meta user
network profile
| bio | website | google.com |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 7 months |
| seen | 37 mins ago | |
| stats | profile views | 23 |
|
May 1 |
comment |
Is it worth applying a MAC on data in a HSM? You wrote the expression for $k_r$ differently in your comment and your post; $k_m$ should be the block $\hspace{.4 in}$ cipher key. $\:$ It would take slightly more space and time, but you might use SIV mode instead, $\hspace{.5 in}$ where one of the headers is the record ID. $\:$ (www.cs.ucdavis.edu/~rogaway/papers/siv.pdf) $\;\;$ |
|
May 1 |
comment |
Is it worth applying a MAC on data in a HSM? No, since I'm not aware of any. $\:$ However, my understanding is that related key $\hspace{1.4 in}$ attacks are usually based on xor relations. $\;\;\;$ |
|
May 1 |
comment |
Is it worth applying a MAC on data in a HSM? Is there a reason for just doing xor-encryption with the master symmetric key, rather than something that would make a related-key attack more difficult after a compromise of the application server? $\;\;$ |
|
May 1 |
comment |
Is it worth applying a MAC on data in a HSM? I just found your use of the singular odd. $\:$ How will you do the cipher operations while still having $\hspace{.5 in}$ "that both the HSM and application server would have to be compromised in order to reveal the key[s]"? |
|
May 1 |
comment |
Is it worth applying a MAC on data in a HSM? Will there really be only one "HSM record key"? $\:$ |
|
Apr 30 |
answered | How to compare two datasets „anonymously”? |
|
Apr 30 |
comment |
How to compare two datasets „anonymously”? That's way more complicated that what's needed for his situation. $\hspace{2.2 in}$ See $\:$ en.wikipedia.org/wiki/Socialist_millionaire . $\;\;$ |
|
Apr 30 |
comment |
Why does key generation take an input $1^k$, and how do I represent it in practice? You should probably represent $1^k$ with the binary representation of $k$. $\:$ |
|
Apr 29 |
comment |
Secure order preserving hash function @curious: $\:$ That is just recovering a plaintext, not breaking the OPE. $\;\;\;$ |
|
Apr 29 |
comment |
Secure order preserving hash function "if the hash function is not publicly available and it's keyed" then you have order-preserving encryption. |
|
Apr 29 |
comment |
Secure order preserving hash function @fgrieu: $\:$ SHA is completely irrelevant for your construction. $\;\;\;$ |
|
Apr 29 |
comment |
risk of attacker decrypting RSA ciphertext without public or private key Neither; we mean that a practical attack is discovered to get information about $\hspace{1.8 in}$ the data from the public key and the ciphertext. $\:$ |
|
Apr 29 |
awarded | Citizen Patrol |
|
Apr 28 |
comment |
Question about proof of knowledge defintion? $|x|^c$ means $(\text{len}(x))^c$, and the "result" of the term is a real number. $\:$ The only way I can $\hspace{1.2 in}$ think of to define $\kappa(x)$ is $p(x)$ minus the probability that $K$ succeeds, but that would end $\hspace{1.2 in}$ up making their defintion of a proof of knowledge trivial. $\;\;$ |
|
Apr 28 |
comment |
Secure encrypt-then-sign with RSA After fixing that, there's still the issue of, even if the PKE is CCA2-secure, there's not necessarily a secure way for the receiver to non-interactively convince anyone else of what the plaintext on a signed message was. $\:$ (If the PKE does not have perfect completeness, then there's not necessarily any way for the receiver to convince anyone else of what the plaintext on a signed message was.) $\:$ To address that, you should use sign-encrypt-sign, with the recipient's public key going into what's signed both times. $\;\;$ |
|
Apr 28 |
comment |
Secure encrypt-then-sign with RSA The issues with your original approach and your most recent approach are that neither of them prevents surreptitious forwarding. $\:$ To address that, the sender's public key should be associated data for the symmetric AEAD. $\;\;$ |
|
Apr 28 |
comment |
Secure encrypt-then-sign with RSA Your original idea already achieves that. $\:$ |
|
Apr 28 |
comment |
RSA - Ecrypting the same data with the same public key = same ciphertext? Also, the only reason I asked about padding was because the second sentence in your post here $\hspace{.42 in}$ made it sound like you had even less understanding of what to do than your post there does. $\:$ |
|
Apr 28 |
comment |
RSA - Ecrypting the same data with the same public key = same ciphertext? Why aren't you using SSL/TLS there? $\:$ |
|
Apr 28 |
comment |
RSA - Ecrypting the same data with the same public key = same ciphertext? I would certainly hope so. $\:$ |
