Thread Links |
Date Links |
||||
---|---|---|---|---|---|

Thread Prev | Thread Next | Thread Index | Date Prev | Date Next | Date Index |

*To*: P1619-2@xxxxxxxxxxxxxxxxx*Subject*: Re: [P1619-2] another P1619.2 question: the EME2 mix function*From*: Hal Finney <hal.finney@xxxxxxxxx>*Date*: Tue, 23 Mar 2010 15:56:23 -0700*Delivered-to*: mhonarc@xxxxxxxxxxxxxxxx*In-reply-to*: <3896c5d61003221617k67c4bf9bg19f6f960bcb0e63f@xxxxxxxxxxxxxx>*List-help*: <http://listserv.ieee.org/cgi-bin/wa?LIST=P1619-2>, <mailto:LISTSERV@LISTSERV.IEEE.ORG?body=INFO%20P1619-2>*List-owner*: <mailto:P1619-2-request@LISTSERV.IEEE.ORG>*List-subscribe*: <mailto:P1619-2-subscribe-request@LISTSERV.IEEE.ORG>*List-unsubscribe*: <mailto:P1619-2-unsubscribe-request@LISTSERV.IEEE.ORG>*References*: <3896c5d61003221617k67c4bf9bg19f6f960bcb0e63f@xxxxxxxxxxxxxx>*Reply-to*: Hal Finney <hal.finney@xxxxxxxxx>

On Mon, Mar 22, 2010 at 4:17 PM, Laszlo Hars <laszlo.hars@xxxxxxxxxxx> wrote: > There might be a problem with EME2. Its mixing layer does not seem to be > very secure: > > > > If the XOR of all the ciphertext blocks PPPi of top layer of encryptors > happens to be the same at two sets of input plaintext blocks, the mix value > M1 remains also the same, and so each XORed value M1*a^i in the mix layer > also remains the same. This happens at 50% chance among 2^64 encryption > operations. Thus, if we keep the P2...Pk plaintext blocks constant for some > k≤m<129, and vary the others, after 2^64 random tries we find two sets of > input at 50% chance such that the corresponding ciphertext blocks C2...Ck > are identical. It distinguishes EME2 from a random permutation. (When > varying the address of the target sector T* would change pseudo randomly. It > is just XORed to the PPPs, which does not affect the random search.) > > > > A modern disk drive contains 2TB/512 ~= 2^32 sectors, which are filled up > pretty soon. There are close to 10^9 ~= 2^30 encrypting disk drives > manufactured a year, and so some user somewhere will find this strange > situation with equal C2...Ck blocks with non-negligible probability. This last part isn't correct. With 2^32 trials (sectors) the chance of a 128-bit collision in a single disk is only about 1 in 2^65 by standard birthday arguments (n^2 / 2H where n=2^32 trials and H=2^128). Therefore close to 2^64 disks would have to be used which would take over 10 billion years at present rates. Hal Finney

**Follow-Ups**:**Re: [P1619-2] another P1619.2 question: the EME2 mix function***From:*Laszlo Hars

**References**:**[P1619-2] another P1619.2 question: the EME2 mix function***From:*Laszlo Hars

- Prev by Date:
**Re: [P1619-2] another P1619.2 question: the EME2 mix function** - Next by Date:
**Re: [P1619-2] another P1619.2 question: the EME2 mix function** - Previous by thread:
**Re: [P1619-2] another P1619.2 question: the EME2 mix function** - Next by thread:
**Re: [P1619-2] another P1619.2 question: the EME2 mix function** - Index(es):