jug

355 reputation

bio	website
	location
	age
visits	member for	1 year, 10 months
	seen	6 hours ago
stats	profile views	12

	355 reputation	bio	website		visits	member for	1 year, 10 months
26 badges		location			seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

83 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 15	comment	Correct way to truncate data to a range How do you distribute fairly $a$ apples to $b$ children if $a$ is not a multiple of $b$? (In your case $a = 2^k$ and $b = 100000$)
Apr 10	comment	Signature schemes for underpowered devices (8bit microcontroller) @fgrieu: Sorry, I don't know of any public reference or standard that simply replaces modular multiplication by Montgomery multiplication.
Apr 9	comment	Signature schemes for underpowered devices (8bit microcontroller) Using Montgomery multiplication (without transformations) instead of normal multiplication simplifies the implementation. For obtaining the given running time of 1s did you use the Karatsuba algorithm?
Mar 15	answered	How to perform Multiplicative Inverse Modulo in IDEA
Feb 25	comment	Which one is fastest? Karatsuba or Montgomery multiplication? To state explicit what's already implicit contained in Henrick's excellent comment: Montgomery multiplication is a trick for modular multiplication using multiplication without division and Karatsuba multiplication is a trick for multiplying in less than quadratic time (with respect to bitlength). So of course one can (and does) use Karatsuba within Montgomery multiplication. As Karatsuba multiplication comes with a small overhead, it depends on the lengths of the factors (and on the criteria Henrick mentionend) if it's worth using it.
Feb 21	comment	Why do we assume un-security of communication channel on every cryptography system Mathematics in general and cryptology in particular is about getting strong conclusions from weak assumptions. Public key cryptography for example can convert an insecure channel from A to B into a secret one assuming there was an authentic channel from B to A before.
Feb 18	comment	what kind of hash function can provide a short hash and be collision resistant? @fgrieu: mary wrote "for example when we put hash value of our software to download", which made think that this is mary's use case, and the SSH is just used as example where short signatures are OK. So probably collision resistance is an overkill here.
Feb 18	comment	what kind of hash function can provide a short hash and be collision resistant? @fgrieu: Does your proposed algorithm have any advantages against iterating $2^{32}$ rsp. $2^{40}$ times the following and then cutting to 64 rsp. 80 bit: append SHA256(m) to the message m, hash the result and append it to m, hash the result and append it to m, ...?
Feb 16	comment	what kind of hash function can provide a short hash and be collision resistant? Due to the birthday attack you won't find any short hash that is collision resistant. But probably 2nd preimage resistance is enough for you, so take a look at the article about cryptographic hash functions (especially the section called "properties").
Feb 6	comment	Is such a crypto-system available? The property you ask for would imply that your cipher is a group, which for block ciphers one tries to avoid since double/triple encryption wouldn't be stronger than a single encryption (google for "DES is not a group").
Dec 10	comment	Attacks on the RSA Cryptosystem Take a look at the homepage of Alexander May, he published a lot about this topic.
Nov 29	comment	Constructing RSA private key, given public key @fgrieu: Do you happen to know if in this case (assuming $N$ is product of two 128-bit primes) the elliptic curve method is more efficient than the number field sieve?
Nov 23	comment	Efficient set up for a Montgomery multiplication @fgrieu: With "costly" I didn't mean time. Instead I meant space on the chip for the HW trying to guess the quotient. I agree with you that in theory Montgomery isn't a big win, but in practice one needs to know well how to divide efficiently (e.g., the long division algorithm in Knuth's Art of Computer Programming is not optimal: neither back addition nor the use of a simple division in necessary), and using faster multiplications like Karatsuba's in long division is not as easy as it is in Montgomery multiplication.
Nov 14	comment	Building a SHA-256 processor using only logic gates Did you try to google SHA2 and hardware and maybe gates? With gates the top link could help you to get an idea.
Nov 14	answered	Efficient set up for a Montgomery multiplication
Nov 14	comment	Efficient set up for a Montgomery multiplication @mikeazo: The idea of using Montgomery multiplication is also to avoid implementing long division (quite costly in HW, and not as easy as one might think in SW).
Nov 5	comment	RSA and prime difference @poncho: You should maybe be a little bit more precise in your last sentence (SquareRootOfTwentyThree took it literal instead of "it means (something) closer to"), as this condition is surely not sufficient: just let $p$ and $q$ of the same bitlength have the highest 200 bits $110\dots 0$ rsp. $101\dots 1$.
Nov 5	comment	RSA and prime difference @D.W.: It might be extremely unlikely that the difference is too small, so you are right about saying that it is not relevant for security in practice. However, if you want to have your key generation evaluated for a certification, it does become relevant.
Nov 2	revised	Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)? added caveat for suggested algorithm and new idea for small f
Nov 2	comment	Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)? @fgrieu: I spoke with one of the authors of the paper of Crypto 2010 and asked him about the persistent usage of $\varphi$ instead of $\lambda$ in most papers about factoring given some information. He answered that the difference is just a technicality, and all results apply easily also to $\lambda$. From the implementation side, I doubt that many RSA key generations bother with calculating the gcd and use $\phi$ [in presence of side-channel attacks calculating the gcd is not very attractive].