1,238 reputation
28
bio website
location
age
visits member for 11 months
seen Jun 7 at 16:50

Jun
24
awarded  Enlightened
Jun
24
awarded  Nice Answer
Jan
27
comment Cryptanalysis of an certain algorithm
@SimicNebojsa - it's a very strong attack model, and many won't accept it as valid/interesting (See e.g. poncho, if I'm not mistaken). But a cipher that is not weak under this model might be of interest to some, so long as you are sufficiently careful and clear in your analysis.
Jan
27
comment Cryptanalysis of an certain algorithm
@SimicNebojsa - related key cryptanalysis (RKC) requires a specified set of functions that the attacker is permitted to apply to the key to derive 'related' keys. The more popular/common types of RKC involve 'differences' as you may be thinking (i.e. xoring or adding attacker-chosen constants to the key). But xoring or adding constants are just one type of function -- there are many, many more.
Jan
27
comment Cryptanalysis of an certain algorithm
@poncho - indeed, AES seems easily breakable under this attack model. But such an attack might not fare so well against a Feistel cipher with strong round functions (e.g. DEAL, or a Feistel cipher than uses a secure hash function to hash the data and round key). If so, then that means AES is weaker in a certain sense than such a cipher.
Jan
27
answered Cryptanalysis of an certain algorithm
Jan
24
comment Impact of distinguishing between random text and cipher text?
@sashank - actually while Patarin did show that six rounds gave a better bound than the one proved for four rounds, David Cary is still correct that four rounds is sufficient to make a Feistel cipher with (pseudo)random round functions a 'strong' pseudorandom permutation (i.e. it is "secure" so long as the number of chosen plaintexts/ciphertexts is less than $2^{(n/4)}$, where $n$ is the cipher block size).
Jan
23
answered Impact of distinguishing between random text and cipher text?
Jan
12
comment Is OCB with short MAC malleable?
Indeed. As Ricky points out, $1/2^0 = 1/1 = 1$, and 1 is the maximum possible Advantage. So the upper bound on Adversarial advantage described in Theorem 5.1 doesn't really do any 'bounding' when there is no tag at all.
Jan
12
answered Is OCB with short MAC malleable?
Jan
8
answered implication of tweak on bruteforcing a block cipher
Jan
8
answered Why is the security of block cipher not a function of key and tweak?
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
@evening - the size would be the block width of the block cipher (e.g. 128 bits for AES, 64 bits for DES, etc).
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
@evening - by E in the linked picture they mean the encryption function of a block cipher.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
@evening - you are correct, if the attacker gets the key at time T then he cannot tamper with messages sent and received prior to time T. Doing so would require both the key and a time machine.
Jan
7
comment Why use CBC-MAC? Why not just apply hash function on the whole message?
That's what forging is (i.e. sending a message of the attacker's choice with the correct Tag). If the attacker gets the key somehow then he can forge any message he likes.
Jan
7
answered Why use CBC-MAC? Why not just apply hash function on the whole message?
Jan
6
comment Shared secret: Generating Random Permutation
You may find the following paper interesting: people.csail.mit.edu/rivest/ShamirRivestAdleman-MentalPoker.pdf
Dec
29
awarded  Nice Answer
Dec
28
answered Why xor is a linear operation but ordinary adding is not