Reputation
Next tag badge:
71/100 score
18/20 answers
Badges
1 11 33
Newest
 Custodian
Impact
~127k people reached

2h
comment POODLE attack on TLS 1.2
Technically, the Netscape formal specification of SSL 3.0 didn't specify how the padding should be generated. The SSL 3.0 specification is consistent with deterministic TLS 1.0 padding. A SSL 3.0 implementation that checks the padding is consequently consistent with the specification, but incompatible with a lot of implementations.
Aug
28
comment Key Size for Symmetric Homomorphic Encryption Over the Integers
You find the formula for the value of $\eta = \Theta \lambda log^2 \lambda$ later in the paper. $\lambda$ is the security parameter and $\Theta$ depends on the depth of operations to be supported.
Aug
26
comment Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?
@mikeazo You forgot about the highest order coefficient. $k(x-2)(x-1)(x+1)$ has the same roots for any value of $k$. And if you don't know $k$, you can't calculate the constant term.
Aug
26
comment Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?
Knowing all $t-1$ roots of polynomial of degree $t-1$, would still not be sufficient to deduce the constant term. The coefficient of degree $t-1$ will not show up knowing nothing but the roots, and this coefficient might have as many values as there are non-zero elements in the field.
Aug
24
reviewed Close What is the difference between a random oracle and a probabilistic algorithm?
Aug
24
reviewed Close How to build a secure cryptographic algorithm
Aug
21
comment Combine two sha512 hashes to a single hash
en.wikipedia.org/wiki/Length_extension_attack
Aug
21
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@111: You will at least have a solution $(0,0,0)$, which means you have a non-zero $k$ such that $kp=2^{p-1}-3^{p-1}$. There might not necessarily be a solution $(k,n,m)$ to $kp = 2^n-3^m$ such that $GCD(n,p-1) = 1$ and $GCD(m,p-1) = 1$, which would be necessary for $log_2(3)$ to be defined, but that's not what I stated. Please note that the goal here is to find one prime for which $log_2(3)$ is known and can be kept secret - not necessarily finding $log_2(3)$ for all primes.
Aug
21
answered Digital Signature Attack
Aug
19
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@tylo: Furthermore, I believe I am able to prove that $kp=2^n−3^m$ for bounded values of k, only has a limited number of solutions $n,m,p$ that can all be found. This means we don't have to worry too much about such possibilities regardless if we generate p ourselves or if someone else generates the prime.
Aug
19
revised Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
added 77 characters in body
Aug
18
comment Is calculating HMAC from hashed input a good idea?
Doesn't the fact that breaking HMAC generally requires a greater effort than finding a collision in the underlying hash algorithm, mean the answer is "yes"?
Aug
17
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@tylo: This questiion isn't about solving DLP in arbitrary $\mathbb{Z}_p^*$ groups, but specifically about the security of system parameters $g,h,p$ where $g=2$ and $h=3$. Should I read your comment as implying that I should clarify the reason for the question?
Aug
17
revised Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
added 7 characters in body
Aug
17
revised Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
added 1301 characters in body
Aug
16
revised Anonymous offline digital cash scheme
added 989 characters in body
Aug
15
answered Anonymous offline digital cash scheme
Aug
15
comment Anonymous offline digital cash scheme
The answer to the question, as currently worded, ought to be "no". Blind signatures are online by definition, so a digital cash system based on blind signatures can't be (completely) offline.
Aug
11
comment Factorization of the semi-palprime $N = pq$
I doubt you find many people here who are experts on optimized implementations for decimal arithmetic. Cryptographic implementations typically work in base $2^8$, $2^{32}$ or $2^{64}$ - not base $10$.
Aug
10
comment Order of MACing and Encrypting in TLS
Some servers are updated. Technically, a modern browser and a modern server might still negotiate an older version of TLS. Since there are still a lot of buggy TLS 1.0 servers out there that will choke on TLS 1.1 and later, some generic TLS clients solve that by only enabling TLS 1.0 by default, unless they know for sure the server supports later versions.