Luis Casillas
• Member for 5 years, 9 months
• Last seen this week

I think I can spot an implicit assumption that you're making that could easily trip this up: Assumption: None of the ciphers is its own inverse. Counterexample: Stream ciphers are a popular class of ...

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to ...

So, AES is more secure than one-time-pad in this case. No, the one-time pad is perfectly secure, so it cannot be less secure than AES. What's tripping you up is you're not understanding a subtle ...

What I mean is can there be two messages M, M' both of the same length such that both md5(M)=md5(M') and sha256(M)=sha256(M')? Yes, such a pair of messages must exist, for the same reason that any ...

Your idea of salting the signature to prevent the collision attack doesn't work, because your salted signing operation is a deterministic mathematical function, and the random choice of salt is only ...

I think you're running into a conceptual misunderstanding here and looking to extract entropy from values that are better understood as a signal (your GPS's estimate of your position) instead of ...

Actually, by your own criterion, the same nonce is routinely used much more than twice, because each call to the ChaCha20 core function reuses the same key and nonce, except with a different counter ...

"Short" and "long" are relative terms. If I secretly make 128 coin flips and write down the results, that sounds like a lot of coin flips, doesn't it? There's $2^{128} > 10^{38}$ combinations I ...

Here are two standard (and equivalent) definitions of confidentiality in symmetric encryption. If Alice sends Bob a message and Eve manages to see it in transit, Eve cannot (without an unreasonable ...

My question is that Poly1305 provide authentication and Salsa20 provides encryption, a combination of both can be considered AEAD or not? There are many ways you could combine both, some are AEADs ...

Compression works by approximating an optimal code—one where if the probability of a given message is $p$, its encoded length is $-log(p)$. This means that the lengths of the encryptions of compressed ...

Thing is, this got me thinking - a nonce, in my book is a protection against forgery, but here I am giving it away. The primary purpose of nonces is not protection against forgery, but rather, to ...

The questions you're getting confused by are, indeed, confusing, but I think I figured out what's going on. Imagine a scenario where: A company want to issue exactly 10,000 numbered coupons; They are ...

Note that for $G : \{0,1\}^s \to \{0,1\}^{n}$ to be a PRG, $n$ must be some polynomial of $s$, so let's rewrite this as $G : \{0,1\}^s \to \{0,1\}^{\ell(s)}$, where $\ell(s)$ is a polynomial. To ...

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext ...

Imagine I have some serialization (example JSON) that can have 1-100 fields I’ll assemble into data to be get a MAC (my AD in AEAD). The receiving end has no idea which ones are coming, and the ...

How can the output of a probabilistic algorithm be different for the same pair of plain text and key when used two different times? The probabilistic algorithm makes calls to a random number ...

However, since most books define the keyspace $\mathcal{K}$ to be finite, then with infinite time any computational device can perform an exhaustive keysearch. The thing is that it isn't sufficient ...

So for example, I have the following cipher: $F_k^r(m) := r(k,m)$. Now $r$ is defined as a random compression function such that $r: \{0,1\}^{3n} \rightarrow \{0,1\}^n$. The length of $k$ and the ...

I think here it helps to examine the nature of length extension attacks, which have to do with the fact that practical hash functions are iterative. They break up their input into a sequence of fixed-...

The first point I'd make is: why can't you just use TLS? (Or if it's a non-interactive protocol, why can't you use ECIES?) Nonce-96-bit = Timestamp-Milliseconds-64bit combined_with CsRandom-Number-...

I would recommend modularizing the implementation into these components: A generic interface abstracting the concept of a block cipher. A generic CFB mode implementation, that instead of hardcoding ...

Let's say I encrypt my passwords with PBKDF2 and store it somewhere. It's not clear here whether you literally mean to encrypt some passwords with a key derived from a master password (as a password ...

Isn't unverified plaintext released just nonsense? You're looking at it from a human perspective, and assuming that gibberish is harmless because there's a human in the loop that would spot it. But ...

A real-life example that's relevant is Diceware, where users generate strong, uniform random passphrases by rolling dice and looking the results up in a numbered wordlist. Diceware's virtue is ...

why is the plain text, cipher stream and cipher text all in binary? In the first picture, it is all in letters, now in the second picture, it is all in binary. Because classical cryptography (e.g., ...

You should pick the function that gives a CPU-equipped defender the most advantage against GPU-based attackers (which are the likeliest attackers). How do we find this out? First, let's benchmark ...

The CPA indistinguishability experiment definition that you give is taken from Katz & Lindell's textbook. In my copy (2nd Ed.), it's on page 74. It would seem like this definition cannot be ...