Reputation
11,556
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

Sep
21
awarded  Enlightened
Sep
21
awarded  Nice Answer
Sep
20
comment Why is 224 bit ecdsa faster than 192 bit ecdsa?
Based on the size, P224 should be 50-60% more expensive since the size of the exponent increases as well. So the scaling has an exponent between 2.6 and 3 depending on the multiplication algorithm.
Sep
19
comment Why is 224 bit ecdsa faster than 192 bit ecdsa?
Implementers put a lot of effort into speeding up the variants we use in practice. For example the paper Emilia Käsper - Fast Elliptic Curve Cryptography in OpenSSL presents an optimized P224 implementation.
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
@poncho Which means that I can check that the signer didn't choose $\mathrm{GCD}(e,\phi(n))>1$ by asking for a certain number of signatures. This can be made non interactive with the usual hashing techniques. Still it's yet another pitfall for blind signature schemes, made particularly annoying since they are often used with multiple public exponents.
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
For a maliciously generated key with $\mathrm{GCD}(e, \phi(n))>1$ there should be several different values that become the same after raising to the $e$th power.
Sep
18
reviewed Satisfactory MAC using a modified CBC mode of operation
Sep
18
reviewed Excellent Elliptic Curve Cryptography
Sep
18
reviewed Satisfactory Secure MultiParty Computation with secret inputs for secret outputs
Sep
18
comment Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency
I think BLS is (or can be made) unique. Its signatures have half the size of ECDSA signatures.
Sep
16
comment Scalar multiplication of elliptic curve point by a fraction
You need the inverse modulo the order of the group, not modulo the inverse in the underlying field.
Sep
16
answered salsa20 is invertible, useless in CTR mode?
Sep
16
answered Is Rabin's cryptosystem secure against known-plaintext attacks?
Sep
16
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
229110545576645850236522690668306544921 = 13118050575083334077 * 17465289088900344973 so this looks like a plausible modulus, albeit very weak. 13082845549543033994073971762152947067 = 37 * 1128586338367 * 313303828194079496938273 It's quite unusual to use a large e, typically we use small primes with low hamming weight like 3 or 65537.
Sep
16
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
I also want to note that keys used for confidentiality effectively never time out, since the attacker can store the ciphertext forever.
Sep
16
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
You should replace the "any kind of asymmetric encryption ... at least 2048 bits" part. This size recommendation if appropriate for RSA or finite field Diffie-Hellman based encryption. There are other algorithms which need much smaller (e.g. 224 bits with ECC) or much larger (~1 Mbit for McEliece) keys for a similar security level.
Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
I don't see the point in using NTRU for authentication and ECDHE for confidentiality. If you want post quantum security, it's far more important to use a PQ algorithm for confidentiality than for authentication, since authentication keys expire and can be revoked.
Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
You can use RSA to achieve forward secrecy and you can use DH creating a non forward secret protocol. Forward secrecy is a matter of protocol design and key management, not about the algorithm you use. In practice we often use DH for forward secrecy since key generation is cheap. But even for algorithms with expensive key generation, you can simply generate a new short term key every couple of seconds, which results in a high degree of forward secrecy.
Sep
11
comment How can AES be considered secure when encrypting large files?
You describe ECB mode, which is indeed not secure. But actually used modes make it different for each block.
Sep
11
comment stream cipher computation cost
Depends on the specific cipher. Salsa20/ChaCha have 512 bit blocks (it's very similar to CTR mode), RC4 outputs bytes. Other ciphers can have different word/block sizes.