Reputation
14,475
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~289k people reached

Nov
18
comment Efficient parameters for group Diffie-Hellman
@poncho Could you describe how to use that oracle to break CDH?
Nov
18
answered Efficient parameters for group Diffie-Hellman
Nov
18
comment Efficient parameters for group Diffie-Hellman
@daniel How would you do that? multiplying public keys translates to addition in the exponent.
Nov
18
comment Efficient parameters for group Diffie-Hellman
@RickyDemer It's large enough to make group DH annoying since you need one round of communication for every member in the group.
Nov
18
comment Efficient parameters for group Diffie-Hellman
You'd need to compute $K^{(a^{-1})}$. Only those who hold the private key $a$ can do this. Multiplying with $(g^a)^{-1} = g^{-a}$ would subtract $a$ from the exponent, not divide the exponent by $a$.
Nov
14
comment Elliptic Curve Encryption Ciphertext Size
Depends on the details of the ECIES implementation. The overhead is one ECC point. For example with an 256 bit curve (offering 128 bits of security) and compressed points the overhead would be 32 bytes. With uncompressed points you need 64 bytes. Often you'll lose a bit more for headers. The symmetric encryption might cost a bit as well for padding or MACs.
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
I don't understand the details of your suggestion, but it seems very unlikely that you can obtain a function that's both hard to invert and bijective like that.
Nov
14
comment Any real world implementation using message recovery?
@DrLecter Even when using a hash as part of the signature one could put the (beginning of the) message into the remaining space.
Nov
14
comment Could MITM securely identify identity?
You could simply run a key-exchange between alice's long term key and the FW's key and use it to authenticate the ciphertext with a MAC based on the shared key. No need for MitM, decryption, etc. Essentially as a wrapper around these protocols.
Nov
14
reviewed Approve Why have 4th and 5th steps in Needham-Schroeder Protocol?
Nov
14
reviewed Approve MD Construction Doesn't Propagate TCR
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
At a glance they seem trivial to invert. Just start with $x_0$ and compute the input bit. Then proceed to the next bit, where you can evaluate $f$ since you already computed all input bits with lower index. Use as S-Box and being non-linear in no way implies being hard to invert.
Nov
14
comment Blinding twice in RSA
@SJR But why do you need blinding with two different $n$s? And why do you need id strings in the token in the first place?
Nov
14
reviewed Approve Proof of the standard pseudorandom generator + XOR encryption scheme in Goldreich
Nov
13
comment Has threefish successfully been attacked (practically or theoretically)?
Only reduced round versions. See SHA-3 Zoo - Skein for an overview.
Nov
13
comment Why routers don't just use Diffie-Hellman protocol?
Only way to fix MitM is to know the public key of your communication partner. Encryption to the router is pretty useless as well, since there is no reason to believe that the router is trustworthy. We need end-to-end encryption. No way around that.
Nov
13
reviewed Approve SHA-1 Keyed Hash Function
Nov
13
reviewed Approve Is there a proof for showing any cryptogram is crackable?
Nov
13
reviewed Approve modfied man in the middle attack diffie hellman
Nov
13
comment Is there a proof for showing any cryptogram is crackable?
With the one-time-pad there is no difference between "apply all possible possible keys to the ciphertext" and "guess all possible messages without looking at the ciphertext". There are just as many keys as there are possible messages.