10,064 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 5 hours ago

Feb
28
revised Mapping between subgroups and the integers
edited tags
Feb
28
revised ElGamal message signatures retrieving the secret value x
edited tags
Feb
28
revised How can one show that an ElGamal-like signature verification scheme is valid?
edited tags
Feb
28
revised What does SSL use? RSA? El-Gamal? Elliptic curves?
deleted 11 characters in body; edited tags
Feb
28
revised ElGamal Signature Scheme: Recovering the key when reusing randomness
edited tags
Feb
28
revised Safe generator for ElGamal signature
edited tags
Feb
28
revised Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
edited tags
Feb
28
revised Efficient algorithm for remainder calculation over prime field for ECC implementation?
edited tags
Feb
28
revised ElGamal: Generation of “g” value?
edited tags
Feb
28
revised How to protect from Silver–Pohlig–Hellman algorithm
edited tags
Feb
28
revised DSA vs. ElGamal vs. Schnorr
edited tags
Feb
28
comment Frequency of letters change by the length of the texts?
There are two different effects: 1) For short texts the frequency won't be statistically significant unless you average over many independent samples 2) Different kinds of text use different words. For example the word frequencies you'd get from emails would be very different from those on wikipedia. It's very well possible that this shifts the frequency of letters somewhat.
Feb
28
comment Rfc2898DeriveBytes - password length
For those not familiar with .NET: Rfc2898DeriveBytes implements PBKDF2-HMAC-SHA-1.
Feb
28
revised Rfc2898DeriveBytes - password length
added 42 characters in body
Feb
28
comment Attacking both authenticity and secrecy in authenticated encryption modes
On x86/AMD64 CPUs "hardware support" means that the AES-NI instruction set is supported, which contains special instructions for AES and GCM (the latter can be used for binary field operation in general).
Feb
28
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus The expression $R < l - 1$ makes no sense. You can't compare group elements and scalars. Where in the paper is this?
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus What I listed is normal malleability. I assume you could run the same attack that hit MtGox by adding $l$ to $S$. If you want to use Ed25519 in a bitcoin like protocol, you certainly should add a $S<l$ check. Nightcracker's attack on the other hand is weirder, it certainly doesn't fit the common definition of malleability. I'm not even sure if we should classify it as an attack. (for details, see discussion on the github issue, I posted a longer comment overthere).
Feb
27
comment Designing a secure IM protocol
One obvious issue is that you can send a different message to each recipient with that scheme.
Feb
27
comment Non-standard signature security definition conforming ed25519 malleability
@Gracchus I only checked one implementation (Ref10, the most popular one), which accepts $s \geq l$. I.e. with this implementation Ed25519 is malleable. I expect most other implementations to accept those signatures as well. => You can't rely on non malleability unless you add additional checks yourself.
Feb
27
revised Non-standard signature security definition conforming ed25519 malleability
edited tags