2,833 reputation
1828
bio website 127.0.0.1
location United Kingdom
age
visits member for 1 year, 1 month
seen Nov 5 at 12:38

Nov
5
revised Why is OCB-AES mode not becoming a standard for authenticated encryption?
shameless hack to change my vote
Nov
5
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
Agreed, I disagree with my past self. When back at desk will try and hack that vote off
Oct
15
awarded  Yearling
Sep
30
awarded  Explainer
Jun
24
reviewed Leave Open In public key cryptography, how many keys are required for secure communication between n parties?
Jun
24
reviewed Leave Open how to truncate a PRF on n bits to PRF on t bits where t < n?
Jun
23
revised Are poly1305 authenticators distinguishable from random data?
Clarified first sentance - wasn't clear to me on first reading
Jun
20
comment Ballot box with multiple parties. All can read it, or none can read it
(Especially in a game explicitly built around misleading fellow players!)
Jun
19
reviewed Close Open source implementations of Symmetric Searchable Encryption and Order Preserving Encryption
Jun
19
comment Ballot box with multiple parties. All can read it, or none can read it
Woo, go Diplomacy! There are "Commitments" which might be worth considering - as in you make eacy player commit to their moves then reveal them later. The issue with using commitments is that someone could refuse to show their moves, but if they do this then you can just eject them from the game or similar. I can't think of a method where you could force players to both commit and to open their commitments.
Jun
18
reviewed Leave Open What are the consequences of not checking the server mac in a TLS connection?
Jun
18
comment Length-preserving all-or-nothing transform
"we can probably take any block cipher E of the desired block width" - Can you propose a scheme of optimally secure and arbitrarily sized block ciphers then?
Jun
17
comment Length-preserving all-or-nothing transform
@StephenTouset - CBC always has the issue of being slightly error-tolerant, which as I understand it means this wouldn't be All-or-Nothing? If part of a ciphertext block is missing, it will only affect the decryption of a couple of plaintext blocks.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
Agreed, but I felt it was a useful question to link to - I certainly don't think it is a duplicate, just a related question.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
This question is arguably closer, but not really a duplicate (I retracted my vote) because it asks whether HMAC-SHA3 is provably secure rather than whether there are smaller schemes that work. Have a look at the dedicated Keccak MAC functions (for example as part of their AE schemes), including the Keyed Sponge functions.
Jun
16
answered Key cracking: Prefer many small texts over one large text?
Jun
9
comment AES-128-CTR message integrity: Construction of HMAC
^^ Careful - that isn't HMAC, and is susceptible to length extension attacks
Jun
1
reviewed Leave Open Why is plain-hash-then-encrypt not a secure MAC?
Jun
1
reviewed Close How small are we talking about when defining the small public/private key exponent
Jun
1
reviewed Leave Open Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?