J.D.
Reputation
2,430
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
 Apr 23 answered Are collision-resistant hash functions even possible? [see description] Apr 14 comment Non-iterative cryptographic hash functions @EthanHeilman - indeed I think it would. While md5 isn't usually defined as a truncation of $G(x)$ like that, defining it that way is functionally equivalent to the usual definition. Clearly my definition for non-iterative is insufficient, and I am not sure at this moment how to fix it (or even if it can be fixed). Even a simpler definition like "a hash function where the internal state does not lose entropy until the final truncation step" would call your md5 example non-iterative. Frankly I'm at a loss, but hopefully this exercise has helped you somewhat. Apr 13 awarded Nice Answer Apr 12 answered Why is the permutation in AES (and other ciphers) not random? Apr 12 revised Non-iterative cryptographic hash functions To generalize the definition and add clarity to example construction. Apr 11 answered Non-iterative cryptographic hash functions Apr 10 comment Non-iterative cryptographic hash functions @EthanHeilman - how about this for a formal definition: a hash function $H_x(y)$ that produces a digest of length $x$ is "non-iterative" iff for any two distinct messages $M_1$, $M_2$, there is a finite digest size $b$ such that $H_b(M_1) \neq H_b(M_2)$. For example, think of an injective Random Oracle, $\{0,1\}^*\mapsto \{0,1\}^{\infty}$, where no two finite messages map to the same infinite string. $H_x(y)$ calls the RO, and truncates the output to a string of length $x$. This definition also applies to your example permutation based hash function. Apr 9 comment Non-iterative cryptographic hash functions @EthanHeilman - I am also a fan of MD6. So is there anything besides truncated permutation-based hash functions that do not discard entropy until the final truncation step? Well, any such function would need to be injective (prior to the truncation step) in order to not lose entropy. So there are two alternatives to a permutation that fit the bill: 1) a bijective function where the domain is not the codomain, and 2) an injective non-surjective function. i.e. an 'expanding' function, where the codomain is larger than the domain). Apr 9 comment Non-iterative cryptographic hash functions Your 'non-iterative' hash function is similar to the the compression function of MD6 (a truncated permutation that can take an input message of up to 4096 bits). Of course, this compression function is then used in a mode of operation that turns MD6 into an iterative hash function with a far larger potential message space - but then so could your hash function. Apr 2 comment Discrete logarithm problem is easy in a cyclic group of order a power of two @Howard - I think I initially misunderstood precisely what you were asking, but have clarified my answer. Let me know if this is still not clear. Apr 2 revised Discrete logarithm problem is easy in a cyclic group of order a power of two Clarification Apr 2 answered Discrete logarithm problem is easy in a cyclic group of order a power of two Mar 6 revised Help with breaking AES reduced to 2 rounds added 3070 characters in body Mar 6 answered Help with breaking AES reduced to 2 rounds Mar 2 comment Mathematical Proof for Key independence in Differential Cryptanalysis I guess I don't understand what exactly you want to show is independent of the key. Trivially, the (xor) difference of two plaintexts (or two ciphertexts) is the same before and after the application of a (xored) roundkey. But if you want to show that $\Pr[\Delta P \rightarrow \Delta C \;|\; K_0 = \alpha] = \Pr[\Delta P \rightarrow \Delta C]$ for any particular $\alpha$, then that is only the case if the pairs that support $\Delta P$ are selected uniformly at random (for e.g. think about what happens if the pairs are selected according to some non-uniform distribution). Mar 2 answered Mathematical Proof for Key independence in Differential Cryptanalysis Jan 30 answered Theoretical security of bit rotation for encyption Jan 23 awarded Informed Jan 23 comment Best attack on double DES followed by XOR with third key @MeysamGhahramani - well, you don't say why you think that, so I can't correct you (or be convinced by you). Jan 23 comment Best attack on double DES followed by XOR with third key @MeysamGhahramani - yes, by which I mean the value for $A$ is arbitrary (i.e. can be any 64-bit string), so long as it is fixed. I did not say "do step one for all possible 64-bit strings". Apologies if that wasn't clear.