Reputation
4,951
Next tag badge:
51/100 score
30/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~47k people reached

Aug
6
comment Is there a secure source of entropy on a typical microcontroller?
"what constitutes a strong extractor on an mcu" is the same as $\hspace{2.46 in}$ "what constitutes a strong extractor on" anything. $\;$
Aug
4
comment Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator
Yes. ${}{}{}\;$
Aug
3
revised Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator
fixed typo
Aug
3
comment Is there a secure source of entropy on a typical microcontroller?
If he can use a strong extractor, then he probably shouldn't just take the LSB(s). $\hspace{1.68 in}$
Aug
3
answered Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator
Aug
3
comment Is there a secure source of entropy on a typical microcontroller?
That would presumably be secure from a computational point of view, rather $\hspace{1.71 in}$ than just a number-theoretic point of view. $\;$
Aug
2
comment Key exchange resilience to DoS attack
I fixed an error in what I was suggesting. $\;$
Aug
2
revised Key exchange resilience to DoS attack
fixed security hole
Aug
2
comment Extend OTP on random data?
It doesn't even provide non-malleability. $\;$
Aug
2
comment Public SRP verifiers or public hash chain “public keys” when secret is low entropy password
If the password is the user's only secret, then the server can simply try passwords offline. $\:$ There is just no way around that. $\:$ With that in mind, do you have a reason for preferring SRP over a signature scheme, where the server holds a ciphertext that is the encryption of the private key with a symmetric key derived from the user's password? $\;\;\;\;$
Aug
2
answered Key exchange resilience to DoS attack
Aug
2
comment ssh-keygen DH Primality Testing
For bit-length of at least 700, the paper I linked to gives a better bound $\hspace{2.12 in}$ than 1-(2^(-30)) even with just one test. $\;$
Aug
2
comment Extend OTP on random data?
No. $\:$ Bob can decrypt much more than 256 bits of plaintext with just 256 bits of key material, $\hspace{.86 in}$ so it can't be information-theoretically secure, and it's too simple for computational security. $\hspace{.95 in}$
Aug
2
comment ssh-keygen DH Primality Testing
I don't know whether-or-not they use Miller-Rabin, but if so, then this paper $\hspace{1.84 in}$ gives upper bounds on that probability. $\;$
Aug
1
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Associated data authentication might work, but in general one should just use a(n efficiently-invertible) pairing function (that is efficiently computable), such as $\:$ prefixfree(x) || y $\:$ or if ​ length(y) < length(x) ​ then ​ 1 || prefixfree(y) || x ​ else ​ 0 || prefixfree(x) || y. $\hspace{.54 in}$
Aug
1
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
In general, $\;\;\; (x,\hspace{-0.03 in}y) \: = \: x\hspace{.04 in}||\hspace{.03 in}y \;\;\;$ does not work, since $\;\;\; 1\hspace{.03 in}||\hspace{.03 in}11 \: = \: 111 \: = \: 11\hspace{.03 in}||\hspace{.03 in}1 \hspace{1.68 in}$ but one would need $\;\;\; (1,\hspace{-0.04 in}11) \neq (11,\hspace{-0.04 in}1) \:\:\:\:$. $\;\;\;\;\;\;\;\;\;$
Aug
1
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Is it also "assumed that any party can correctly decomposit" $\:$ c || ciphertext $\:$ "and thereby recover the length of $c$"? $\;\;\;$ (After all, if $c$ is just being prepended, then that's what would need to be decomposed.) $\;\;\;\;\;\;\;\;$
Aug
1
comment Signature Verification: High level
It's neither of those things. $\:$ See this answer. $\;\;\;\;$
Aug
1
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
The OP fixed that issue well before you posted this answer. $\;$
Aug
1
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Also, is it assumed that the private-key holder can recover length(c) from $\hspace{1.79 in}$ length(c) + length(the_ciphertext) $\:$ ? $\;\;\;\;$