Hot answers tagged

24

Is this number specified anywhere? It was formally specified in this RFC as the 1536 bit MODP group (although its use predates that RFC). However, from what I've seen, the 2048 bit MODP group from that same document is actually more popular. Why was this particular number picked? Well, it's a safe prime; in addition, the leading 64 bits and the ...


12

The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg: $\log_2{0.886\sqrt{2^{571}}} = 285.32537860389294$ The real computation (at least for curves over a finite field defined by a prime $p$) is $ \log_2{\sqrt{\pi/4}\sqrt{ℓ}} $, where $ℓ$ is the ...


6

The previous answer has the correct formula for estimating the security level of prime field elliptic curves. However, the table seems to just list the closest Koblitz curve sizes used, as Richie Frame points out. If you computed the actual security strength of the curves in question, you would not end up with exactly the values in the left column. For ...


4

The answer is simple. AES is in itself a pseudorandom function, so an output from a single block encryption will produce 128-bits of pseudorandom numbers. Now to use AES to generate longer sequences, you will have to use a block-cipher mode that lets you do the same. Here is a small list of a few very popular modes ment for PRNGs: Counter(CTR): Counter ...


4

The NIST source you link to is SP 800-90B. If you look at the other two publications in the series: 90A and 90C, you can find explanations of how you can use a TRNG to instantiate a DRBG or requirements on how to condition the entropy. Here is what section 7.1 of 90A says about entropy input to a DRBG: Ideally, the entropy input will have full entropy; ...


4

Yes, RSA encryption without padding as used by RSASVE in NIST SP800-56B is secure. The RSASVE Generate Operation in NIST SP800-56B §7.2.1.2 is given on input an RSA public key $(n,e)$; generates a random secret bitstring $Z$ uniformly distributed on range $[2,n-2]$; computes $C=Z^e\bmod n$ (as in textbook RSA encryption); outputs the secret $Z$ and the ...


3

From what I understood, data units are sectors, so a sector can have at most $2^{128}-2$ blocks but you can only encrypt $2^{20}$ blocks which cannot be correct (it seems too little compared to a disk's capacity). The data unit is the sector, yes, but both of those quotes only talk about the length of a single data unit. The larger number in the latter ...


2

http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf "... specifies the procedures involved in validating implementations of the Advanced Encryption Standard (AES) algorithm in FIPS 197 : Advanced Encryption Standard. The AESAVS is designed to perform automated testing on Implementations Under Test (IUTs). This publication provides the basic design ...


2

I'm not sure I got your question right, but it seems to me you are asking about modular reductions modulo $p=2^{192}-2^{64}-1$. If so, this answer from poncho, that I should have searched before writing this answer, might interests you. Note that in the following the choice of the base doesn't matter. If we have to reduce $2^{192} \mod{p}$ you can just ...


2

My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)? When AES was standardized, the best known attack (pdf, page 19) in terms of rounds broken was a related key attack that broke 9/14 rounds of AES-256. The best attack on AES-128 broke 7/10 rounds. Currently, the ...


2

To my knowledge, NIST has not really decided or announced anything about successors to ECC. However, they do run workshops and such on post-quantum cryptography, so when the time is right something will probably move towards standardization. NSA, on the other hand, recently announced that they will soon push for a post-quantum system, going so far as to say ...


2

What is its signature length ? Depends on what algorithms you use, but with ECDSA the signature length is twice the length of the order of the base point. For P-521 that's 1042 bits, or 132 bytes when using whole bytes for each part. For E-521 it's 1038 bits or 130 bytes. How is it better ? The design criteria for E-521 are stated in A note on high-...


1

This particular prime has been widely used in implementations of the Internet Key Exchange Protocol (IKE) and commonly referred to as Group 5. Group 5 has been in many devices for over a decade. Depending on your viewpoint this fact is either good or bad. It's good if you are implementing IKE and want to interoperate with other implementations of IKE. It ...


1

3d multiplication is a simple multiplication not a mod multiplication. I suggest you to check IEEE Std 1363-2000 document and "A.10.3 Elliptic scalar multiplication" part of that document if you can. It has somewhat more explanation than Nist's document.


1

Except if you are picky with updates of references, there is such standard. DSA, RSA, ECDSA-$F_p$, ECDSA-$F_{2^n}$, are approved by ETSI TS 102 176-1 V2.1.1 (2011-07) (Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms), which essentially ...



Only top voted, non community-wiki answers of a minimum length are eligible