Reputation
5,952
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 22
Newest
 Informed
Impact
~66k people reached

Mar
28
comment Authenticated encryption with Enc-Sign-Mac
Enc-Sign-Mac doesn't hide the sender's identity from eavesdroppers. ​ ​
Mar
27
revised Lightest symmetric, fixed key, “Format preserving Encryption” algorithm?
fixed spelling and improved grammar
Mar
27
comment I homebrewed an algorithm. Is it secure?
This is at most one-time secure, since otherwise rpass will be reused. ​ ​
Mar
26
revised Authenticated encryption with Signatures
fixed after actually reading malexmave's link
Mar
25
comment Is this session start protocol secure?
No, since eavesdroppers can use ​ 3. & 4. ​ to check possible master passwords. ​ ​ ​ ​
Mar
25
comment Authenticated encryption with Signatures
If the MAC gets signed then you lose strong unforgeability with respect to verifiers that don't know the MAC key. ​ Otherwise, no. ​ ​ ​ ​
Mar
23
answered Authenticated encryption with Signatures
Mar
23
comment Combining public key signature schemes and private key encryption
@LukasSchüßler : ​ I just realized that for sign-then-encrypt, you'd need to make sure the lengths of the encodings of the [message,signature] pairs don't reveal more about the messages than the lengths of the messages. ​ ​ ​ ​
Mar
23
revised What are the minimum constraints on RSA parameters and why?
added detail
Mar
22
revised Combining public key signature schemes and private key encryption
fixed the one "i" that slipped through
Mar
22
comment Combining public key signature schemes and private key encryption
More generally, a non-malleable cipher would be sufficient. ​ Additionally, encrypt-then-sign doesn't work nearly as well in the symmetric-encryption case, since for non-repudiation the recipients must reveal the symmetric key and somehow show that the revealed key was the actual symmetric key. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​
Mar
22
revised Combining public key signature schemes and private key encryption
fixed "i"s
Mar
22
comment Can the SHA256 hashes of consecutive integers be attacked?
Length extension attacks are a "known weakness in SHA256 about hashing related messages." ​ (However, I don't see any way of using them here.) ​ ​ ​ ​
Mar
20
comment Is regular CTR mode vulnerable to any attacks?
CTR mode is malleable. ​ (ECB mode is too, but has a worse problem.) ​ ​ ​ ​
Mar
20
comment Is regular CTR mode vulnerable to any attacks?
en.wikipedia.org/wiki/Malleability_(cryptography) ​ ​
Mar
20
comment What's the best way to pad a message?
Are your messages fixed-length? ​ ​
Mar
19
comment What are the minimum constraints on RSA parameters and why?
$\langle n,\hspace{-0.02 in}e,\hspace{-0.02 in}d\rangle \: = \: \langle 391,\hspace{-0.02 in}3,59\rangle \;\;\;$ is an example in which $e\hspace{-0.04 in}\cdot \hspace{-0.04 in}d$ isn't congruent to $1$ mod $\phi(n)$. $\;\;\;\;\;\;\;\;$ This allows smaller $d$. $\;\;\;\;\;\;\;\;$ Wikipedia explains the relevant property, although I find the reason for that easier to grasp when considering the decomposition into prime powers rather than gcd(m,n) and n/(gcd(m,n)). $\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;$
Mar
19
comment Finding Private key in RSA with public key, cipher text and plain text
cseweb.ucsd.edu/~mihir/papers/blindsigs.pdf ​ ​
Mar
18
comment Simple application of verifiable random function?
cs.umd.edu/~jkatz/gradcrypto2/NOTES/lecture12.pdf#page=4cs.umd.edu/~jkatz/gradcrypto2/NOTES/lecture13.pdf ​ ​ ​ ​
Mar
18
revised What are the minimum constraints on RSA parameters and why?
simplified last condition