Henrick Hellström

2,656 reputation

1412

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	12 mins ago
stats	profile views	29

	2,656 reputation	bio	website		visits	member for	1 year, 3 months
1412 badges		location			seen	12 mins ago

summary answers questions tags badges favorites bounties reputation activity

181 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 2	comment	In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize? IME step 2 is more expensive in the sense that it is less likely, given a fixed prime $r$ and a randomly selected $k$ of a fixed size, a number of the form $rk + 1$ is a prime, compared to a completely random odd integer of the same size. I only have experimental evidence to support this conjecture, though.
Mar 2	comment	What is “Blinding” used for in cryptography? I describe it informally in my answer to this question: crypto.stackexchange.com/questions/6538/…. Basically, if you are targeting e.g. a server that performs the private key operation using CPU operations, you make it (or observe it) perform other tasks at different relative timing offsets to the start of the private key operation to be attacked. For most exponentiation implementations this will reveal each bit of the private exponent with an accuracy that depends only on how accurate the timing is.
Mar 2	comment	Timing attack on modular exponentiation Then again, some of that info doesn't necessarily help in common scenarios.
Mar 2	comment	What is “Blinding” used for in cryptography? Then again, it is usually not the value $x$ to-be-raised that has to be blinded, but the private exponent $d$. Your method does not blind $d$, so if the timing attack works independently of the value-to-be-raised, it has no effect at all.
Mar 1	comment	Is it possible to create a Bilinear Function with Already Assigned “Multiplicative” Input Groups? Right, that explains your third edit, thanks.
Mar 1	comment	Is it possible to create a Bilinear Function with Already Assigned “Multiplicative” Input Groups? Given the formula in the question, I think you have to set $xy=z$, $x=a$, $y=sb$, $b=z=xy$ and consequently $s=x^{-1}$, and get $e(g^x,g^y)=e(g^z,g)$ which is equivalent to what you write in your second edit. However, doesn't this require either x or y to be invertible $\mod p-1$?
Mar 1	comment	Is it possible to create a Bilinear Function with Already Assigned “Multiplicative” Input Groups? You might have to add more information about the properties of the groups you are referring to. It is already known that the discrete logarithm problem is easier to solve in some groups, than it is other groups.
Feb 27	comment	Deriving HMAC key and cipher key from passphrase? Yes, if $HMAC_K$ is a $PRF$ in the random oracle model, it is $IND-CPA$, so it doesn't matter if the label is a known constant.
Feb 26	comment	Deriving HMAC key and cipher key from passphrase? Yes, that should work. (I am not familiar with the framework you are using in your example, but it looks right.)
Feb 26	comment	Deriving HMAC key and cipher key from passphrase? HMAC-SHA-512 is a PRF, as stated in the answer.
Feb 25	comment	Which one is fastest? Karatsuba or Montgomery multiplication? The Big-O complexity values for the algorithms are based on the number of single precision MUL operations (and DIV, but not for those) only. On modern CPUs the performance of MUL is not as relatively bad as it was 10-20 years ago. Instead, on x64 Karatsuba suffers from its higher memory usage and more CALL operations. Montgomery Multiplication OTOH might be implemented to take advantage of r8-r15.
Feb 25	comment	Which one is fastest? Karatsuba or Montgomery multiplication? The actual speed of an implementation of an algorithm depends on which language you are coding in, which compiler you are using and what the target CPU is. For instance, if we are discussing the integer sizes commonly used in cryptography and reasonably optimized assembler implementations, Karatsuba multiplication followed by Montgomery reduction is typically faster on x86 than Montgomery multiplication, while on x64 it is the other way around. Hence, this is not a crypto.stackexchange question, but rather one for stackoverflow.
Feb 24	comment	Digital signatures in SSL/TLS-like protocols Another question popped up regarding your suggestion: What do need to assume with respect to the $PRF$ function in order to prove perfect forward secrecy, considering that you mix in both the ephemeral-static key agreement $<A,y>$ and the ephemeral key agreement $<U,V>$? I am sure it is not something the function isn't generally assumed to meet, but I am interested in the technicalities.
Feb 24	comment	Digital signatures in SSL/TLS-like protocols Thanks for your detailed answer. However: "The DHE_RSA and DHE_DSS key exchange protocol needs a signature in the Server Key Exchange message, since there is no other way for the client to verify that the message (and the public DH key) actually comes from the right server." In the case of DHE_DSS, yes, because that key should only be used for digital signatures. RSA keys might however usually be used for both key transport and digital signatures (i.e. in the case of DHE_RSA, server authentication could theoretically be done using a RSA key transport in the Client Key Exchange instead).
Feb 22	comment	Digital signatures in SSL/TLS-like protocols Thanks, CurveCP seems interesting, but I am missing a more thorough analysis of that protocol. The steps in my question are based on the TLS protocol, which, I presume, is more well known and well understood.
Sep 21	comment	Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems? Actually, the original PSS proposal by Rogway and Bellare included a different hashing mechanism that calculated the digest as Hash(padding\|\|salt\|\|M). This was later changed in PKCS#1 v2.1, but that algorithm is commonly referred to as RSASSA-PSS.
May 11	comment	Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings Note: Deliberate SHA-1 collisions might theoretically be generated with a work factor of $2^{51}$ according to this paper: eprint.iacr.org/2008/469.pdf. It might be worth mentioning that it is also not self evident that the system described by the OP does not have to protect itself from deliberate collisions. For instance, the OP should perhaps consider the possibility that an installer for some software creates two file paths that hashes to the same value? Would that be an exploitable weakness?
May 4	comment	Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built? Yes, but I reckon you wanted a semi-realistic lower bound of the time required for the attack, and clearly that depends not only on the amount of RAM ever built, but also on engineering questions and a lot of other costs; not only the cost of other hardware, but how many CPU cores and DES engines you might physically wire to a single instance of memory, what it would cost to manufacture such a circuit, and the cost of energy for both running the thing and cooling it? Simply put: Is it really still the amount of memory available that puts a limit to the attack, rather than other factors?
May 3	comment	Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built? IOW: Is it cheaper to double RAM and CPUs, instead of replacing the CPU with one with the double amount of cores, or replacing the motherboard and double the number of CPUs? The number of DES engines are doubled in each case. ISTM getting a motherboard with 512 DES engines would probably be more expensive than 128 GB of RAM.
May 3	comment	Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built? That's right, but each machine might e.g. have 2TB of memory and 4 CPUs with 10 cores each (which is something you can buy from e.g. HP today), corresponding to 40 "peripheral components" with the terminology of the original paper. Each one of those machines might have one copy of the large P-table each. One server might manage the smaller and less frequently probed B-table.