Hi there @e-sushi, I was perusing around and found a question of yours: crypto.stackexchange.com/questions/18202/… . I recently asked a similar question directed towards block ciphers. Since the core issue is really similar, I was wondering if I could pick your brain regarding anything your question helped you to conclude? Is it ultimately inadvisable to incorporate the data into the keystream?
Side note: many thanks for all of your insightful questions and answers! Which really goes to lots of people here, to be honest...
FYI everyone: I did a roll-back on the following question (by a newbie). I'm not sure whether the OP will not try again. If he does, a lock may be neccessary (consider this an informal flag). I've left him a comment that his question is not closed and that he should delete it if wants no answers anymore.
On the 2nd page of "New probabilistic public-key encryption based on the RSA cryptosystem" by Roman'kov (PDF), at last it says Alice can find "f" of order "l" with least probability of (1-1/l). I cannot understand how they came up with this probability.
Can anyone help me with this.
@EllaRose you may want to have a look at the OCB mode and Katz' new high-speed modes. They both use tweakable block ciphers to get fast authenticated encryption. OCB, Katz' modes
@EllaRose I’ld say that – in the end – it strongly depends on the specific scenario… but bluntly sharing my personal opinion for the “general screnarios and use cases”: yes, I would avoid it unless there is a good reason to do so.
@EllaRose I’ll skip my reasoning as that would most probably get too lengthly to post here (and – to be honest – I’m currently also lacking the time to do so). If you’ve got a question up at Crypto.SE, chances are someone will write up an answer with according hints and/or reasons.
@SEJPM lol – Don’t want to brag, but I‘ve got BIG inboxes that will eat near to anything. (Not saying that I read everything they swallow.) Nevertheless, I’ve scratched that part “to protect the innocent”. /* Looks at SEJPM and smiles… */
Here was my question: crypto.stackexchange.com/questions/35254/security-of-randomized-data-dependant-key-schedules . It's not nearly as well formed as e-sushi's question was. I didn't know of an example to point to and the one I tried to give didn't appear to highlight the point very well, but I was basically asking the same question you did.
@SEJPM I have heard of those (was thoroughly "wowed" by the latter ones and the automated approach). My interest was actually in authenticating the primitive itself, and whether or not that's even a good idea.
I know usually authentication is done at the mode of operation level, and my own software uses AES-GCM or AES-CBC/CTR-HMAC
(and i'm the only one that uses that at all). I am more into playing with things and learning about the insides then out to create some kind of properly functional scheme to protect data in the real world
I do appreciate all the recommendations I can get though!
eats the information like pacman
@e-sushi Did authentication turn out to be a good enough reason to do so? I saw mention of that in your question, and to be honest authentication was the source of my interest in the idea to begin with. That and if it might complicate statistical side channels at all. Thank you for your time, I do appreciate it!
I really mean the last part, too. There's no way I could afford to pay for someone to consult me on these things and it's pretty hard to find people to talk to about crypto in day to day life. Of the few people I know, their eyes would just glaze over.
That gratitude applies to many users on here, really.
On the 2nd page of "New probabilistic public-key encryption based on the RSA cryptosystem" by Roman'kov (PDF), at last it says Alice can find "f" of order "l" with least probability of (1-1/l). I cannot understand how they came up with this probability.
Can anyone help me with this.
The Side Channel
The Side Channel