444 reputation
36
bio website
location
age
visits member for 3 years, 1 month
seen 4 hours ago

Apr
29
comment How to argue to a paranoid that RSA is safe?
Other paranoids (like banks) use it for transferring money.
Feb
28
awarded  Yearling
Oct
19
comment Bleichenbacher 1998 “Million message attack” on RSA
Yes, you have to compute the interval for each possible $r$ (by looping over $r$). The reason is that for big $s_i$ the current interval $[a, b]$ can be stretched by multiplying with $s_i$ so long that it intersects $[2B+rn, 3Brn-1]$ for several $r$. (In the line starting with $M_i \leftarrow$ you should have $s_i$ in the denominator).
Sep
16
comment Possible ECC backdoor and its impact on Internet traffic
The standard also "suggests" points $P$ and $Q$ (and implementers tend to use and did use those choices) whose origin is not explained. No need to break the elliptic curve discrete log problem, see rump2007.cr.yp.to/15-shumow.pdf
Jul
31
comment Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512
@user7827: With current error rates of quantum computers and the currently known techniques for error correction (which give a polynomial blowup) you need a quantum computer with about $10^9$ qubits to factor a 1024-bit RSA modulus. (Source: A colleague of mine visiting shortly ago the workshop "From Quantum Matter to Quantum Information").
Jul
18
comment Why does Shamir's Secret Sharing Scheme need a finite field?
For calculating the interpolation polynomial one needs its coefficients to be elements of a field. Sampling random values uniformly from an infinite field is not possible, so you have to take a finite field.
Jul
9
comment Physical analogue for MACs
@minar: An example for a secret security feature for banknotes is the so called "M feature".
Jun
27
comment P = NP and current cryptographic systems
Besides $P=NP$ there are other possibilities "bad for crypto", see "A Personal View of Average-Case Complexity" by Russell Impagliazzo (available from his webpage as postscript).
Jun
27
comment Elliptic curve parameter generation
Usually the cofactor is small, so you can find it either by trial division or by Lenstra's elliptic curve factorization algorithm (normally trial division is sufficient), and then test the quotient for primeness.
May
27
comment Size of Parameters in Polynomial Key-Splitting Algorithm
In this setting one usually works over a finite field that has to be big enough for storing $K$.
Apr
15
comment Correct way to truncate data to a range
How do you distribute fairly $a$ apples to $b$ children if $a$ is not a multiple of $b$? (In your case $a = 2^k$ and $b = 100000$)
Apr
10
comment Signature schemes for underpowered devices (8bit microcontroller)
@fgrieu: Sorry, I don't know of any public reference or standard that simply replaces modular multiplication by Montgomery multiplication.
Apr
9
comment Signature schemes for underpowered devices (8bit microcontroller)
Using Montgomery multiplication (without transformations) instead of normal multiplication simplifies the implementation. For obtaining the given running time of 1s did you use the Karatsuba algorithm?
Mar
15
answered How to perform Multiplicative Inverse Modulo in IDEA
Feb
25
comment Which one is fastest? Karatsuba or Montgomery multiplication?
To state explicit what's already implicit contained in Henrick's excellent comment: Montgomery multiplication is a trick for modular multiplication using multiplication without division and Karatsuba multiplication is a trick for multiplying in less than quadratic time (with respect to bitlength). So of course one can (and does) use Karatsuba within Montgomery multiplication. As Karatsuba multiplication comes with a small overhead, it depends on the lengths of the factors (and on the criteria Henrick mentionend) if it's worth using it.
Feb
21
comment Why do we assume un-security of communication channel on every cryptography system
Mathematics in general and cryptology in particular is about getting strong conclusions from weak assumptions. Public key cryptography for example can convert an insecure channel from A to B into a secret one assuming there was an authentic channel from B to A before.
Feb
18
comment what kind of hash function can provide a short hash and be collision resistant?
@fgrieu: mary wrote "for example when we put hash value of our software to download", which made think that this is mary's use case, and the SSH is just used as example where short signatures are OK. So probably collision resistance is an overkill here.
Feb
18
comment what kind of hash function can provide a short hash and be collision resistant?
@fgrieu: Does your proposed algorithm have any advantages against iterating $2^{32}$ rsp. $2^{40}$ times the following and then cutting to 64 rsp. 80 bit: append SHA256(m) to the message m, hash the result and append it to m, hash the result and append it to m, ...?
Feb
16
comment what kind of hash function can provide a short hash and be collision resistant?
Due to the birthday attack you won't find any short hash that is collision resistant. But probably 2nd preimage resistance is enough for you, so take a look at the article about cryptographic hash functions (especially the section called "properties").
Feb
6
comment Is such a crypto-system available?
The property you ask for would imply that your cipher is a group, which for block ciphers one tries to avoid since double/triple encryption wouldn't be stronger than a single encryption (google for "DES is not a group").