Reputation
1,746
Top tag
Next privilege 2,000 Rep.
Access moderator tools
Badges
3 10
Newest
 Critic
Impact
~12k people reached

  • 0 posts edited
  • 0 helpful flags
  • 21 votes cast
Jul
25
comment How to prove that a function is not pseudorandom?
@pa5h1nh0 - If the XOR of the two inputs equals the XOR of the two outputs, then with high probability the function is $F_k(x)$ and not a random function. This shows that $F_k(x)$ is not pseudorandom (because it can be distinguished from random with non-negligible Advantage).
Jul
25
comment How to prove that a function is not pseudorandom?
In that example, for two inputs $x$ and $y$, where $|x| = |y|$, then $F_k(x) \oplus F_k(y) = x \oplus y$ with probability one, while that equality holds with small probability for a true random function. An Adversary basing its guess on the truth of that equality will have very high Advantage in distinguishing the Function from a random function. Therefore the Function is not pseudorandom.
Jul
14
comment Why have round constants in hashes?
@PaulUszak - If you don't need the hash function to be cryptographically secure then many design requirements can be dropped. That said, there are much faster (insecure) checksum functions than Keccak or Skein without the round constants. e.g. The simple Modular sum of all the words in a message produces a fingerprint (the sum) enormously faster than any hash function, and is often sufficient in 'benign' situations.
Jul
10
answered Why have round constants in hashes?
Jul
7
comment Diffe-Helman Exchange result is always 1
1 raised to any power is always 1. This fact holds regardless of the modulus. 47 is (2*23)+1, and thus is congruent to 1 mod 23. So 47 raised to any power is 1 (mod 23). 5, on the other hand, generates the multiplicative group of integers modulo 23, which is to say that all the integers from 1 to 22 can be generated by raising 5 to successive powers and reducing mod 23.
Jul
7
comment Diffe-Helman Exchange result is always 1
Try a generator of 5.
Jul
4
revised Parallel authentication of encrypted data. What AE type to choose?
added 419 characters in body
Jul
4
answered Parallel authentication of encrypted data. What AE type to choose?
Jul
4
answered Reasons for components of AES
Jun
22
answered Which symmetric cipher is best for studying?
Jun
7
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
While writing my answer, I realized that the RoR advantage versus $\mathcal{E}$ = the identity function doesn't actually exactly equal 1, because the random oracle can always by chance generate and 'encrypt' the same string as the query. Of course this probability very quickly becomes extremely small, and as such the RoR advantage very quickly approaches 1 as the total bit-length of the queries grows. But this is not like the LoR advantage, which can equal 1 immediately, even with a query where the left and right messages are each a single bit long.
Jun
7
answered Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
Jun
6
answered computational complexity class of decryption of AES
Jun
5
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
OK that clarifies the question for me. Of course there are encryption schemes where max Adv LOR = max Adv ROR = 1 (e.g. where the encryption function is the identity function). So we know Bellare's upper bound is not always met. But you want to know if it is ever met at all. That's a good question, so I am upvoting it. Unfortunately I don't know the answer.
Jun
4
comment Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?
In other words, where Bellare et al proved that the max LOR Advantage can never be greater than twice the max ROR Advantage, you are asking whether that upper bound is in fact an equality (i.e. whether max Adv LOR $= 2 \cdot$ max Adv ROR for all encryption schemes)?
May
30
answered LED cryptography algorithm
May
27
revised Effective security of block cipher – equal the key size, or half the key size?
Changing variable names to hopefully clarify the algorithm.
May
27
comment Effective security of block cipher – equal the key size, or half the key size?
@PaŭloEbermann - I'll change the counter names to make it clearer. Also, you are correct, in that this is an attack on the block cipher itself, not any particular mode (unless the mode is ECB).
May
27
comment Effective security of block cipher – equal the key size, or half the key size?
I took your suggestion and added an answer, with more detail.
May
27
answered Effective security of block cipher – equal the key size, or half the key size?