221 reputation
7
bio website github.com/louismullie
location Montréal, Canada
age 22
visits member for 10 months
seen yesterday

Apr
11
comment Difference between plain AES CTR and “CCM-style” CTR
This was helpful re: "standard" CTR functionality: security.stackexchange.com/questions/4606/…
Apr
11
accepted Difference between plain AES CTR and “CCM-style” CTR
Apr
10
comment Difference between plain AES CTR and “CCM-style” CTR
In this case the ctr is initialized with an array of 4 big-endian words, each 4 bytes in length. From what I can tell, this array is used a) to store the L parameter + the IV (up to 12 bytes) and b) to store the counter (4 bytes). Can I just replace the L+IV part with a 12-byte IV, keep the 4-byte counter and do away with all of the rest of the code that deals with authentication?
Apr
10
asked Difference between plain AES CTR and “CCM-style” CTR
Apr
10
revised Security of this deterministic encryption scheme
edited tags
Apr
10
comment Security of this deterministic encryption scheme
@fgrieu Is SIV vulnerable to the same types of side-channel attacks?
Apr
10
accepted What's wrong with this “order-preserving MAC” function?
Apr
9
asked Security of this deterministic encryption scheme
Apr
8
comment What's wrong with this “order-preserving MAC” function?
Excellent, thanks for your help.
Apr
8
comment What's wrong with this “order-preserving MAC” function?
Can this attack be mitigated if the step size is derived from the initial secret, such that it falls within a suitably large random range, and kept away from the adversary?
Apr
8
comment What's wrong with this “order-preserving MAC” function?
Now I see where this scheme fails. Any of you guys care to put up your comment as an answer?
Apr
8
comment What's wrong with this “order-preserving MAC” function?
@fgrieu 1) I updated the title - indeed it's a MAC that is used, as shown in the pseudo-code. 2) I updated the pseudo-code to make it clear what this does.
Apr
8
revised What's wrong with this “order-preserving MAC” function?
edited title
Apr
8
revised What's wrong with this “order-preserving MAC” function?
edited title
Apr
8
comment What's wrong with this “order-preserving MAC” function?
In theory no, but in practice I imagine an attacker could guess a few values (for example if a value is always initialized to 0, and the attacker is allowed to observe values right after they have been initialized). So let's assume the attacker does have known plaintext (but only through "guessing"). I'm not sure how to state that assumption in technical terms.
Apr
8
comment What's wrong with this “order-preserving MAC” function?
@figlesquidge Thanks! that makes it much clearer and look more professional. Yes, I am implying that the adversary cannot ask for the "encryption" of a chosen plaintext.
Apr
8
awarded  Commentator
Apr
8
comment What's wrong with this “order-preserving MAC” function?
@RickyDemer Yes - edited accordingly. To the downvoter, care to explain why this is not a good question? I'm asking specifically why this is NOT secure.
Apr
8
revised What's wrong with this “order-preserving MAC” function?
deleted 9 characters in body
Apr
8
comment What's wrong with this “order-preserving MAC” function?
Additionally, assume that the input random secret to the keyGen procedure is kept secret (i.e. the adversary is only allowed to observe the output of the function).