Timeline for What is the ideal cipher model?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 16, 2013 at 3:45 | history | edited | Seth | CC BY-SA 3.0 |
added 1056 characters in body
|
| Sep 16, 2013 at 3:40 | history | edited | Seth | CC BY-SA 3.0 |
added 1056 characters in body
|
| Sep 15, 2013 at 17:19 | comment | added | Seth | @pg1989 MD5 uses a Merkle–Damgård structure with a Davies-Meyer compression function. The compression function uses a block cipher. A natural question to ask is if we can prove MD5 is, e.g., collision resistant by starting with some assumption about the security of the block cipher. My point was that the PRP assumption won't help us out here, because the PRP definition assumes a random secret key, but the block cipher is being used in a mode of operation where the key bits are known to (in fact, chosen by) the attacker. | |
| Sep 15, 2013 at 17:11 | comment | added | Seth | @RichieFrame It's true that if you use a Davies-Meyer compression function, the message bits get used as key bits in the block cipher. But the message bits certainly aren't secret when talking about collision resistance (and they aren't necessarily random, either). | |
| Sep 15, 2013 at 9:15 | comment | added | Richie Frame | Actually I believe the message is considered the secret key in MD type hash functions | |
| Sep 15, 2013 at 8:41 | comment | added | pg1989 | >But anyone can compute MD5 --- there's no secret key involved, so the PRP assumption doesn't apply. That isn't why the PRP assumption doesn't apply to MD5. | |
| Sep 15, 2013 at 6:42 | history | edited | Seth | CC BY-SA 3.0 |
added 83 characters in body
|
| Sep 15, 2013 at 6:34 | history | edited | Seth | CC BY-SA 3.0 |
deleted 2 characters in body
|
| Sep 15, 2013 at 6:09 | history | edited | Seth | CC BY-SA 3.0 |
deleted 5 characters in body
|
| Sep 14, 2013 at 21:08 | history | answered | Seth | CC BY-SA 3.0 |