454 reputation
37
bio website
location
age
visits member for 3 years, 5 months
seen Dec 12 at 16:12

Dec
11
comment Are modified implementations of cryptographic algorithms a good idea?
@RichieFrame: Thanks a lot!
Dec
3
comment Are modified implementations of cryptographic algorithms a good idea?
@RichieFrame: Thanks, I didn't remember what it was exactly. Do you happen to have a link or reference?
Nov
25
comment Cracking RSA with Small exponent 5
You could take a look at these two questions about exponent 3 and RSA without padding and you should better stop your trial division project (waste of energy, sorry). Implement instead Pollard's rho or take a look here.
Nov
13
revised How does asymmetric encryption work?
added an important (missing) property of PKC pointed out by mikeazo
Nov
13
revised How does asymmetric encryption work?
removed edit by mikeazo that claimed exactly the common WRONG belief
Nov
12
comment Are modified implementations of cryptographic algorithms a good idea?
@CodesInChaos: Thanks, I adapted my answer accordingly. Unfortunately I misread the paragraph I intended to link to, and I cannot find currently the article about the modification of the DES.
Nov
12
revised Are modified implementations of cryptographic algorithms a good idea?
removed incorrect link; improved history of backdoor
Nov
11
comment How big an RSA key is considered secure today?
Do you consider Dan Bernstein's and Tanja Lange's article about Batch NSF worth including in your answer?
Nov
11
answered Are modified implementations of cryptographic algorithms a good idea?
Nov
11
awarded  Citizen Patrol
Sep
17
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
The difficulty to implement RSA in a side-channel resistant way does not depend on the key size.
Apr
29
comment How to argue to a paranoid that RSA is safe?
Other paranoids (like banks) use it for transferring money.
Feb
28
awarded  Yearling
Oct
19
comment Bleichenbacher 1998 “Million message attack” on RSA
Yes, you have to compute the interval for each possible $r$ (by looping over $r$). The reason is that for big $s_i$ the current interval $[a, b]$ can be stretched by multiplying with $s_i$ so long that it intersects $[2B+rn, 3Brn-1]$ for several $r$. (In the line starting with $M_i \leftarrow$ you should have $s_i$ in the denominator).
Sep
16
comment Possible ECC backdoor and its impact on Internet traffic
The standard also "suggests" points $P$ and $Q$ (and implementers tend to use and did use those choices) whose origin is not explained. No need to break the elliptic curve discrete log problem, see rump2007.cr.yp.to/15-shumow.pdf
Jul
31
comment Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512
@user7827: With current error rates of quantum computers and the currently known techniques for error correction (which give a polynomial blowup) you need a quantum computer with about $10^9$ qubits to factor a 1024-bit RSA modulus. (Source: A colleague of mine visiting shortly ago the workshop "From Quantum Matter to Quantum Information").
Jul
18
comment Why does Shamir's Secret Sharing Scheme need a finite field?
For calculating the interpolation polynomial one needs its coefficients to be elements of a field. Sampling random values uniformly from an infinite field is not possible, so you have to take a finite field.
Jul
9
comment Physical analogue for MACs
@minar: An example for a secret security feature for banknotes is the so called "M feature".
Jun
27
comment P = NP and current cryptographic systems
Besides $P=NP$ there are other possibilities "bad for crypto", see "A Personal View of Average-Case Complexity" by Russell Impagliazzo (available from his webpage as postscript).
Jun
27
comment Elliptic curve parameter generation
Usually the cofactor is small, so you can find it either by trial division or by Lenstra's elliptic curve factorization algorithm (normally trial division is sufficient), and then test the quotient for primeness.