3,577 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 2 hours ago

1d
comment IND-CCA2 secure schemes without Plaintext Awareness?
iacr.org/archive/pkc2009/54430381/54430381.pdf $\;$
1d
comment A patched SHA1 attempt for password verification
or even basE91 $\;$
1d
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
It makes the resulting protocol be such that, as far as I can see, there does not necessarily exist a fast classical two-for-one guessing attack on a large $N$ that can handle arbitrary pairs of candidate passwords. $\;$
1d
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$
1d
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using k = 3 + H(N,g,A) would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$
1d
comment SRP-6 vulnerabilities when N is small
If "someone ... B - kv" then succeeding at finding those logs would give candidate S values. $\hspace{.54 in}$ Probably not, since those logs will almost always exist. $\;$
2d
revised SRP-6 vulnerabilities when N is small
fixed math error
2d
revised Entropy Loss of KDFs
fixed typos and separated questions
2d
comment SRP-6 vulnerabilities when N is small
The attacker that you say "is in the same position as one who breaks into the server and steals $v = g^x$, but isn't able to break the DL". $\;$
2d
comment SRP-6 vulnerabilities when N is small
How would that attacker impersonate the server without finding the password via 3&4? $\hspace{1.23 in}$
2d
revised SRP-6 vulnerabilities when N is small
fixed error
2d
answered SRP-6 vulnerabilities when N is small
2d
comment Is my id obfuscation algorithm secure?
What programming language is that? $\:$ Will the lengths of x.low ever be different for the same key? $\:$ What about the lengths of x.high? $\;\;\;\;$
Aug
18
comment Is my id obfuscation algorithm secure?
I don't see why it should be at all likely "that next hash will have the same chip as the owner". $\hspace{.75 in}$
Aug
18
revised Attacking a hardware AES implementation if it leaks the intermediate round states
fixed typo
Aug
18
comment Is my id obfuscation algorithm secure?
Mainly because he doesn't give a specification. $\:$ On the other hand, his system includes "Insecure low-bandwidth unstable one-way channels", and one of his requirements refers to "create too large outputs (over 64-bit)". $\;\;\;\;$
Aug
18
comment Is my id obfuscation algorithm secure?
No, it means you'll find a secure short-output PRF collision, which is not impressive. $\hspace{1.32 in}$
Aug
18
comment Is my id obfuscation algorithm secure?
Your way runs into the birthday problem. $\;$
Aug
18
comment Encryption method with master key and user keys
Yes. $\:$ Do other players need to be able to verify a user's changes on their own? $\:$ Should the game/program not know the passwords? $\;\;\;\;$
Aug
17
revised Construct block cipher from a smaller one with mixing function
improved grammar