Reputation
4,816
Next tag badge:
50/100 score
29/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~45k people reached

May
7
comment Mutual verification of shared secret
I now think the assumption I mentioned would only help in the random oracle model, in which case the "uniformly" part would actually be irrelevant. $\:$ The relation is to your opening paragraph, rather than the example you gave or the comments to my answer. $\;\;\;\;$
May
7
comment Mutual verification of shared secret
@codebeard : $\:$ Do you also want to assume that their inputs are uniformly distributed, $\hspace{1.15 in}$ and either identical or each unguessable given the other? $\;\;\;\;$
May
7
comment Why does spiped use both nonces and ephemeral keys?
That's fine. $\;$
May
7
comment Why does spiped use both nonces and ephemeral keys?
Yes. ${}{}{}\;$
May
7
comment Why does spiped use both nonces and ephemeral keys?
The attacker doesn't "now produce a packet with a valid HMAC tag". $\;$
May
7
comment Why does spiped use both nonces and ephemeral keys?
The attacker would just send the same group_element || MAC_tag to the party that message $\hspace{.26 in}$ was sent to before, even though that "party will end up computing a different shared secret every time." $\hspace{.15 in}$
May
7
answered Why does spiped use both nonces and ephemeral keys?
May
7
comment Mutual verification of shared secret
@codebeard : $\;\;\;\;\;\;\;$ No, I mean Bob. $\;\;\;$ The "naive approach" you gave would let Bob try however many guesses his computing power lets him evaluate $\: h\circ h \:$ on, with high accuracy. $\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;$
May
7
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
It may be better to switch the order of subtraction, so that storing $\:b-1\:$ as a constant could reduce the necessary number of arithmetic operations by one. $\;\;\;\;$
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
From Yasuda's paper: “The envelope MAC, however, is shown to be vulnerable against key recovery attack [8] (which is more threatening than forgery attack.)” $\;$
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Your formula now describes the "envelope MAC". $\:$ I think your $k$s should be replaced with $k_{\hspace{.02 in}0}$ and $k_1$. $\;\;\;\;$
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
I think |m|-1 should be replaced with |m|+1. $\;$
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Should that be parsed as $\: (10)^{-|m| \operatorname{mod} b} \:$ or $\;\;\; 1 \: || \: 0^{-|m| \operatorname{mod} b} \:\:\:\:$? $\;\;\;\;\;\;\;\;$
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
For all messages m, if |m| is not a multiple of b then your formula will give $\:$ m || 0 $\:$ the same MAC as m. $\;\;\;\;$
May
6
comment Mutual verification of shared secret
@codebeard : $\:$ With the "naive approach" given in your question, Bob could just $\hspace{1.25 in}$ calculate h(h(x)) for whatever xs he wants. $\;\;\;\;$
May
6
revised Mutual verification of shared secret
expanded on what I mean
May
6
answered Mutual verification of shared secret
May
6
comment How to map a handful of numbers in a large range to a much smaller range deterministically without collissions
It specifically can avoid picking the hashing function based on data. $\;$
May
6
comment How to map a handful of numbers in a large range to a much smaller range deterministically without collissions
Does the "deterministically" part rule out universal hashing? $\;$
May
4
reviewed Edit How do I prove IND-CPA security of RSA-OAEP?