1,273 reputation
721
bio website
location
age
visits member for 3 years, 3 months
seen Oct 9 at 20:45

Feb
22
comment Exposing RSA private-key data… bad?
Can you explain how you arrived at this (nice) solution? What was the motivation?
Nov
29
comment Why is MixColumns omitted from the last round of AES?
Thanks for your response, PulpSpy. However, my question is not so much about security implications, but rather "how does omissions of MixColumns make the inverse cipher similar to the cipher?" and "how does this help in implementing the cipher?" For the latter, I have always found it a pain to implement this special-case in AES where you have to omit MixColumns in the final round: for example, you can't use the precomputed tables.
Nov
27
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Moving to chat.
Nov
26
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann: Normally public-inputs are given a priori then we (want to) say there is no efficient algorithm to compute a desired output. You cannot say that here since the algorithm is to simply output a correct preimage. When you have a block cipher (for example), the public inputs are the cipher and any pt/ct pairs. But the key is not public, so any algorithm that attacks the block cipher (usually the cipher's semantic security) must actually query its oracle(s) and produce a distinguisher. This cannot be efficiently done for good block ciphers.
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann The essence of the problem is this: given a hash function $h$ (which has NO KEY!) and a digest $d=h(m)$, the hash function is "preimage resistant" iff there exists no efficient algorithm that outputs a preimage of $d$ under $h$. But this is silly! Of course there is an algorithm: Output m; works. The point is this: there is no hidden information for an algorithm to try and extract, so how can we define "hard" here? We don't have this problem with keyed algorithms like block-ciphers or public-key schemes... they are keyed.
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Rogaway is talking about collision resistance because it's the "weakest" notion of security for hash functions that people care about. In other words, collision resistance implies preimage resistance (I'm being informal here; Rogaway-Shrimpton formalizes all this).
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
@PaŭloEbermann Your added comment addresses the issue, but it's not quite right. I'm afraid it would take more space than this comment box to point out why this (subtle) issue is difficult. If you're interested, see the introduction in Rogaway's paper on this topic (cs.ucdavis.edu/~rogaway/papers/ignorance.pdf).
Nov
12
comment What is pre-image resistance, and how can the lack thereof be exploited?
It's important to note that none of the answers you get will be "definitions" of Preimage Resistance. That's because it doesn't have a good one for a given hash function (you can define it on families of hash functions, but I doubt anyone here will do that).
Oct
17
comment Does AES have any fixed-points?
By the way, finding a fixed-point in AES-128 is equivalent to inverting one round of Davies-Meyer built on AES; showing how to do this efficiently would be a startling result.
Oct
15
comment Does AES have any fixed-points?
Do you consider the proof that all AES permutations are even to be "suspicious" as well then?
Oct
15
comment Does AES have any fixed-points?
@Paŭlo In all fairness, this is probably a research question (ie, it's open and probably hard) and your answer above is quite sound as long as you emphasize that you must make this unproven (but reasonable) assumption about AES's randomness.
Oct
15
comment Does AES have any fixed-points?
But AES is not a random subset of the $2^{128}!$ permutations on 128 bits; for example, it generates only even permutations. How do we know it doesn't select only from the derangements?
Oct
15
comment Now that quantum computers have been out for a while, has RSA been cracked?
"Their claimed speedup over classical algorithms appears to be based on a misunderstanding of a paper my colleagues van Dam, Mosca and I wrote on "The power of adiabatic quantum computing." That speed up unfortunately does not hold in the setting at hand, and therefore D-Wave's "quantum computer" even if it turns out to be a true quantum computer, and even if it can be scaled to thousands of qubits, would likely not be more powerful than a cell phone." -- Umesh Vazirani, UC Berkeley
Oct
15
comment What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?
It should also be noted that 128-bit AES has had a lot more scrutiny than 192- and 256-bit AES.
Oct
12
comment Why has the RSA factoring challenge been withdrawn?
Perhaps RSA needed to invest that money into their new SecurID technology! :)
Sep
28
comment For Diffie-Hellman, must g be a generator?
@Thomas: Improved attacks could also kill DH (or require parameter adjustments). I guess I'm trying to advocate that authors of cryptographic content stop saying (for example) "factoring large integers is impossible" and instead say "there is no publicly-known efficient factoring algorithm on conventional computers". Although I suppose it can get tiresome after a while. Nonetheless, I'm very careful to say the latter when teaching.
Sep
28
comment For Diffie-Hellman, must g be a generator?
Implied in all of the above is "according to current cryptanalysis". The parameters above are a function of (1) our current computing model and (2) our current state of knowledge.
Sep
27
comment Is modern encryption needlessly complicated?
@Ivo: DES was regarded as "broken" upon release (due to key length); 3DES is still secure (but painfully slow); if you know an attack, please post it. 3DES has an effective key length of at least 110 bits. When I said that DES has never been broken, I mean the construction, not the parameter set.
Sep
27
comment In RSA, do I calculate d from e or e from d?
In general, I would trust this site for crypto more than wikipedia since things are vetted here pretty much immediately after they're written.
Sep
27
comment How to fairly select a random number for a game without trusting a third party?
Another fix is to require the number of random bits be higher than (say) 256, and disallow repeated digests. Or better, to force the 2nd publisher of a repeated digest to reveal first (better because it allows you conclusively identify cheaters).