3,597 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 1 hour ago

Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$
Aug
19
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using k = 3 + H(N,g,A) would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$
Aug
19
comment SRP-6 vulnerabilities when N is small
If "someone ... B - kv" then succeeding at finding those logs would give candidate S values. $\hspace{.54 in}$ Probably not, since those logs will almost always exist. $\;$
Aug
19
revised SRP-6 vulnerabilities when N is small
fixed math error
Aug
19
revised Entropy Loss of KDFs
fixed typos and separated questions
Aug
19
comment SRP-6 vulnerabilities when N is small
The attacker that you say "is in the same position as one who breaks into the server and steals $v = g^x$, but isn't able to break the DL". $\;$
Aug
19
comment SRP-6 vulnerabilities when N is small
How would that attacker impersonate the server without finding the password via 3&4? $\hspace{1.23 in}$
Aug
19
revised SRP-6 vulnerabilities when N is small
fixed error
Aug
18
answered SRP-6 vulnerabilities when N is small
Aug
18
comment Is my id obfuscation algorithm secure?
What programming language is that? $\:$ Will the lengths of x.low ever be different for the same key? $\:$ What about the lengths of x.high? $\;\;\;\;$
Aug
18
comment Is my id obfuscation algorithm secure?
I don't see why it should be at all likely "that next hash will have the same chip as the owner". $\hspace{.75 in}$
Aug
18
revised Attacking a hardware AES implementation if it leaks the intermediate round states
fixed typo
Aug
18
comment Is my id obfuscation algorithm secure?
Mainly because he doesn't give a specification. $\:$ On the other hand, his system includes "Insecure low-bandwidth unstable one-way channels", and one of his requirements refers to "create too large outputs (over 64-bit)". $\;\;\;\;$
Aug
18
comment Is my id obfuscation algorithm secure?
No, it means you'll find a secure short-output PRF collision, which is not impressive. $\hspace{1.32 in}$
Aug
18
comment Is my id obfuscation algorithm secure?
Your way runs into the birthday problem. $\;$
Aug
18
comment Encryption method with master key and user keys
Yes. $\:$ Do other players need to be able to verify a user's changes on their own? $\:$ Should the game/program not know the passwords? $\;\;\;\;$
Aug
17
revised Construct block cipher from a smaller one with mixing function
improved grammar
Aug
17
comment Is my id obfuscation algorithm secure?
In that case, if additionally he won't be able to meaningfully influence the ids after seeing a ciphertext, then you can use theorem 2 (on page 6) instead of equation (1). $\;$
Aug
17
revised How can I fix a corrupted PGP file?
fixed title's grammar
Aug
17
comment Is my id obfuscation algorithm secure?
Even if they're not interested in forgeries, an adversary might want to submit its own ciphertext as part of trying to trace specific chips. $\:$ For equation (1) on page 4 of the swap-or-not paper, N is $2^{48}$, $r$ would be 500, and $q$ would be [[[number of encryptions per chip] times [number of chips]] plus [number of additional ciphertexts that an adversary might submit]]. $\;\;\;\;$