Reputation
4,303
Next tag badge:
101/100 score
17/20 answers
Badges
1 10 32
Newest
 Enlightened
Impact
~103k people reached

Mar
7
comment Strength of Combining Hash functions
@user5195 Define "break the hash". Do you mean successfully find a collision, find a pre-image, ..?
Mar
5
comment What should I be aware of when implementing algorithms myself?
I suppose it would be, once you or someone else has gone over it and checked there is no suspicious code in it. But any realistic application is going to need at least performance, security, or certification, so there is no incentive to use an alternative library over, say, OpenSSL, or BouncyCastle, except in the most trivial of uses. There are a lot of subtle threats lurking around even this contrived scenario which I can't enumerate (correctly handling padding, etc..) and while it would be a good coding exercise - I did it myself a few months ago - I would not expect widespread use.
Mar
5
comment What should I be aware of when implementing algorithms myself?
just don't. I mean, yes, if everything passes the test vectors, there is a good chance the implementations are, functionally, correct. But you are ignoring side channel attacks, backdoors, performance, portability, ease of use, patents on algorithms, etc.. which require careful review by experienced people. So it would be at best unsafe to let other people use a hobby cryptography library.
Mar
5
comment Security relevance of random factor in Paillier
Revealing $r_1 \cdot r_2 ~ \text{mod} ~ n^2$ will not reveal $r_1$ and $r_2$, since there are exponentially many pairs of solutions, and only one will allow the recovery of $m_1$ and $m_2$ given the two ciphertexts.
Mar
2
comment Security of Pohlig-Hellman exponentation cipher?
Looking at the requirements for the hardness of the discrete logarithm problem (DLP) would be a good start. Indeed, $p$ needs to be chosen with care, a large random prime simply won't do. Size is only half of the story. As in $\log{(p)}$, I mean.
Mar
2
comment How to solve the reverse of an equation that uses MOD?
@hsikcah en.wikipedia.org/wiki/Modular_exponentiation
Mar
2
reviewed Approve How is CipherCloud doing homomorphic encryption?
Mar
1
comment Is SHA-512 bijective when hashing a single 512-bit block?
@StephenTouset And even then, SHA-512 is more expensive to compute than iterating a counter, so you can add a few more bits of required computational work to that.
Feb
28
comment Is SHA-1 collision free on data up to 20 bytes long?
@SmitJohnth That is because there is no mathematical proof. Modern hash functions have structures that aren't very exploitable mathematically, by design. The best we can do is either brute-force it and try to find a collision, but this is expensive (it's supposed to be infeasible, actually) or assume that SHA-1 is a perfect random function and use that to calculate the likelihood of bijection, and the duplicate's answers address both these approaches. There simply is no other known way on a non-broken hash function.
Feb
28
comment Question about why RSA is hard to attack
Note the two approaches are fundamentally different, the first one recovers the plaintext (and says nothing about $d$) and the second one recovers $d$.
Feb
27
reviewed Approve Why are RSA keys encoded with ASN.1 for TLS?
Feb
27
comment Generate an insecure public / private key pair
If you mean RSA keys, you can easily factor a 56-bit modulus with trial division. Last I checked, RSA-100 (330 bits) took a night to factor on my computer. But I don't think PGP will accept such short key lengths, everyone will probably reject your certificate. But theoretically, yes, you could. 56 bits may be a bit on the low side, though, since PGP uses padding which mandates a minimum modulus size (140 bits or something).
Feb
26
comment Padding always the same, problem or not?
@CodesInChaos In light of the Romain's previous comment, I would expect the smartcard interface to also enforce PKCS7, which does require padding even if the message is a multiple of 16 bytes.
Feb
26
comment Padding always the same, problem or not?
Off-topic, but since you are on a limited capacity link, and your message has length multiple of 64 bits (where padding is at its most wasteful) doesn't it make more sense to use something like CFB or CTR?
Feb
25
comment Nonce role on stream ciphers
@Ivella In that case the offset in the keystream for each new message is equivalent to an IV (a variant of counter mode, but for stream ciphers). And as Paŭlo says, this has a few drawbacks.
Feb
25
comment Chosen Plaintext Attacks against an Affine Cipher
What happens if the attacker asks the oracle to encrypt $x = 0$?
Feb
25
comment How to represent point-at-infinity in affine coordinate
Does crypto.stackexchange.com/questions/6156/… help, by any chance?
Feb
25
answered Nonce role on stream ciphers
Feb
24
comment Fastest multiplication algorithm for efficient exponentiation in C++?
Fürer's algorithm is asymptotically the fastest multiplication algorithm known, but only for numbers with several million digits, so it's definitely not meant for cryptography (or anything else, really). If you're just doing RSA, Karatsuba will work fine.
Feb
24
comment Is the following key stretching algorithm as memory hard as I think it is?
I recommend you take a look at the code of scrypt to see what is going on at a high level (there are python implementations).