Reputation
4,932
Next tag badge:
51/100 score
30/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~47k people reached

Jul
20
comment Implementing forward secrecy in OpenPGP with public key authentication
In other words, do you also require forward authenticity? $\;$
Jul
20
comment Implementing forward secrecy in OpenPGP with public key authentication
"forward secrecy" ... "sent from that user." $\:$ Do you actually mean forward security? $\:$ The situations for secrecy and authenticity are rather different. $\;\;\;\;$
Jul
19
comment Why don't use random padding in RSA?
Probably because we want to be more confident in 2. $\;$
Jul
19
comment Simulation based proofs: Simple examples
This was cross-posted to mathoverflow after less than 2 hours without mentioning that on either site. $\hspace{.42 in}$
Jul
18
comment 64bit nonce in AES-CTR, why not 128?
Your question is missing a description of what "IV"'d means. $\;$
Jul
18
comment Determine AES key given encrypted and unencrypted files
As far as is publicly known. $\;$
Jul
18
answered Determine AES key given encrypted and unencrypted files
Jul
17
revised Is authenticated encryption basically a lockable box?
corrected last block and expanded an earlier block
Jul
17
comment Is authenticated encryption basically a lockable box?
Right. $\:$ (I just expanded on that in my answer.) $\;\;\;\;$
Jul
17
revised Is authenticated encryption basically a lockable box?
expanded
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
The attacker could do that regardless of whether or not Alice initiated the challenge session. $\hspace{.86 in}$
Jul
17
comment What needs to be proved for a cryptosystem to be secure?
One can build a key exchange system that "can be proven to depend upon the security of the Computational Diffie-Hellman Problem (CDHP)" (via Theorem 6), but as far as I'm aware, the security of Diffie-Hellman itself as a key exchange system against passive adversaries is not known to follow from the hardness of the CDHP. $\;$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
No, forward secrecy also applies to the parties' identities. $\:$ An active adversary can just choose $x$ and then decrypt to get Bob's signature. $\:$ For passive adversaries, distinguishing between candidate parties would require breaking the underlying key exchange (Diffie-Hellman of PK encrypted symmetric key) or the symmetric encryption. $\:$ Even for active attackers, the only other way to do that would require choosing one of the messages for the underlying key exchange, which in turn would require being one of the parties or breaking the signature scheme. $\;\;\;\;$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
The definition is that the adversary's ability to distinguish between different initiators is negligible. $\hspace{.57 in}$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
Why would this scheme be "already broken from identity point of view" if $\hspace{1.87 in}$ "he has a specific subset to choose from"? $\;$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
possible duplicate of In the STS Authentication Protocol, why are the signatures encrypted?
Jul
17
answered Is authenticated encryption basically a lockable box?
Jul
17
comment Unconditional authentication
Yes. $\:$ My suggestion (now removed) was worse. $\:$ All strongly universal hash families $\hspace{1.27 in}$ are universal hash families. $\;\;\;\;$
Jul
17
revised Unconditional authentication
changed #1 to hopefully be accurate
Jul
17
comment Deterministic ECDSA signatures?
You already mentioned another way "to create deterministic signatures". $\:$ BLS is another way to create signatures where there is at most one valid signature per message. $\;\;\;\;$