3,890 reputation
1621
bio website
location United States
age
visits member for 3 years, 3 months
seen 9 mins ago

23h
revised What is contained in a RSA key file?
fixed title's grammar
2d
comment How much work is required to detect multiple collisions for a hash function?
detecting $\mapsto$ finding $\:$ ? $\;\;\;\;$
2d
comment Simple message authentication code
Melab: $\;\;\;$ If "typical RSA signatures ... message's hash" aren't insecure, then that's because their hash functions are collision resistant. $\:$ For MACs, I am not aware of any reason to require collision resistance. $\;\;$
2d
comment Simple message authentication code
@StephenTouset : $\:$ Melab didn't say that $E_k$ and $D_k$ would be with a block cipher. $\hspace{1.44 in}$
2d
revised Finding strong primes
improved grammar
2d
comment Simple message authentication code
The result that "every other friggin' message authentication code, digital signature scheme, and CSPRNG out there" "requires collision-resistance of the hash function." $\:$ Collision resistance is the problem, and I'm not aware of any practical implementations that would not necessary immediately fail when a hash collision is found, athough one can presumably avoid requiring collision resistance. $\:$
Jan
23
comment Security issues for integrating AAA and OTP services
"AAA" = ... $\;$
Jan
23
comment Simple message authentication code
(continued ...) $\:$ Also, what I believe is currently the best known security argument for HMAC only uses pseudorandomness of the compression function. $\;\;\;\;$
Jan
23
comment Simple message authentication code
My point is that I believe the result "so does every other friggin' message authentication code, digital signature scheme, and CSPRNG out there" would potentially be publishable, since those can be based on one-way functions, and from what I can find (section 4.3), there is currently no publicly known way to base collision-resistance on one-way functions. $\:$ (... continued) $\;\;\;\;$
Jan
23
comment Simple message authentication code
@Melab : $\:$ en.wikipedia.org/wiki/Universal_hashing $\;\;\;\;$
Jan
23
comment Simple message authentication code
That construction requires collision-resistance of the hash function. $\;$
Jan
20
revised Montgomery and Galois fields
general copy-editing
Jan
19
comment Public key encryption and big files with NaCL
No, public "key encryption is done with" ["the target public key"] and randomness and the message. $\:$ Signcryption adds in "the source private key" so that "the decryption step" will ensure "mutual authentication", which will guarantee that "the chunks are not forged". $\:$ You "need to add an extra step" into your question so that people know you're using signcryption rather than just PKE. $\;\;\;\;$
Jan
18
comment Updating the secret key used for HMAC
If even if "there will only ever be as much entropy on the chip as you put on it to begin with", providing forward-security would still be a "purpose in updating the key". $\;$
Jan
18
comment Public key encryption and big files with NaCL
You should MAC an ordered pair that indicates the autoinc and the ciphertext. $\;$
Jan
17
comment RSA signing security
@poncho : $\:$ The attacker could get such a signature by sending a prediction of the nonce $\hspace{.97 in}$ to the server while masquerading as the(/a) client. $\;\;\;\;$
Jan
17
comment Public key encryption and big files with NaCL
"being able to decrypt it" certainly doesn't verify it, especially since the encryption is public key. $\hspace{.6 in}$
Jan
17
comment RSA signing security
"receiver repeats the nonce" $\: \mapsto \:$ "nonce is predicted" $\;\;\;\;$
Jan
16
comment Public key encryption and big files with NaCL
Verifying "the order of chunks" is not enough; you should also verify the chunks. $\;$
Jan
16
comment What kind of attack does the current brokenness of SHA-1 allow?
@yyyyyy : $\;\;\;$ Yes, but incorrectly, since for second preimage resistance, d1 is chosen uniformly at random from the set of strings whose length is length(d0) (where d0 is the adversary's initial output). $\:$ In particular, any collision trivially allows one to find a d1 and an easy way to perform the OP's task for that d1. $\;\;\;\;\;\;\;$