9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 1 hour ago

Feb
19
revised RSA with modulus product of many primes
edited tags
Feb
19
revised Who first published the interest of more than two prime factors in RSA?
edited tags
Feb
19
revised Are there any standards of multi-prime RSA key generation?
edited tags
Feb
18
comment Finding if exponent share is present in dlog instance
I recommend using uppercase letters for group elements and lower case letters for scalars. That way you easily see that you're adding a scalar an a group element which doesn't make much sense.
Feb
18
comment Can a properly implemented ed25519 private key with public underlying data be cracked?
Even with say RSA-PSS, the security gets weaker as you get more hashes to target in a second pre-image attack. For example if you had a 128 bit hash and generated $2^{30}$ signatures, creating a fake would only cost $2^{90}$ operations. Now we generally use hashes with are twice as wide as the security level, so this is not a practical concern, but it demonstrates that this issue isn't as trivial as it seems.
Feb
18
comment Block Cipher vs Stream Cipher in Web Application
My experience is that there is a movement away from traditional block cipher modes like CBC towards stream cipher modes. For example AES-GCM is based on the AES-CTR, a stream cipher mode. Google will probably add TLS suites based on the stream cipher ChaCha soon, and I believe some SSH implementations already did add similar suites.
Feb
18
comment Block Cipher vs Stream Cipher in Web Application
1) RC4 is unfortunately common. 2) There is no reason to believe that stream ciphers are weaker in principle than block ciphers. For example Salsa20 or Keccak in duplex mode are believed to be secure. 3) You can build stream ciphers from block ciphers, e.g. AES in CTR mode is a stream cipher. This proves that if you know of to build a secure block cipher, then you can also build a secure stream cipher.
Feb
18
comment RSA vs El Gamal digital signature. Which is more secure?
I don't see how that's a duplicate. This question is about RSA and ElGamal signatures, the other question about RSA and ElGamal encryption.
Feb
18
comment Proof of work for standard computers
@D.W. 1) Scrypt with sufficient memory (say 1GB) use isn't cheap to verify. Scrypt is pretty much the baseline against which to compare a better scheme. 2) The only time lock puzzles I know are sequential, but don't need much memory. So you can solve many instances in parallel with many cheap cores.
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
In scenarios where you want random IVs, you probably can afford a hashing operation per message, so you could derive a per-message key from a master key and a longer per-message random value.
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
@owlstead Security and block size are only loosely coupled. The main advantage of larger block sizes is that you get larger IVs, so you can safely use a random IV. I'd guess the main reason for using larger block sizes is that your cipher (say Threefish) happens to have larger blocks.
Feb
17
comment IV/Nonce in CTR&GCM mode of operation
GCM IVs are typically 96 bits, which is rather short for random generation.
Feb
17
comment Can a properly implemented ed25519 private key with public underlying data be cracked?
There are signature algorithms with either a strictly limited number of signatures (typical hash signatures) or which get weaker as more signatures are generated.
Feb
17
comment Block Ciphers and (Non-)Generic Attacks
A generic attack works against all block-ciphers with a given key and block size.
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
Why would you have to choose a larger field? AFAIK GCM only uses the underlying cipher as stream cipher, so the block size shouldn't matter at all (if it is at least the field size, for smaller blocks a bit of special handling might be required)
Feb
14
awarded  Enlightened
Feb
14
awarded  Nice Answer
Feb
12
comment Prime factorization of RSA modulus
$m^{e_1d_1-e_2d_2}=1$ mod $N$ follows from $m^0=1$ and $e_1d_1-e_2d_2=0 \mod \phi(N)$
Feb
12
comment Prime factorization of RSA modulus
Typically $e$ is the public key, not the private key.
Feb
12
revised Why do we use 1024 / 160 bit primes in DSA?
added 10 characters in body; edited tags; edited title