Reputation
1,641
Top tag
Next privilege 2,000 Rep.
Access moderator tools
Badges
3 10
Newest
 Critic
Impact
~12k people reached

  • 0 posts edited
  • 0 helpful flags
  • 18 votes cast
1d
revised Parallel authentication of encrypted data. What AE type to choose?
added 419 characters in body
1d
answered Parallel authentication of encrypted data. What AE type to choose?
1d
answered Reasons for components of AES
Jun
22
answered Which symmetric cipher is best for studying?
Jun
7
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
While writing my answer, I realized that the RoR advantage versus $\mathcal{E}$ = the identity function doesn't actually exactly equal 1, because the random oracle can always by chance generate and 'encrypt' the same string as the query. Of course this probability very quickly becomes extremely small, and as such the RoR advantage very quickly approaches 1 as the total bit-length of the queries grows. But this is not like the LoR advantage, which can equal 1 immediately, even with a query where the left and right messages are each a single bit long.
Jun
7
answered Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
Jun
6
answered computational complexity class of decryption of AES
Jun
5
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
OK that clarifies the question for me. Of course there are encryption schemes where max Adv LOR = max Adv ROR = 1 (e.g. where the encryption function is the identity function). So we know Bellare's upper bound is not always met. But you want to know if it is ever met at all. That's a good question, so I am upvoting it. Unfortunately I don't know the answer.
Jun
4
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
In other words, where Bellare et al proved that the max LOR Advantage can never be greater than twice the max ROR Advantage, you are asking whether that upper bound is in fact an equality (i.e. whether max Adv LOR $= 2 \cdot$ max Adv ROR for all encryption schemes)?
May
30
answered LED cryptography algorithm
May
27
revised Effective security of block cipher – equal the key size, or half the key size?
Changing variable names to hopefully clarify the algorithm.
May
27
comment Effective security of block cipher – equal the key size, or half the key size?
@PaŭloEbermann - I'll change the counter names to make it clearer. Also, you are correct, in that this is an attack on the block cipher itself, not any particular mode (unless the mode is ECB).
May
27
comment Effective security of block cipher – equal the key size, or half the key size?
I took your suggestion and added an answer, with more detail.
May
27
answered Effective security of block cipher – equal the key size, or half the key size?
May
26
comment Effective security of block cipher – equal the key size, or half the key size?
If the attacker can make related-key requests, there is a generic attack that can recover the key with $2^{n/2}$ requests and $2^{n/2}$ time, thus cutting the strength to (almost) half the key-size.
May
26
comment How to prove that someone encrypted a specific (large) chunk of data
@user74088 - in my suggested protocol, Bob can only ever send Caroline a string of random gibberish, i.e. $P$, the pad send to him by Tim. Even if he reveals this to Caroline without ever encrypting it, this random string is "utterly useless" without Alice also revealing her string, $P \oplus S$. Similarly, Alice's string is useless without knowing Bob's string. Only when you know both pieces can you xor them together to reveal $S$. A prosecutor would have to prove that both Alice and Bob gave Caroline their keys (i.e. revealed their unencrypted strings).
May
25
awarded  Critic
May
25
comment Is it practical to use a stream cipher in a block cipher mode?
Most stream ciphers have an IV input in addition to the secret key input, so that each key stream is unique. Well designed stream ciphers are secure even if the IV is chosen/controlled by the attacker. As such, one can use the stream cipher as a pseudorandom function, with the IV as the input and the truncated keystream as the output, and then use a Feistel structure to turn the pseudorandom function into a block cipher (perhaps reserving part of the IV for a round counter to make each round function different). This however would very likely be extremely inefficient.
May
25
comment How to prove that someone encrypted a specific (large) chunk of data
@SOJPM - I took your suggestion (see above edits).
May
25
revised How to prove that someone encrypted a specific (large) chunk of data
Per a suggestion by SOJPM, I have moved a comment into the main body of the answer.