1,844 reputation
18
bio website
location
age
visits member for 1 year, 2 months
seen 20 hours ago

Mar
3
reviewed Approve suggested edit on What RC4 key value will completely invert $S$ after initial permutation?
Mar
3
comment IND-CPA Security
Why didn't you mention that before? I can't be bothered looking up the details of the KDF, but for any reasonable KDF the answer is yes.
Mar
1
comment IND-CPA Security
If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs?
Feb
28
comment IND-CPA Security
What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ...
Feb
24
comment Using ECDSA keys for encryption
I agree that using ECIES and ECDSA with the same key is probably safe, but that you shouldn't do it. About provability: I don't think a proof of security for ECDSA is known (not counting generic group model proofs). A proof of joint security would imply a proof of ECDSA security, so we can't expect such a joint proof. Probably you could prove that the ECDSA signing oracle doesn't break ECIES if you only sign each message once.
Feb
20
comment Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?
Just to be clear, the protocol is obviously not secure. Alice has no security. Bob has some security, but probably not enough. The interesting part is of course finding attacks. A nice exercise.
Feb
20
revised Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
added 255 characters in body
Feb
20
revised Homomorphic crypto allowing anonymous yes/no votes?
added 120 characters in body
Feb
20
comment Homomorphic crypto allowing anonymous yes/no votes?
You would not use zero knowledge proofs to prevent voters from voting more than once. You would instead record the voter identities along with the ciphertext they submit, which would allow you to do what you want (reject all ballots, reject all but the first, discard all but the final, etc.). Obviously, you need to authenticate somehow before accepting the ballot.
Feb
19
comment Is use of pre-shared key for sharing session key in symmetric key cryptography vulnerable to MITM?
Does $Pk(\dots)$ denote encryption with $Pk$ as key? Pretend you are Alice and that you have just completed a protocol run. What do you know? What can you deduce about Bob? Don't forget that you and Bob are have other instances of the protocol running in parallel.
Feb
19
answered Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Feb
19
answered Homomorphic crypto allowing anonymous yes/no votes?
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
Yes, random IV works.
Feb
14
comment Does RSA work for any message M?
One really minor nitpick: Don't use CRT. It is sufficient to note that if $p$ and $q$ both divide $Z$, then $pq$ divides $Z$.
Feb
13
comment crypto design with AES256 MODE OFB
Usability is important. Nobody wants to type the same password over and over again. Typically, you solve this by remembering the password for some time (or until something happens). Preserving the integrity of the entire database may be a good idea, and may remove the need for per-entry integrity protection, but do use HMAC with a key derived from the passphrase. BTW. It is probably not the case that SHA512 gives you more security than SHA256. Overdoing key size and hash length looks silly.
Feb
13
comment crypto design with AES256 MODE OFB
You didn't do too badly. Using OFB over CBC doesn't add significantly to the adversary's cost, that is taken care of by PBKDF2. It would be good to use something that preserves integrity. You could probably do something like tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-02 using the tools you have.
Feb
12
comment Proofs by reduction and times of adversaries
If you want to complicate the picture, you could also mention that there is a tight reduction to RSA-FDH from a one-more-type RSA problem. And the best analysis suggests that the one-more-type RSA problem is no easier than the RSA problem.
Feb
12
answered crypto design with AES256 MODE OFB
Feb
10
comment Computationaly hard detokenization algorithm for credit card numbers
As fgrieu suggests, itaifrenkel should probably think again and see if he can change the situation. Placing the tokenizer/detokenizer inside a smart card may be feasible and may provide real security.
Feb
9
comment Computationaly hard detokenization algorithm for credit card numbers
Yes, $V$ should respond with any secrets. I've fixed it. There are no long-term secrets in the solution, so it doesn't matter.