Reputation
2,841
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
1 8 28
Newest
 Yearling
Impact
~28k people reached

Jan
14
comment What is a tweakable block cipher?
@StephenTouset: Changing a key can be very expensive if there is a key expansion routine to calculate (eg AES), whereas tweaking the message need not be. A common method is to take a blockcipher $E_k(\cdot)$ and define the tweakable blockciphers $E^T_k(M):=H(T)\oplus E_k(M \oplus H(T))$ where H is some finite field multiplication with its own secret key (ie $H(T):=T\cdot K_2$). Thus the whole calculation consists of two xors and one finite field multiplication, whereas to tweak the key would require recomputing the whole AES key schedule [as well as opening you up to related key attacks].
Nov
5
revised Why is OCB-AES mode not becoming a standard for authenticated encryption?
shameless hack to change my vote
Nov
5
comment Why is OCB-AES mode not becoming a standard for authenticated encryption?
Agreed, I disagree with my past self. When back at desk will try and hack that vote off
Oct
15
awarded  Yearling
Sep
30
awarded  Explainer
Jun
24
reviewed Leave Open In public key cryptography, how many keys are required for secure communication between n parties?
Jun
24
reviewed Leave Open how to truncate a PRF on n bits to PRF on t bits where t < n?
Jun
23
revised Are poly1305 authenticators distinguishable from random data?
Clarified first sentance - wasn't clear to me on first reading
Jun
20
comment Ballot box with multiple parties. All can read it, or none can read it
(Especially in a game explicitly built around misleading fellow players!)
Jun
19
reviewed Close Open source implementations of Symmetric Searchable Encryption and Order Preserving Encryption
Jun
19
comment Ballot box with multiple parties. All can read it, or none can read it
Woo, go Diplomacy! There are "Commitments" which might be worth considering - as in you make eacy player commit to their moves then reveal them later. The issue with using commitments is that someone could refuse to show their moves, but if they do this then you can just eject them from the game or similar. I can't think of a method where you could force players to both commit and to open their commitments.
Jun
18
reviewed Leave Open What are the consequences of not checking the server mac in a TLS connection?
Jun
18
comment Length-preserving all-or-nothing transform
"we can probably take any block cipher E of the desired block width" - Can you propose a scheme of optimally secure and arbitrarily sized block ciphers then?
Jun
17
comment Length-preserving all-or-nothing transform
@StephenTouset - CBC always has the issue of being slightly error-tolerant, which as I understand it means this wouldn't be All-or-Nothing? If part of a ciphertext block is missing, it will only affect the decryption of a couple of plaintext blocks.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
Agreed, but I felt it was a useful question to link to - I certainly don't think it is a duplicate, just a related question.
Jun
17
comment Is HMAC needed for a SHA-3 based MAC?
This question is arguably closer, but not really a duplicate (I retracted my vote) because it asks whether HMAC-SHA3 is provably secure rather than whether there are smaller schemes that work. Have a look at the dedicated Keccak MAC functions (for example as part of their AE schemes), including the Keyed Sponge functions.
Jun
16
answered Key cracking: Prefer many small texts over one large text?
Jun
9
comment AES-128-CTR message integrity: Construction of HMAC
^^ Careful - that isn't HMAC, and is susceptible to length extension attacks
Jun
1
reviewed Leave Open Why is plain-hash-then-encrypt not a secure MAC?
Jun
1
reviewed Close How small are we talking about when defining the small public/private key exponent