Luis Casillas
  • Member for 5 years, 9 months
  • Last seen this week
XOR and cipher stream
1 votes

why is the plain text, cipher stream and cipher text all in binary? In the first picture, it is all in letters, now in the second picture, it is all in binary. Because classical cryptography (e.g., ...

View answer
What is proper use of a True Random Number Generator?
3 votes

The contract of a true random number generator is that: Every bit it outputs has an equal chance of being a zero as a one; Knowledge of the values of any of the bits it has output in the past is of ...

View answer
Why this complexity defining AES-GCM counter block?
Accepted answer
4 votes

Knowing that it does not need to be secret and its only required property is to be unique, why not use a 128 bits true random number for the whole block? The counter instead of starting at 0 will ...

View answer
Best way to hash two values into one?
Accepted answer
14 votes

The most important thing you're missing is that you should combine the two strings with an injective function: a function such that every unique combination of inputs determines a unique output. ...

View answer
what is the block in crypto
Accepted answer
3 votes

Lots of practical cryptographic algorithms operate on variable length inputs. E.g., if you're encrypting messages, you want your algorithm to be able to handle messages of any reasonable length. But ...

View answer
HMACSHA1 vs HMACSHA2 (for PBKDF2)
1 votes

You should pick the function that gives a CPU-equipped defender the most advantage against GPU-based attackers (which are the likeliest attackers). How do we find this out? First, let's benchmark ...

View answer
clarify perfect secrecy definition
2 votes

"For all $k$, ..." would be a statement of the form that is formalized by first-order logic, but what's going on here is different, we're talking about probability theory, and if you're better ...

View answer
Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?
8 votes

Skimming these three papers should give you an idea (which I list roughly in the order I recommend you look at them): Rogaway, Philip. 2004. "Nonce-based symmetric encryption." Namprempre, ...

View answer
Why does md5_crypt move bytes around?
4 votes

One of the candidate answers you should consider is "for no good reason." As Provos and Mazières put it in the bcrypt USENIX paper (section 6.1.2): Some steps in the algorithm make it doubtful ...

View answer
Is there such a thing as perfect CPA security?
Accepted answer
1 votes

The CPA indistinguishability experiment definition that you give is taken from Katz & Lindell's textbook. In my copy (2nd Ed.), it's on page 74. It would seem like this definition cannot be ...

View answer
In end-to-end encryption, doesn't the server need to be trusted?
3 votes

Public-key cryptography allows precisely the sort of thing that's puzzling you: two parties can, over a public channel that eavesdroppers listen on, come up with a shared secret key. “Diffie-Hellman ...

View answer
One Time Pad change by third party?
Accepted answer
1 votes

I was reading about how a one time pad output can be changed by a third party without the receiving person realising. Surely the output at the other end would be garbage? There's no guarantee either ...

View answer
Authentication of data using XOR and a secure function
1 votes

This is a form of what this Bernstein paper calls an (unprotected) counter sum. It is not a secure MAC, it is vulnerable to a simple attack (and I'll use 1-based indexing, unlike your question's 0-...

View answer
Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?
Accepted answer
4 votes

I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet. There are two aspects to ...

View answer
Would this hash functionality fall under pre-image resistance or collision resistance?
1 votes

The property you're thinking of is just that of being a mathematical function: if $x = y$ then $f(x) = f(y)$. Computer folk, who often work with faux "functions" (scare quotes; routine or procedure ...

View answer
Can a key exchange protocol exchange a one time pad instead of a key?
2 votes

I think there's a problem here in that you're not specifying an attack model—what does the adversary see, and what powers do they have? For example, in the case of the one-time pad a standard ...

View answer
Does this use of hash provide anything over a nonce? HMAC instead?
1 votes

This looks like a straightforward application for a MAC. Let's summarize the security property of MACs: if the honest party chooses the key at random and keeps it secret, it should be impossible in ...

View answer
Key Derivation Functions offering better than 2^hlen security?
2 votes

Note that Krawczyk's paper builds the extract-and-expand paradigm from a notion that he labels computational randomness extractor. This is a modification of the concept of randomness extractor such ...

View answer
Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?
4 votes

Here's an answer that takes your question down a different path. RFC 2898, "PKCS #5: Password-Based Cryptography Specification: Version 2.0" is the document that defines the PBKDF2 function, ...

View answer
How to combine AES-CMACs
1 votes

The XOR of the tags is trivially vulnerable to multiple easy attacks by an active attacker, which will yield the same tag, for example: They can reorder chunks, because XOR is associative ($a \oplus (...

View answer
Can data over a very low bandwidth channel still be encrypted?
5 votes

If the sender and recipient can agree on the nonce of every message from existing context, so that the nonce either doesn't need to be transmitted or can be derived from metadata that must be ...

View answer
Definition of a distinguisher
5 votes

I think of it this way: think of a distinguisher as an adversarially-chosen statistical experiment that attempts to support or refute some hypothesis, that again is adversarially selected. This means ...

View answer
Is it safe to use a MAC as iv for CTR encoding?
Accepted answer
3 votes

First remark here should be don't roll your own crypto. That said, your idea seems to be a variant of Synthetic Initialization Vector mode (SIV, RFC 5297), where a pseudorandom function of the ...

View answer
Does a practical collision attack on a cryptographic hash function also mean it fails “indistinguishable from random data”?
Accepted answer
4 votes

Does a practical collision attack on a cryptographic hash function also mean we can (or should) consider it to fail “indistinguishable from random data”? Or does a collision attack have no influence ...

View answer
Combination of two stream ciphers
Accepted answer
5 votes

This sort of combination is vulnerable to a meet-in-the-middle attack. Let's start from one of your equations: $$ C = P \oplus f_1(K_1) \oplus f_2(K_2) $$ If we XOR $f_1(K_1)$ to both sides, we get:...

View answer
Is there a way or how to predict the output size as a result of encryption?
3 votes

This depends on: Precise choice of encryption algorithm Choice of representation for the ciphertext Size of additional metadata stored with each ciphertext On #1, 3DES, AES128, AES192 are block ...

View answer
Different languages use-cases in information encryption?
Accepted answer
2 votes

The problems here are that: If the method for obfuscating the message has definite, explicit, well-documented rules, then they are part of the encryption algorithm and therefore by Kerckhoff's ...

View answer
The difference between MACs vs. HMACs vs. PRFs
5 votes

You need to understand the difference between security goals vs. specific algorithms. PRF and MAC are security goals—they're definitions that stipulate properties that we would like cryptographic ...

View answer
How to express a coin flip based random generator mathematically?
3 votes

Boneh's definition of a pseudorandom generator stipulates that a PRG is a mathematical function—a mapping from an input domain to an output codomain such that the choice of argument value uniquely ...

View answer
Are there flaws in (cryptographic) science/engineering/software/research due to pseudo random generators?
5 votes

I know of one engineering example: the standard pseudo random number generator for the Haskell programming language is the StdGen type in the System.Random module. The RandomGen class that this ...

View answer
1
3 4
5
6 7
10