1,764 reputation
8
bio website
location
age
visits member for 11 months
seen 13 hours ago

Feb
19
answered Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?
Feb
19
answered Homomorphic crypto allowing anonymous yes/no votes?
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
Yes, random IV works.
Feb
14
comment Does RSA work for any message M?
One really minor nitpick: Don't use CRT. It is sufficient to note that if $p$ and $q$ both divide $Z$, then $pq$ divides $Z$.
Feb
13
comment crypto design with AES256 MODE OFB
Usability is important. Nobody wants to type the same password over and over again. Typically, you solve this by remembering the password for some time (or until something happens). Preserving the integrity of the entire database may be a good idea, and may remove the need for per-entry integrity protection, but do use HMAC with a key derived from the passphrase. BTW. It is probably not the case that SHA512 gives you more security than SHA256. Overdoing key size and hash length looks silly.
Feb
13
comment crypto design with AES256 MODE OFB
You didn't do too badly. Using OFB over CBC doesn't add significantly to the adversary's cost, that is taken care of by PBKDF2. It would be good to use something that preserves integrity. You could probably do something like tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-02 using the tools you have.
Feb
12
comment Proofs by reduction and times of adversaries
If you want to complicate the picture, you could also mention that there is a tight reduction to RSA-FDH from a one-more-type RSA problem. And the best analysis suggests that the one-more-type RSA problem is no easier than the RSA problem.
Feb
12
answered crypto design with AES256 MODE OFB
Feb
10
comment Computationaly hard detokenization algorithm for credit card numbers
As fgrieu suggests, itaifrenkel should probably think again and see if he can change the situation. Placing the tokenizer/detokenizer inside a smart card may be feasible and may provide real security.
Feb
9
comment Computationaly hard detokenization algorithm for credit card numbers
Yes, $V$ should respond with any secrets. I've fixed it. There are no long-term secrets in the solution, so it doesn't matter.
Feb
9
revised Computationaly hard detokenization algorithm for credit card numbers
Fixed the 'compromise' message, improved last paragraph.
Feb
8
comment Computationaly hard detokenization algorithm for credit card numbers
I think so. I've added a paragraph at the end.
Feb
8
revised Computationaly hard detokenization algorithm for credit card numbers
How to increase cost of tokenization.
Feb
7
answered One-way permutation over a small interval?
Feb
6
answered Computationaly hard detokenization algorithm for credit card numbers
Feb
5
comment Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?
The Wikipedia page on cryptographically secure pseudo-random generators isn't a good reference, because it requires "backtracking resistance", which is non-standard. Also, the best definition of pseudo-random generator uses indistinguishability, not next-bit-unpredictability. The two notions are equivalent, of course, but the indistinguishability definition is best.
Feb
5
answered Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?
Feb
4
revised Perfect Secrecy -> One Time Semantic Security -> Secure PRG
added 501 characters in body
Feb
4
comment Perfect Secrecy -> One Time Semantic Security -> Secure PRG
Supposedly: Andrew C. Yao. Theory and Applications of Trapdoor Functions. In Proceedings of the 23rd IEEE Symposium on Foundations of Computer Science, pages 80– 91. IEEE Computer Society, 1982.
Feb
4
comment On the Definition of a PRG and a CSPRG
fgrieu's comment above is a good answer to the question.