Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hm... wouldn't the dead simple pattern of "RRRRREEEEETTTTTRRRRREEEEEAAAAATTTTT" in the message defeat the attempt to sow confusion?

To be clear-- the parties agree ahead of time that each message will consist of repeating each desired letter in the message N times (before encrypting). If there's a letter that doesn't repeat N times in the received message then the message isn't authentic.

Surely a cryptographer could figure out the math to make N large enough that the probability of defeating the authentication is practically equivalent to guessing the message itself.



This doesn't work if the attacker knows the repeating pattern is going to be used, and if they know it's going to be either "ADVANCE" or "RETREAT" then it seems likely they will also know about the repeating pattern.

They can still invert the meaning by XORing the cyphertext with XOR("RRRRREEEEETTTTTRRRRREEEEEAAAAATTTTT","AAAAADDDDDVVVVVAAAAANNNNNCCCCCEEEEE").


Thanks, I just realized that in my comment below. See additional question there...


Hm... I guess if the attacker knows N=5 they could just send truncated text.

Is there really no dead simple authentication scheme that is as easy to understand as OTP, which can be used with OTP?

Edit: clarification


Would you be a bit better off if N is to be inferred from the decrypted text, and Alice rolls a die to pick it?


I'm just surprised that there isn't some bog standard authentication puzzle piece that goes with learning OTPs.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: