2,936 reputation
1518
bio website
location United States
age
visits member for 2 years, 6 months
seen 53 mins ago

Mar
6
comment Is MITM possible after key exchange phase done successfully in RSA?
For a key pair $\langle N\hspace{-0.03 in},\hspace{-0.03 in}e\hspace{-0.02 in},\hspace{-0.03 in}d\hspace{.02 in}\rangle$ and randomness $r$, "encrypting m with the private key" would give $\:\operatorname{mod}((\operatorname{encpadding}(m\hspace{.02 in},\hspace{-0.03 in}r))\text{^}d,\hspace{-0.02 in}N\hspace{.025 in})\:$, $\:$ and signing m with the private key would give $\:\operatorname{mod}((\operatorname{sighash}(N\hspace{-0.03 in},\hspace{-0.03 in}e\hspace{-0.02 in},\hspace{-0.03 in}m))\text{^}d,\hspace{-0.02 in}N\hspace{.025 in})\;$. $\;\;\;\;$
Mar
6
comment Is MITM possible after key exchange phase done successfully in RSA?
The main issue is that you are trying have Alice and Bob generate Sig_a and $\hspace{1.6 in}$ Sig_b by "encrypting the message content with their private key" rather than by $\hspace{1.3 in}$ "signing the message content with their private key". $\:$
Mar
6
comment Unpredictability vs randomness
How about the fact that your "source of entropy is of very poor quality but it seems unpredictable as long as ..."? $\:$ If the problem is insufficient entropy, rather than getting randomness from a large amount of entropy, then you should use a password-based key derivation function. $\;\;\;$
Mar
6
comment Tweakable encryption algorithms vs Key wrapping
"keys forage and key archive" $\: \mapsto \:$ "key storage and key archives" $\;\;$ ? $\;\;\;\;\;$
Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
In Diffie-Hellman, we usually want to encrypt data that doesn't fit in a single group element. $\hspace{.86 in}$
Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
g^{{ab}^b}^-1 $\:$ is not canceling the value of $b$. $\;\;\;\;$
Mar
6
comment Secure Broadcast Channel
andrew.cmu.edu/course/15-749/READINGS/required/resilience/… $\;$
Mar
6
comment What key exchange protocols give Forward-Secrecy resisting future progress?
@DrLecter : $\:$ Should "future" be replaced with "past"? $\;\;\;\;$
Mar
6
comment Unpredictability vs randomness
The phrase "randomness extraction" is better and also used, such as in this answer's key derivation link. $\:$ Also, one could potentially implement a strong extractor that is not a polynomial hash. $\hspace{1.42 in}$
Mar
5
comment encrypted file sharing protocol
It looks to me like the paper only indicates that he would "need the message for which the signature should be valid with the second key" in order to use their method. $\:$ The more important question is whether or not a feasible method to do that exists. $\:$ Even if there isn't such a method, there would still be the issue of an attacker claiming to have the same signature verification key. $\:$ Also, since the signature is sent unencrypted, your protocol draft does not preserve sender anonymity, and one needs to worry about whether or not the masterkey is actually "out of reach". $\;\;\;$
Mar
5
answered Why is “multiplying” $g^x$ and $g^y$ not possible?
Mar
5
answered What key exchange protocols give Forward-Secrecy resisting future progress?
Mar
5
comment encrypted file sharing protocol
Oh, I'd though signature was over what came after it, rather than what was above "hash, sign". $\:$ In that case, your protocol draft does not provide non-repudiation, and I'd have to think more about whether or not it provides authenticity. $\:$ There is a need for a sender identifier because otherwise an attacker could find a different verification key that will cause the signature to check out or claim to have the same signature verification key as the real sender. $\;\;\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
Yes, however, the ephemeral private keys are $a$symmetric. $\;$
Mar
5
comment encrypted file sharing protocol
You have "recipient" in the wrong place and are missing "sender"; "recipient" should be put $\hspace{.95 in}$ into what is covered by the signature and "sender" should be put where "recipient" was. $\hspace{1.09 in}$ What purpose is "hash, sign" supposed to serve? $\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
"an attack against a key-establishment protocol with forward secrecy can" be performed after $\hspace{.62 in}$ the intercept, by searching for the/either ephemeral private key. $\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
The answer is, the kind described by the first 12 characters of this question's tag. $\;$
Mar
5
comment Convincing “someone” on the (in)validity of DH tuple without revealing $u,v$
Would you be interesting in non-interactive ZK proofs for this? $\;$
Mar
4
answered Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
Mar
4
revised Is it meaningful to consider the leakage of master key of KGC?
completely changed answer