Reputation
5,961
Next tag badge:
71/100 score
18/20 answers
Badges
1 11 33
Newest
 Custodian
Impact
~127k people reached

1d
comment Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?
@mikeazo You forgot about the highest order coefficient. $k(x-2)(x-1)(x+1)$ has the same roots for any value of $k$. And if you don't know $k$, you can't calculate the constant term.
1d
comment Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?
Knowing all $t-1$ roots of polynomial of degree $t-1$, would still not be sufficient to deduce the constant term. The coefficient of degree $t-1$ will not show up knowing nothing but the roots, and this coefficient might have as many values as there are non-zero elements in the field.
Aug
21
comment Combine two sha512 hashes to a single hash
en.wikipedia.org/wiki/Length_extension_attack
Aug
21
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@111: You will at least have a solution $(0,0,0)$, which means you have a non-zero $k$ such that $kp=2^{p-1}-3^{p-1}$. There might not necessarily be a solution $(k,n,m)$ to $kp = 2^n-3^m$ such that $GCD(n,p-1) = 1$ and $GCD(m,p-1) = 1$, which would be necessary for $log_2(3)$ to be defined, but that's not what I stated. Please note that the goal here is to find one prime for which $log_2(3)$ is known and can be kept secret - not necessarily finding $log_2(3)$ for all primes.
Aug
19
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@tylo: Furthermore, I believe I am able to prove that $kp=2^n−3^m$ for bounded values of k, only has a limited number of solutions $n,m,p$ that can all be found. This means we don't have to worry too much about such possibilities regardless if we generate p ourselves or if someone else generates the prime.
Aug
18
comment Is calculating HMAC from hashed input a good idea?
Doesn't the fact that breaking HMAC generally requires a greater effort than finding a collision in the underlying hash algorithm, mean the answer is "yes"?
Aug
17
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@tylo: This questiion isn't about solving DLP in arbitrary $\mathbb{Z}_p^*$ groups, but specifically about the security of system parameters $g,h,p$ where $g=2$ and $h=3$. Should I read your comment as implying that I should clarify the reason for the question?
Aug
15
comment Anonymous offline digital cash scheme
The answer to the question, as currently worded, ought to be "no". Blind signatures are online by definition, so a digital cash system based on blind signatures can't be (completely) offline.
Aug
11
comment Factorization of the semi-palprime $N = pq$
I doubt you find many people here who are experts on optimized implementations for decimal arithmetic. Cryptographic implementations typically work in base $2^8$, $2^{32}$ or $2^{64}$ - not base $10$.
Aug
10
comment Order of MACing and Encrypting in TLS
Some servers are updated. Technically, a modern browser and a modern server might still negotiate an older version of TLS. Since there are still a lot of buggy TLS 1.0 servers out there that will choke on TLS 1.1 and later, some generic TLS clients solve that by only enabling TLS 1.0 by default, unless they know for sure the server supports later versions.
Aug
10
comment Order of MACing and Encrypting in TLS
RFC 7366 is widely implemented, e.g. by Chrome, Mozilla, OpenSSL etc.
Jul
10
comment Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$
@Pierre: (Generalized) Tonelli-Shanks is an algorithm for finding (arbitrary) roots in cyclic groups. It's not the same thing, far from it, but if you see a connection, please feel free to demonstrate it.
Jul
3
comment Working on subgroup of $\mathbb{Z}^*_p$ in practice
It is important to know in exactly what sense you "need to work on some elements not in the subgroup". Your question does not include any reference to any cryptographic scheme or algorithm.
Jul
3
comment Working on subgroup of $\mathbb{Z}^*_p$ in practice
It is unclear what you are asking. Are you asking what role large multiplicative subgroups play in cryptography, or do you simply want to know more about the algebraic properties of the fields and groups involved?
Jul
3
comment Easy explanation of “IND-” security notions?
No, I don't think it is a duplicate. You will not necessarily understand the precise meaning of IND-CPA just because you know what is meant by a Chosen Plaintext Attack, etc
Jul
1
comment Deriving HMAC key and cipher key from passphrase?
@mistika: It depends on which algorithms you use for the generic EtA composite scheme. In some cases your scheme will break down completely if you use the same key for both (e.g. if you combine AES-CBC for confidentiality with AES-CBC-MAC for authentication). In other cases the algorithms are likely different enough for there not to be any practical attacks, should you use the same key for both components. However, you can't prove that the generic composition by itself is as secure as the least secure component, unless your premise is that the components use independent keys.
May
9
comment Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509
RSASSA-PSS is a completely different beast altogether. A correct representation would require not only Signature Algorithm and Signature Hash Algorithm, but also identifiers for MGF Algorithm and P Source. This is however beside the point.
Mar
9
comment Will SHA1 or Other Hash Functions Ever Contain Quotes
I'm voting to close this question as off-topic because this is an apples and oranges kind of question. SHA-1 will output a string of 160 bits. A quote character is a character and not a bit. Your question will only make sense, if there is an implied conversion algorithm from the bit string output of SHA-1, to the character string you store in your database. This conversion algorithm might be chosen independently of the hash algorithm. Hence, your question is off-topic.
Feb
17
comment How many attempts does it take to crack a 32-bit password hash with this scenario?
Could you explain, in pseudo-code, exactly what you mean by "attempts" in the context of "matching a 32-bit hash from 4 million hashes". Finding a value that is known to exist in a list of 4 million values, depends on whether the list is already sorted or not, and does not depend of what kind of values are in the list or how they were generated.
Feb
16
comment ECC considered secure in OpenSSL?
The term "safe curve" seems to be used by Bernstein for curves that meet certain criteria, selected to make it easy to ensure that simple implementations are secure implementations. This doesn't imply that "non-simple" implementations using other curves are not secure. Hence, the information provided on the page is insufficient to infer anything about the security of OpenSSL, although it does raise some flags.