Reputation
1,381
Top tag
Next privilege 1,500 Rep.
Approve tag wiki edits
Badges
3 10
Newest
 Critic
Impact
~10k people reached

  • 0 posts edited
  • 0 helpful flags
  • 16 votes cast
3h
revised Effective security of block cipher – equal the key size, or half the key size?
Changing variable names to hopefully clarify the algorithm.
3h
comment Effective security of block cipher – equal the key size, or half the key size?
@PaŭloEbermann - I'll change the counter names to make it clearer. Also, you are correct, in that this is an attack on the block cipher itself, not any particular mode (unless the mode is ECB).
15h
comment Effective security of block cipher – equal the key size, or half the key size?
I took your suggestion and added an answer, with more detail.
15h
answered Effective security of block cipher – equal the key size, or half the key size?
1d
comment Effective security of block cipher – equal the key size, or half the key size?
If the attacker can make related-key requests, there is a generic attack that can recover the key with $2^{n/2}$ requests and $2^{n/2}$ time, thus cutting the strength to (almost) half the key-size.
1d
comment How to prove that someone encrypted a specific (large) chunk of data
@user74088 - in my suggested protocol, Bob can only ever send Caroline a string of random gibberish, i.e. $P$, the pad send to him by Tim. Even if he reveals this to Caroline without ever encrypting it, this random string is "utterly useless" without Alice also revealing her string, $P \oplus S$. Similarly, Alice's string is useless without knowing Bob's string. Only when you know both pieces can you xor them together to reveal $S$. A prosecutor would have to prove that both Alice and Bob gave Caroline their keys (i.e. revealed their unencrypted strings).
1d
awarded  Critic
1d
comment Is it practical to use a stream cipher in a block cipher mode?
Most stream ciphers have an IV input in addition to the secret key input, so that each key stream is unique. Well designed stream ciphers are secure even if the IV is chosen/controlled by the attacker. As such, one can use the stream cipher as a pseudorandom function, with the IV as the input and the truncated keystream as the output, and then use a Feistel structure to turn the pseudorandom function into a block cipher (perhaps reserving part of the IV for a round counter to make each round function different). This however would very likely be extremely inefficient.
2d
comment How to prove that someone encrypted a specific (large) chunk of data
@SOJPM - I took your suggestion (see above edits).
2d
revised How to prove that someone encrypted a specific (large) chunk of data
Per a suggestion by SOJPM, I have moved a comment into the main body of the answer.
2d
comment How to prove that someone encrypted a specific (large) chunk of data
@SOJPM - Simply forwarding the unencrypted shares to Caroline is equivalent to encrypting the shares but then revealing the keys to her -- so long as either Alice or Bob do their part properly Caroline cannot know $S$. It takes collaborative effort / incompetence by both Alice and Bob for $S$ to be revealed. If we cannot trust that at least one of the two will keep their key secret and properly run their part of the protocol then no scheme will succeed (so my scheme is not unique in that respect). But given my described scheme, one is sufficient.
2d
answered How to prove that someone encrypted a specific (large) chunk of data
2d
revised Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?
Clarification.
2d
comment Are pseudorandom permutation really permutation in mathematical sense?
@cpast - That is true, but it is also true that you can have families of permutations (i.e. block ciphers) that are not pseudorandom. In the Standard model, a block cipher $B$ (as a family of permutations on the set $\{0,1\}^n$) is a pseudorandom permutation if a uniformly-randomly-selected element of the family is "indistinguishable" from a uniformly-randomly-selected element of $Sym(\{0,1\}^n)$. So yes, being a family is necessary for being pseudorandom, but it is not sufficient.
2d
answered Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?
2d
answered Are pseudorandom permutation really permutation in mathematical sense?
2d
comment Would this method allow fast authenticated encryption using only a single encryption operation per block?
My comment was not meant as criticism -- I am just suggesting that you try to design a provably secure mode (start by reading the proofs for more established modes). It's really the best way to learn what makes modes secure and why; even if you are not a mathematician and just want to understand and appreciate modes like OCB or GCM. Making unproven proposals and waiting until others point out the flaws is not going to deepen your understanding very much I'm afraid.
2d
comment Would this method allow fast authenticated encryption using only a single encryption operation per block?
Just fyi, the preferred method of proposing authenticated encryption modes these days is to prove it is secure, rather than asking people to prove it is insecure and then 'fixing' it when they do. Trying to design a mode that you can prove attains the goal of authenticated encryption is challenging (especially if you are trying to minimize the number of expensive operations), but it can be quite rewarding and educational as well.
May
24
answered Would this method allow fast authenticated encryption using only a single encryption operation per block?
Nov
18
awarded  Self-Learner