meta user
network profile
| bio | website | google.com |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 8 months |
| seen | yesterday | |
| stats | profile views | 23 |
|
Apr 18 |
comment |
GPG and PAR2 error correction data from the plain archive, will it compromise security? Incidentally, the second (and third) sentence(s) of this answer address(es) $\hspace{2 in}$ why the first candidate method is bad. $\:$ |
|
Apr 18 |
answered | GPG and PAR2 error correction data from the plain archive, will it compromise security? |
|
Apr 17 |
comment |
Ciphertext-only attack on Simplified DES Because there will be $2^{56}$ possible solutions. $\:$ |
|
Apr 14 |
comment |
Is there an existing AEAD scheme with minimal IV requirements? The AE proof for the last link uses random IVs, and I can't figure out whether it actually needs those. $\hspace{.55 in}$ (SIV mode seems fine, though.) $\;\;$ |
|
Apr 14 |
accepted | Is there an existing AEAD scheme with minimal IV requirements? |
|
Apr 13 |
comment |
Is there an existing AEAD scheme with minimal IV requirements? I'm not clear on what you mean by "encrypted IV", but I think that would allow detecting $\hspace{1 in}$ equality of plaintexts that had different cleartexts. $\:$ |
|
Apr 12 |
asked | Is there an existing AEAD scheme with minimal IV requirements? |
|
Apr 12 |
comment |
Proper uses for CTR and CBC AES block cipher modes HMAC would help if someone was able to change the database but didn't have access to the keys. $\hspace{.3 in}$ Yes, as described in Paulo's answer. $\;\;$ |
|
Apr 11 |
comment |
Relaxed trust criterion for mental poker server? How would your third sentence work for a fake timestamp dated before the message was created? |
|
Apr 10 |
comment |
AES Message Authentication Vulnerability If it's just "the AES permutation" (so to speak), then it should not be possible. $\hspace{1.7 in}$ If it's AES in ECB mode, then it's quite easy. $\;\;$ |
|
Apr 7 |
comment |
Question about the definition of a secure PRF You're missing the massive difference between the actual expression and your other words. $\hspace{.6 in}$ |
|
Mar 31 |
revised |
Using encryption schemes for identification corrected middle paragraph |
|
Mar 31 |
comment |
Using encryption schemes for identification Huh. $\:$ I'm pretty sure there's a paper on that, but I can't find it. $\:$ The idea is building a tree of ordinary $\hspace{.2 in}$ trees and having the signatures be a branch with the choices at each node (of the ordinary trees) $\hspace{.4 in}$ given by the message's hash, and using a pseudo-random function for all of the randomness to $\hspace{.4 in}$ make the signing algorithm (deterministic and) stateless. $\;\;$ |
|
Mar 31 |
revised |
Using encryption schemes for identification clarified security requirement |
|
Mar 30 |
comment |
Single-purpose symmetric encryption scheme for single files As far as I can see, you're not using a work factor. $\:$ |
|
Mar 30 |
answered | Using encryption schemes for identification |
|
Mar 23 |
comment |
Perfectly hiding / binding commitment scheme (Even a computationally bounded) Alice can decommit to any value by giving $k$ zeros and her message as her randomness, but that is not perfectly (or even computationally) hiding because Bob trivially has probability more than $\:1-(1/(2^k))\:$ of correctly guessing her_value. $\;\;$ |
|
Mar 23 |
comment |
Perfectly hiding / binding commitment scheme No. $\:$ Consider the (completely insecure) commitment scheme where Alice chooses $k$ random bits, where if they're all zero then she sends length(her_value) additional random bits to Bob, otherwise she sends her_value to Bob, and Bob accepts a decommitment if and only if Alice presents randomness that matches the transcript of the commit phase. $\;\;$ |
|
Mar 22 |
comment |
Perfectly hiding / binding commitment scheme Um, no. $\:$ Perfect hiding means, that if Alice was honest and Bob was computationally unbounded $\hspace{.6 in}$ then Bob's view is independent of Alice's value. $\;\;$ |
|
Mar 22 |
comment |
Perfectly hiding / binding commitment scheme It is easy to show that (in the plain model) any perfectly binding commitment scheme is not even $\hspace{.8 in}$ statistically hiding (an unbounded receiver can brute force $K$ and $N$ to find $N\hspace{.02 in}$). $\:$ It is a folk $\hspace{.75 in}$ theorem that bit commitment (in the plain model) cannot even be both statistically hiding and $\hspace{.8 in}$ statistically binding, although I have never seen any proof of that. $\;\;$ |
