3,650 reputation
1520
bio website
location United States
age
visits member for 2 years, 11 months
seen 2 hours ago

Aug
11
comment Computational Complexity - When is it really exponential time?
@polarbear : $\:$ That's why we "view matrix multiplication relative to the size of the" $\hspace{1.2 in}$ matrices (since those are the inputs). $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
I would heuristically expect that to hold for RSA even if the public keys are not known to attackers, since I would expect signatures to be distributed roughly uniformly in {1,2,3,4,5,...,modulus-1}. $\:$ On the other hand, it is provably the case that if there are are secure signature schemes then there are secure signature schemes for which the signatures do not provide signer anonymity even against parties that don't have any of the verification keys. $\:$ Also, "messages cannot be repudiated by senders" is a feature (see the upper #3 in the OP). $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
The OP's scheme also does not provide signer anonymity against eavesdroppers. $\hspace{1.55 in}$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
You're missing that you still haven't edited your question to specify that the author will be signing with the author's private key instead of encrypting with the author's private key. $\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
The main problem is that I'm not aware of any reason(s) it should be hard to have a significant probability of finding an asymmetric encryption of a random message's digest-hash. $\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
@P.T. : $\:$ Do you mean a symmetrically encrypted hash, or one that was encrypted $\hspace{1.35 in}$ "with the message author's private key"? $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
Even after your edit, your post does not mention signing. $\:$ A commitment to the AES key needs to be included in what gets signed, since otherwise the receiver could break non-repudiation by claiming a different AES key. $\:$ Additionally, there needs to be only one way to split what gets signed back into its parts. $\:$ (If at most one part is not fixed-length, then the previous sentence will automatically be satisfied.) $\;\;\;\;$
Aug
11
comment Do I need to use AE/AEAD in my particular scenario? Or is it redundant?
Yes, since encrypting the digest-hash with the message author's private key is not necessarily useful. $\:$ Instead, the author should presumably sign the output from (2) with the author's private key. $\hspace{.95 in}$
Aug
11
comment Streaming mode of operation that is more resistant against nonce reuse
When I thought about this before, the candidate that I came up with was letting each block's key be the result of applying a PRF to the previous block (starting with the IV). $\;$
Aug
10
comment Is HMAC-SHA-1 secure?
cseweb.ucsd.edu/~mihir/papers/hmac-new.html $\;$
Aug
8
comment RSA, finding p,q
$e$ is not supposed to be secret. $\;$
Aug
7
revised How can I control the output of a hash function to output to specific data according to similarity?
improved title's grammar
Aug
5
comment Skein or Keccak stream cipher construction
In particular, even though one is "guaranteed by the MAC security property (existential forgery) that an adversary cannot generate any of the key stream on" its own, that does not necessarily give a secure stream cipher. $\;$
Aug
5
comment Interleaving bytes to make an effectively larger block size
"key digest" $\: \mapsto \:$ "part of the key" $\;\;\;$ ? $\;\;\;\;\;\;\;$
Aug
5
comment Skein or Keccak stream cipher construction
A MAC does not necessarily suffice. $\:$ One needs a PRF. $\;\;\;\;$
Aug
3
comment Constant data as input to hash
Is the "source data" the constant data or the non-constant data? $\;$
Aug
3
comment Is SRP post-quantum secure?
That is what it refers to. $\:$ For S/KEY, I think a commitment scheme that is one-to-one non-malleable, extractable, and equivocable would suffice, although the only candidates for that which I can think of use at least multi-string setup. $\:$ What is "a similar alternative based on Lamport's scheme"? $\;\;\;\;$
Aug
1
answered Is SRP post-quantum secure?
Aug
1
comment Theoretical attack on RSA
crypto.stackexchange.com/q/16036/991 $\;$
Aug
1
answered Is perfect-forward secrecy achieved with RSA?