Thomas
Reputation
4,107
98/100 score
1 9 30
Impact
~86k people reached

• 39 helpful flags
• 348 votes cast

# 925 Actions

 Jun14 comment Strategy for random CTR initial counter values @RichieFrame "No message is more than $2^{32}−2$ blocks long" Jun11 comment Given $n$ bits, how many “truly random” sequences/numbers can be constructed? @paul The basic idea of these test suites is to first assume you have access to a uniform bit generator (or a suitably large sample generated by said generator), run statistical tests on it, see how much the results deviate from the expected results, and then conclude after you have reached a statistically significant outcome. They don't measure the "randomness" of the data sample, they simply give confidence towards the hypothesis that "this generator produces uniformly distributed bits". Is this what you mean? Jun1 comment How Does Progressive Hashing Work? It would be difficult to do otherwise, conceptually.. May31 comment Correct way to read a given permutation cipher? The first permutation just shifts each letter to the right cyclically. Look at the permutation: (1, 2, 3) => (3, 1, 2). So (1=V, 2=E, 3=N) is mapped to (3=N, 1=V, 2=E), that is, NVE. May31 answered RSA: Fermat's Little Theorem and the multiplicative inverse relationship between mod n and mod phi(n) May31 revised RSA: Fermat's Little Theorem and the multiplicative inverse relationship between mod n and mod phi(n) cleaned latex a bit May30 comment Security of the iterated Hill Cipher Note: the first two papers are behind a paywall. May27 comment Want to use ECC but am clueless This is off-topic as it as about security software recommendation rather than actual cryptography. But I think you should really rethink your problem - generally end users should not concern themselves with which algorithms are being used to secure their data, just that it is, so a general purpose tool will probably serve you better (and it may or may not use elliptic curve technology), otherwise you are probably only going to find hobby, proof-of-concept tools that are probably flawed and insecure... May21 awarded Enlightened May21 awarded Nice Answer May20 comment Common password derivation function for different encryption methods Don't both bcrypt and PBKDF2 let you choose an arbitrary output length? In that case what's wrong with simply choosing the key length of the block cipher to use next? May15 comment RSA private exponent primality Specifically, $d$ is going to be an integer such that $ed - 1 = k\cdot \mathrm{lcm}(p - 1, q - 1)$ for some integer $k$, that is, $d = \frac{k \cdot \mathrm{lcm}(p - 1, q - 1) + 1}{e}$, so, really, its prime factorization could be anything, except it will always be coprime to $\mathrm{lcm}(p - 1, q - 1)$, that's about all you can say. May15 comment modulo operations in crypto algorithms @user220201 This is when, e.g. using $e = 3$, we have $m < n^{1/3}$, in which case $c$ is literally $m^3$ and you can just take the cube root in the integers and decrypt the ciphertext using only public information. If $m > n^{1/3}$, then we only know that $c + kn$ is a perfect cube for some integer $k$, but this $k$ becomes very, very large on average as $m$ increases (with a very complicated distribution), making it impossible to brute force it without knowing the factors of $n$ (or so we believe). May14 comment RSA private exponent primality The public exponent doesn't have to be a prime. May12 comment Generating unsigned, bounded random value using signed bounded random values "All generated random values must have a normal distribution" is a non-issue, once you have a uniform distribution you can convert it to a normal distribution efficiently via inverse-transform sampling or specialized methods like Box-Muller. Focus on getting a uniform distribution (rejection sampling will probably be fast enough, except perhaps for pathological values of $x$). May11 comment RSA, finding p,q If you prefer, you can use the following idea: since $ed - 1$ is a multiple of both $p - 1$ and $q - 1$, if follows that $a^{\frac{ed - 1}{2^k}} \equiv \pm 1 \pmod{p, q}$ for some small $k$. Thus trying a bunch of random $a$'s, you will quickly find an $a$ which is a quadratic residue modulo $p$ but a quadratic nonresidue modulo $q$, such that $a^{\frac{ed - 1}{2^k}} - 1$ is a multiple of $p$ but not of $q$, and you are done. May11 comment RSA, finding p,q I'm not sure I follow what you mean by "2 divides p - 1 ϕ(p-1) times", but the basic idea is this: if 2 divides $p - 1$, $x$ times, and 2 divides $q - 1$, $y$ times, then 2 divides $ed - 1$ at least $\max(x, y)$ times. So if you keep dividing $ed - 1$ by 2, at some point you will end up with a number that is a multiple of $p - 1$ but not of $q - 1$ (or vice versa). Then using Fermat's little theorem can produce a factor of $n$ (there are some details but that is essentially the idea). May11 comment RSA, finding p,q Correct, now how do you use this knowledge to find the factors of $p$ and $q$ efficiently? Hint: how many times can $2$ divide $p - 1$ or $q - 1$? What about $ed - 1$? With this you should be able to find an efficient way to produce a congruence of the form $a^m \equiv 1 \pmod{p}$ and $a^m \not \equiv 1 \pmod{q}$ and thus find $p$ (can you see why?) May11 comment RSA, finding p,q If you have $e$ and $d$, and you know that $ed \equiv 1 \pmod{\varphi(n)}$ - or $\mathrm{lcm}{(p - 1, q - 1)}$ - what can you deduce? May2 revised Symmetry for finite cyclic groups (Z/pZ)∗ added 315 characters in body