Reputation
1,665
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 26
Impact
~70k people reached

  • 0 posts edited
  • 0 helpful flags
  • 155 votes cast
Mar
10
comment What is the intuition for ECDSA?
This is very helpful, but without the underlying material (ie, Schnorr signatures and identification scheme discussion) it still requires some work. But perhaps the most useful thing about your answer is that you show that ECDSA is the result of an evolution (from FS, FFS, Schnorr, DSA, then ECDSA) and that helps me know what legwork I need to undertake. Thanks Yehuda!
Mar
10
comment What is the intuition for ECDSA?
@HenrickHellström The wikipedia article doesn't give any answers to the questions I gave above: why are forgeries hard? Where did the formulas come from? Why won't a simpler scheme work? What idea(s) did the inventor(s) use to come up with this? Wikipedia just gives what most sources give: a rote recapitulation of the formulas with no explanation.
Mar
7
comment Why is OTP not vulnerable to brute-force attacks?
@DavidRicherby If $D$ is the probability distribution on plaintexts before the ciphertext $C$ is known, then we'd say Pr$[D] =$ Pr$[D | C]$. In other words, the distribution on plaintexts is unchanged by revelation of the ciphertext.
Mar
5
comment Why is OTP not vulnerable to brute-force attacks?
For a brute force attack to be useful, it has to reveal information you didn't already have before it was conducted. For OTP, brute forcing the keystream yields nothing.
Mar
5
comment Why is OTP not vulnerable to brute-force attacks?
@DavidRicherby It's not nonsense. It's math. The point is that both "bomb Baghdad" and "bomb Chicago" will appear as candidate plaintexts for a 12-character OTP ciphertext, but you have no additional information as to which it is. Or as a cryptographer would put it, "the information you have about the plaintext after seeing the ciphertext is the same as what you had before seeing the ciphertext." You say, "bomb Baghdad" is more likely, but you didn't learn that from the ciphertext; you're relying on information you already had.
Feb
25
comment DES_cblock and Key Recovery
See Thomas Pornin's answer to this question: security.stackexchange.com/questions/29106/… Does that help?
Sep
22
comment Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?
Thomas: you switched from SHA-256 in your answer to MD5 at the end. As you know, these are two different animals (neither animal, being a gorilla) since MD5 outputs only 128 bits and it has known collisions. Finding a collision by brute force (a suddenly very apt term in the present context) for a 128 bit hash is going to take "only" $2^{64}$ expected trials, making it roughly on par with gorilla attacks.
Sep
10
comment What NIST protocol was allegedly backdoored by NSA in 2006?
It wouldn't be the first time the media got something wrong; even the NYT makes technical mistakes occasionally. More likely, there is a wrong perception among researchers about the history of SP 800-90.
Aug
31
comment Recent attacks on RSA
Seems that Schneier (and other cryptographers) agree with me: schneier.com/blog/archives/2013/08/the_cryptopocal.html
Aug
30
comment Do ciphertexts leak information about their algorithmic creators?
So if I say "I have 1024 bits of ciphertext" you can definitively ascertain whether that is an output from Rijndael-1024, or it's three blocks of AES-CBC with a random IV? I can't.
Aug
25
comment Do ciphertexts leak information about their algorithmic creators?
@Ninveh You're confusing block cipher encipherment with full-blown encryption again. The concept of an "IV" does not apply to AES, Twofish, Serpent, etc. That's an idea used with modes in order to (typically) implement randomization. So you can't say "IV structure in some ciphers". In any case, the normal approach to security in crypto is to NOT try to hide which algorithms have been used at all (unless you are the NSA).
Aug
3
comment Recent attacks on RSA
Elliptic curve cryptanalysis has had 1/100th the attention of RSA and yet these guys want to run to it? I'm guessing if we start to convert to ECC, the recommended key lengths will quickly increase in the next few years.
Aug
3
comment Recent attacks on RSA
Thanks for posting this. I am not an algebraist, but breakthroughs in discrete log for small-characteristic finite fields doesn't seem particularly related to factoring in zero-characteristic rings like $\mathbb{Z}$. Of course it may be relevant to RSA (which is on the ring $\mathbb{Z}_N$) and despite many wrong proclamations in the cited articles, breaking RSA does not require factoring. In any case, in my opinion the presenters have overstepped in declaring a state of emergency with respect to RSA. Remember 10 years ago all the factorization papers (Bernstein and Shamir mostly)?
Aug
2
comment Recent attacks on RSA
That post refers to the Blackhat speakers as "experts in cryptography." I have been a professional cryptographer for 20 years... I have never heard of these guys...
Jan
24
comment Why is MixColumns omitted from the last round of AES?
@PaĆ­loEbermann Yes, but you need a separate set of precomputed table just for the final round. This is onerous in environments where memory is tight.
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. I'm not sure why I would care about perturbing the ciphertext if the underlying message is immutable; padding attacks rely on being able to change the message (in order to decrypt it based on padding-validity rules). Anyway, thanks for your input.
Jul
29
comment Can I jettison MAC if I already have SHA1(M)?
@D.W. My assertion that adversarial messages will (almost certainly) be rejected is based on the assumption that any perturbation to a string whose SHA1-digest is fixed-and-known is effectively immutable. Gave you give an example where this is false (choose any padding scheme you like).
Jul
24
comment Can I jettison MAC if I already have SHA1(M)?
It's standard in CCA security to give the adversary a decryption oracle (that's what every definition of CCA security does, that I've seen). You of course don't give the adversary credit for decrypting a message he's encrypted with the corresponding encryption oracle. (en.wikipedia.org/wiki/…)
Jul
22
comment Can I jettison MAC if I already have SHA1(M)?
Yeah, I know the padding attacks well.
Jul
21
comment Can I jettison MAC if I already have SHA1(M)?
Thanks for the reply. Your "secure" above works even without encryption(!). My intent was to preserve privacy even in some "reasonable" attack model, meaning the adversary cannot decrypt C=E_K(M) even with access to a decryption oracle and subject to the usual complexity-theoretic limits.