Reputation
11,691
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~189k people reached

1d
comment How to calculate RSA CRT parameters from public key and private exponent
The $\lambda$ in that calculation, isn't necessarily the usual $\lambda(n)$, right? Only a multiple of it.
2d
comment Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops?
1) The exponential function works pretty well. 128 bits should hold for several more decades and the idea of brute-forcing 256 bits on a conventional computer, ever, is ridiculous. Even the effect of quantum computers isn't that big, they just require you to double the key size. We're at the point where brute-force can easily be defeated and we only need be afraid of cryptanalytic advances (or new physics beyond QM). 2) Of course you still need true random numbers to generate the seed. Having a hardware generator is certainly convenient for that. But that's the only thing I'd use it for.
2d
comment Using ECB as encryption mode, but encrypted messages are unique
Don't use PKCS#1v1.5 padding, use OAEP.
2d
comment Why don't we have hardware generate NON-pseudo, but REAL random numbers from meta-stable flip-flops?
1) Current Intel CPUs have a RDRAND instruction and Broadwell adds an RDSEED instruction. 2) Brute force is powerless against the might of the exponential function. If you want to break crypto, you need better cryptoanalysis, not just a faster computer.
May
24
comment Are pseudorandom permutation really permutation in mathematical sense?
It's a permutation, but of the $2^{64}$ possible 64 bit blocks, not of the 64 bits within a single block. If a blockcipher were no permutation, you couldn't decrypt a block.
May
24
revised Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
added 768 characters in body
May
24
revised Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
added 768 characters in body
May
24
answered Why does TLS do Authenticate-then-Encrypt instead of Encrypt-then-Authenticate?
May
23
comment Curve41417 example
Your example is mod $10^8$. So how is it supposed to relate to Curve41417?
May
23
comment Huffman encoding of hashes
If order doesn't matter, you can sort them and then compress the first few bytes, which rarely change between hashes.
May
21
comment one-way deterministic hash for low entropy input?
Your construction offers no advantage over computing HMAC(key, id) on a trusted device, relying on its rate limiting features and on key being unextractable.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
I wouldn't say that the original version was incorrect, it just didn't mention an important limitation.
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 1120 characters in body
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 29 characters in body
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
If you like that nitpicky stuff, you might enjoy reading about the "foundations of hashing" problem and why random oracles can't be fully realized using random oracles. Rogaway - Formalizing Human Ignorance, Canetti, Goldreich, Halevi - Random Oracle Methodology, Revisited, Bernstein, Lange - Non-uniform cracks in the concrete, etc.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
@Anon2000 Cryptographers almost always deal with indistinguishability, so the distinction between "real" and "indistinguishable from real" is only made in formal contexts, such as security proofs. For example we don't assume that AES is a PRP, we merely assume it's indistinguishable from one. Cryptography is all about reducing the probability of undesirable outcomes so much that they don't matter in practice.
May
19
comment How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
@Anon2000 The size of the values is irrelevant, as you already noted, you could concatenate 2 64 bit values to obtain a full block. What matters how much data you output. The security claim for CTR mode is something like "The output is indistinguishable from random data as long as you observe significantly less than $2^{n/2}$ blocks and you don't have enough computational power to bruteforce the key". If you really care, you can quantify that as the probability of distinguishing the random data from the output given the total size of the outputs and the available computational power.
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 88 characters in body
May
19
revised How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?
added 169 characters in body
May
19
answered How can a block cipher in counter mode be a reasonable PRNG when it's a PRP?