Reputation
Next tag badge:
101/100 score
17/20 answers
Badges
1 10 32
Newest
 Enlightened
Impact
~99k people reached

Mar
2
comment Security of Pohlig-Hellman exponentation cipher?
Looking at the requirements for the hardness of the discrete logarithm problem (DLP) would be a good start. Indeed, $p$ needs to be chosen with care, a large random prime simply won't do. Size is only half of the story. As in $\log{(p)}$, I mean.
Mar
2
comment How to solve the reverse of an equation that uses MOD?
@hsikcah en.wikipedia.org/wiki/Modular_exponentiation
Mar
2
reviewed Approve How is CipherCloud doing homomorphic encryption?
Mar
1
comment Is SHA-512 bijective when hashing a single 512-bit block?
@StephenTouset And even then, SHA-512 is more expensive to compute than iterating a counter, so you can add a few more bits of required computational work to that.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@SmitJohnth That is because there is no mathematical proof. Modern hash functions have structures that aren't very exploitable mathematically, by design. The best we can do is either brute-force it and try to find a collision, but this is expensive (it's supposed to be infeasible, actually) or assume that SHA-1 is a perfect random function and use that to calculate the likelihood of bijection, and the duplicate's answers address both these approaches. There simply is no other known way on a non-broken hash function.
Feb
28
comment Question about why RSA is hard to attack
Note the two approaches are fundamentally different, the first one recovers the plaintext (and says nothing about $d$) and the second one recovers $d$.
Feb
27
reviewed Approve Why are RSA keys encoded with ASN.1 for TLS?
Feb
27
comment Generate an insecure public / private key pair
If you mean RSA keys, you can easily factor a 56-bit modulus with trial division. Last I checked, RSA-100 (330 bits) took a night to factor on my computer. But I don't think PGP will accept such short key lengths, everyone will probably reject your certificate. But theoretically, yes, you could. 56 bits may be a bit on the low side, though, since PGP uses padding which mandates a minimum modulus size (140 bits or something).
Feb
26
comment Padding always the same, problem or not?
@CodesInChaos In light of the Romain's previous comment, I would expect the smartcard interface to also enforce PKCS7, which does require padding even if the message is a multiple of 16 bytes.
Feb
26
comment Padding always the same, problem or not?
Off-topic, but since you are on a limited capacity link, and your message has length multiple of 64 bits (where padding is at its most wasteful) doesn't it make more sense to use something like CFB or CTR?
Feb
25
comment Nonce role on stream ciphers
@Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks.
Feb
25
comment Chosen Plaintext Attacks against an Affine Cipher
What happens if the attacker asks the oracle to encrypt $x = 0$?
Feb
25
comment How to represent point-at-infinity in affine coordinate
Does crypto.stackexchange.com/questions/6156/… help, by any chance?
Feb
25
answered Nonce role on stream ciphers
Feb
24
comment Fastest multiplication algorithm for efficient exponentiation in C++?
Fürer's algorithm is asymptotically the fastest multiplication algorithm known, but only for numbers with several million digits, so it's definitely not meant for cryptography (or anything else, really). If you're just doing RSA, Karatsuba will work fine.
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
I recommend you take a look at the code of scrypt to see what is going on at a high level (there are python implementations).
Feb
24
comment Bad/Crackable Encryption Example?
The first example that comes to mind is deterministic encryption (no IV) on a small piece of data. Looks impenetrable to the novice, but you can do lots of stuff with that (replay attacks, statistical attacks, etc..)
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
I don't think it's possible to have a purely memory-hard problem, it's always possible to not use memory and recalculate everything all the time, but you have to make sure this is actually expensive.
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
@mingleplough You don't need an excessively large number of iterations to make it memory-hard (otherwise it would be too slow in practice, 200k iterations is already pushing it). And initializing the array does help - in the example you gave, the attacker can clearly choose to not spend much memory and only save some of the cells in the array, but he'll have to spend much more time repeatedly computing the missing cells that way, which balances out. And just iterating a hash wasn't my idea of initialization, think something where a cell depends on all previous cells.
Feb
23
answered Is the following key stretching algorithm as memory hard as I think it is?