3,577 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 4 mins ago

Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
The main problem is that I'm not aware of any reason(s) it should be hard to have a significant probability of finding an asymmetric encryption of a random message's digest-hash. $\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
@P.T. : $\:$ Do you mean a symmetrically encrypted hash, or one that was encrypted $\hspace{1.35 in}$ "with the message author's private key"? $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
Even after your edit, your post does not mention signing. $\:$ A commitment to the AES key needs to be included in what gets signed, since otherwise the receiver could break non-repudiation by claiming a different AES key. $\:$ Additionally, there needs to be only one way to split what gets signed back into its parts. $\:$ (If at most one part is not fixed-length, then the previous sentence will automatically be satisfied.) $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
Yes, since encrypting the digest-hash with the message author's private key is not necessarily useful. $\:$ Instead, the author should presumably sign the output from (2) with the author's private key. $\hspace{.95 in}$
Aug
11
comment Streaming mode of operation that is more resistant against nonce reuse
When I thought about this before, the candidate that I came up with was letting each block's key be the result of applying a PRF to the previous block (starting with the IV). $\;$
Aug
10
comment Is HMAC-SHA-1 secure?
cseweb.ucsd.edu/~mihir/papers/hmac-new.html $\;$
Aug
8
comment RSA, finding p,q
$e$ is not supposed to be secret. $\;$
Aug
7
revised How can I control the output of a hash function to output to specific data according to similarity?
improved title's grammar
Aug
5
comment Skein or Keccak stream cipher construction
In particular, even though one is "guaranteed by the MAC security property (existential forgery) that an adversary cannot generate any of the key stream on" its own, that does not necessarily give a secure stream cipher. $\;$
Aug
5
comment Interleaving bytes to make an effectively larger block size
"key digest" $\: \mapsto \:$ "part of the key" $\;\;\;$ ? $\;\;\;\;\;\;\;$
Aug
5
comment Skein or Keccak stream cipher construction
A MAC does not necessarily suffice. $\:$ One needs a PRF. $\;\;\;\;$
Aug
3
comment Constant data as input to hash
Is the "source data" the constant data or the non-constant data? $\;$
Aug
3
comment Is SRP post-quantum secure?
That is what it refers to. $\:$ For S/KEY, I think a commitment scheme that is one-to-one non-malleable, extractable, and equivocable would suffice, although the only candidates for that which I can think of use at least multi-string setup. $\:$ What is "a similar alternative based on Lamport's scheme"? $\;\;\;\;$
Aug
1
answered Is SRP post-quantum secure?
Aug
1
comment Theoretical attack on RSA
crypto.stackexchange.com/q/16036/991 $\;$
Aug
1
answered Is perfect-forward secrecy achieved with RSA?
Jul
31
comment Using Lattice-based cryptography for TLS\SSL
@otus : $\:$ Do you know of a generic proof that there isn't a classical algorithm to solve RSA? $\hspace{.88 in}$
Jul
31
comment Is this an acceptable All-or-Nothing Transform?
It's just confusing, since you use "$H$" for something quite different. $\:$ You could say "and a source of (pseudo)random bits". $\;\;\;\;$
Jul
31
comment Is this an acceptable All-or-Nothing Transform?
I don't see any reason to use $G$. $\;$
Jul
31
comment Is this an acceptable All-or-Nothing Transform?
In that case, should "Extract $b$ bits ... $G$" be replaced with "Generate a random block of $b$ bits"? $\hspace{.6 in}$