D-Wave's "quantum computer" even if it turns out to be a true quantum computer, and even if it can be scaled to thousands of qubits, would likely not be more powerful than a cell phone." -- Umesh Vazirani, UC Berkeley
Oct
15
comment What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
It should also be noted that 128-bit AES has had a lot more scrutiny than 192- and 256-bit AES.
Oct
12
comment Why has the RSA factoring challenge been withdrawn?
Perhaps RSA needed to invest that money into their new SecurID technology! :)
Oct
9
accepted What is the “Random Oracle Model” and why is it controversial?
Oct
9
awarded  Nice Question
Sep
30
accepted Converting a stream cipher into a block cipher
Sep
30
asked What is the “Random Oracle Model” and why is it controversial?
Sep
29
asked How did the Koblitz/Menezes papers affect the cryptography community?
Sep
28
comment For Diffie-Hellman, must g be a generator?
@Thomas: Improved attacks could also kill DH (or require parameter adjustments). I guess I'm trying to advocate that authors of cryptographic content stop saying (for example) "factoring large integers is impossible" and instead say "there is no publicly-known efficient factoring algorithm on conventional computers". Although I suppose it can get tiresome after a while. Nonetheless, I'm very careful to say the latter when teaching.
Sep
28
comment For Diffie-Hellman, must g be a generator?
Implied in all of the above is "according to current cryptanalysis". The parameters above are a function of (1) our current computing model and (2) our current state of knowledge.