Reputation
4,816
Next tag badge:
50/100 score
29/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~45k people reached

11m
comment Public SRP verifiers or public hash chain “public keys” when secret is low entropy password
If the password is the user's only secret, then the server can simply try passwords offline. $\:$ There is just no way around that. $\:$ With that in mind, do you have a reason for preferring SRP over a signature scheme, where the server holds a ciphertext that is the encryption of the private key with a symmetric key derived from the user's password? $\;\;\;\;$
3h
answered Key exchange resilience to DoS attack
4h
comment ssh-keygen DH Primality Testing
For bit-length of at least 700, the paper I linked to gives a better bound $\hspace{2.12 in}$ than 1-(2^(-30)) even with just one test. $\;$
13h
comment Extend OTP on random data?
No. $\:$ Bob can decrypt much more than 256 bits of plaintext with just 256 bits of key material, $\hspace{.86 in}$ so it can't be information-theoretically secure, and it's too simple for computational security. $\hspace{.95 in}$
18h
comment ssh-keygen DH Primality Testing
I don't know whether-or-not they use Miller-Rabin, but if so, then this paper $\hspace{1.84 in}$ gives upper bounds on that probability. $\;$
23h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Associated data authentication might work, but in general one should just use a(n efficiently-invertible) pairing function (that is efficiently computable), such as $\:$ prefixfree(x) || y $\:$ or if ​ length(y) < length(x) ​ then ​ 1 || prefixfree(y) || x ​ else ​ 0 || prefixfree(x) || y. $\hspace{.54 in}$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
In general, $\;\;\; (x,\hspace{-0.03 in}y) \: = \: x\hspace{.04 in}||\hspace{.03 in}y \;\;\;$ does not work, since $\;\;\; 1\hspace{.03 in}||\hspace{.03 in}11 \: = \: 111 \: = \: 11\hspace{.03 in}||\hspace{.03 in}1 \hspace{1.68 in}$ but one would need $\;\;\; (1,\hspace{-0.04 in}11) \neq (11,\hspace{-0.04 in}1) \:\:\:\:$. $\;\;\;\;\;\;\;\;\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Is it also "assumed that any party can correctly decomposit" $\:$ c || ciphertext $\:$ "and thereby recover the length of $c$"? $\;\;\;$ (After all, if $c$ is just being prepended, then that's what would need to be decomposed.) $\;\;\;\;\;\;\;\;$
1d
comment Signature Verification: High level
It's neither of those things. $\:$ See this answer. $\;\;\;\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
The OP fixed that issue well before you posted this answer. $\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Also, is it assumed that the private-key holder can recover length(c) from $\hspace{1.79 in}$ length(c) + length(the_ciphertext) $\:$ ? $\;\;\;\;$
1d
comment How to correctly convert TAG value to the right format so that to Verify HMAC?
What programming language is that? $\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
By the syntax above your post's grey line, $\: \operatorname{Range}(\hspace{.05 in}f_K) \subseteq \mathcal{C} \:$, $\:$ so the left part of the disjunction can be removed. $\;\;\;$ (Also, I've now convinced myself that without the assumption I mentioned, even the integrated scheme could be malleable, rather than just the KEM.) $\;\;\;\;\;\;\;\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
That is reasonable, it's just something to make sure of, since otherwise the KEM can be malleable. $\hspace{.48 in}$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
No, since you wrote $\mathcal{C}$ instead of $\operatorname{Range}(\hspace{.05 in}f_K)$ and wrote $\hspace{.04 in}f_K$ instead of $\hspace{.04 in}f_K^{-1}$. $\;$
1d
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Is $\hspace{.04 in}f_K^{-1}$ assumed to not output an element of $\operatorname{Dom}(\hspace{.05 in}f_K)$ whenever $\hspace{.04 in}f_K^{-1}$'s $\hspace{1.93 in}$ input is not an element of $\operatorname{Range}(\hspace{.05 in}f_K)$? $\;$
2d
comment Cryptanalysis on two time pad ciphers?
crypto.stackexchange.com/q/2249/991 $\;$
Jul
30
comment Prove that certain amount of data was stored
eprint.iacr.org/2013/805.pdf $\;$
Jul
30
comment Present an attack for the combination of OTP and textbook RSA
@Ruggero : $\;\;\;$ Presumably, he means ​ length(r) = length(m) . $\;\;\;\;\;\;\;\;$
Jul
30
comment Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?
That depends entirely on the rest of $G$'s description. $\;$