3,920 reputation
1621
bio website
location United States
age
visits member for 3 years, 3 months
seen 3 mins ago

Jan
23
comment Simple message authentication code
@Melab : $\:$ en.wikipedia.org/wiki/Universal_hashing $\;\;\;\;$
Jan
23
comment Simple message authentication code
That construction requires collision-resistance of the hash function. $\;$
Jan
20
revised Montgomery and Galois fields
general copy-editing
Jan
19
comment Public key encryption and big files with NaCL
No, public "key encryption is done with" ["the target public key"] and randomness and the message. $\:$ Signcryption adds in "the source private key" so that "the decryption step" will ensure "mutual authentication", which will guarantee that "the chunks are not forged". $\:$ You "need to add an extra step" into your question so that people know you're using signcryption rather than just PKE. $\;\;\;\;$
Jan
18
comment Updating the secret key used for HMAC
If even if "there will only ever be as much entropy on the chip as you put on it to begin with", providing forward-security would still be a "purpose in updating the key". $\;$
Jan
18
comment Public key encryption and big files with NaCL
You should MAC an ordered pair that indicates the autoinc and the ciphertext. $\;$
Jan
17
comment RSA signing security
@poncho : $\:$ The attacker could get such a signature by sending a prediction of the nonce $\hspace{.97 in}$ to the server while masquerading as the(/a) client. $\;\;\;\;$
Jan
17
comment Public key encryption and big files with NaCL
"being able to decrypt it" certainly doesn't verify it, especially since the encryption is public key. $\hspace{.6 in}$
Jan
17
comment RSA signing security
"receiver repeats the nonce" $\: \mapsto \:$ "nonce is predicted" $\;\;\;\;$
Jan
16
comment Public key encryption and big files with NaCL
Verifying "the order of chunks" is not enough; you should also verify the chunks. $\;$
Jan
16
comment What kind of attack does the current brokenness of SHA-1 allow?
@yyyyyy : $\;\;\;$ Yes, but incorrectly, since for second preimage resistance, d1 is chosen uniformly at random from the set of strings whose length is length(d0) (where d0 is the adversary's initial output). $\:$ In particular, any collision trivially allows one to find a d1 and an easy way to perform the OP's task for that d1. $\;\;\;\;\;\;\;$
Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
That requirement is not present in these definitions of one-time signature scheme. $\hspace{1.44 in}$
Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
@Bren2010 : $\:$ "No, because n is an upper bound" on what? $\;\;\;\;$
Jan
14
revised Updating the secret key used for HMAC
fixed spelling and spacing
Jan
14
comment What cryptanalysis is possible against two independent keystreams XORed against plaintext?
What he's talking about is a cascade of stream ciphers. $\;$
Jan
13
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
Every "signature scheme which is valid for an unbounded number of signatures (the current design)" is "an n-time signature scheme". $\:$ However, for direct constructions of n-time signature schemes, your suggestion would allow for somewhat-short arguments that the child CA misbehaved. $\;\;\;\;$
Jan
10
comment How much (home PC) CPU time is required to generate a prime number of a given size?
@Reid : $\:$ This paper gives an intermediate approach. $\;\;\;\;$
Jan
10
comment How much (home PC) CPU time is required to generate a prime number of a given size?
Since "the prime number computed should be immediately next to the given random number," the best known bounds on the time grow more quickly than the square-root of "the given random number". $\hspace{.55 in}$
Jan
9
revised Key derivation of public key without knowledge of private key?
attempted a summary of how it could be used
Jan
8
answered Key derivation of public key without knowledge of private key?