Reputation
2,430
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
5 14
Newest
 Nice Answer
Impact
~20k people reached

  • 0 posts edited
  • 0 helpful flags
  • 28 votes cast
Apr
23
answered Are collision-resistant hash functions even possible? [see description]
Apr
14
comment Non-iterative cryptographic hash functions
@EthanHeilman - indeed I think it would. While md5 isn't usually defined as a truncation of $G(x)$ like that, defining it that way is functionally equivalent to the usual definition. Clearly my definition for non-iterative is insufficient, and I am not sure at this moment how to fix it (or even if it can be fixed). Even a simpler definition like "a hash function where the internal state does not lose entropy until the final truncation step" would call your md5 example non-iterative. Frankly I'm at a loss, but hopefully this exercise has helped you somewhat.
Apr
13
awarded  Nice Answer
Apr
12
answered Why is the permutation in AES (and other ciphers) not random?
Apr
12
revised Non-iterative cryptographic hash functions
To generalize the definition and add clarity to example construction.
Apr
11
answered Non-iterative cryptographic hash functions
Apr
10
comment Non-iterative cryptographic hash functions
@EthanHeilman - how about this for a formal definition: a hash function $H_x(y)$ that produces a digest of length $x$ is "non-iterative" iff for any two distinct messages $M_1$, $M_2$, there is a finite digest size $b$ such that $H_b(M_1) \neq H_b(M_2)$. For example, think of an injective Random Oracle, $\{0,1\}^*\mapsto \{0,1\}^{\infty}$, where no two finite messages map to the same infinite string. $H_x(y)$ calls the RO, and truncates the output to a string of length $x$. This definition also applies to your example permutation based hash function.
Apr
9
comment Non-iterative cryptographic hash functions
@EthanHeilman - I am also a fan of MD6. So is there anything besides truncated permutation-based hash functions that do not discard entropy until the final truncation step? Well, any such function would need to be injective (prior to the truncation step) in order to not lose entropy. So there are two alternatives to a permutation that fit the bill: 1) a bijective function where the domain is not the codomain, and 2) an injective non-surjective function. i.e. an 'expanding' function, where the codomain is larger than the domain).
Apr
9
comment Non-iterative cryptographic hash functions
Your 'non-iterative' hash function is similar to the the compression function of MD6 (a truncated permutation that can take an input message of up to 4096 bits). Of course, this compression function is then used in a mode of operation that turns MD6 into an iterative hash function with a far larger potential message space - but then so could your hash function.
Apr
2
comment Discrete logarithm problem is easy in a cyclic group of order a power of two
@Howard - I think I initially misunderstood precisely what you were asking, but have clarified my answer. Let me know if this is still not clear.
Apr
2
revised Discrete logarithm problem is easy in a cyclic group of order a power of two
Clarification
Apr
2
answered Discrete logarithm problem is easy in a cyclic group of order a power of two
Mar
6
revised Help with breaking AES reduced to 2 rounds
added 3070 characters in body
Mar
6
answered Help with breaking AES reduced to 2 rounds
Mar
2
comment Mathematical Proof for Key independence in Differential Cryptanalysis
I guess I don't understand what exactly you want to show is independent of the key. Trivially, the (xor) difference of two plaintexts (or two ciphertexts) is the same before and after the application of a (xored) roundkey. But if you want to show that $\Pr[\Delta P \rightarrow \Delta C \;|\; K_0 = \alpha] = \Pr[\Delta P \rightarrow \Delta C]$ for any particular $\alpha$, then that is only the case if the pairs that support $\Delta P$ are selected uniformly at random (for e.g. think about what happens if the pairs are selected according to some non-uniform distribution).
Mar
2
answered Mathematical Proof for Key independence in Differential Cryptanalysis
Jan
30
answered Theoretical security of bit rotation for encyption
Jan
23
awarded  Informed
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - well, you don't say why you think that, so I can't correct you (or be convinced by you).
Jan
23
comment Best attack on double DES followed by XOR with third key
@MeysamGhahramani - yes, by which I mean the value for $A$ is arbitrary (i.e. can be any 64-bit string), so long as it is fixed. I did not say "do step one for all possible 64-bit strings". Apologies if that wasn't clear.