Reputation
12,198
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~205k people reached

Jul
12
revised Differential addition on Montgomery curve
added 2 characters in body
Jul
12
reviewed Reviewed Which concrete applications benefit from Oblivious RAM constructions?
Jul
12
revised Which concrete applications benefit from Oblivious RAM constructions?
added 998 characters in body
Jul
12
comment Which concrete applications benefit from Oblivious RAM constructions?
It'd be nice if you could include a short summary in your answer.
Jul
12
answered How to compute two EC point multiplication?
Jul
12
revised Does exponentiation by squaring work on Montgomery curves?
edited tags
Jul
12
comment How to compute two EC point multiplication?
The OP can define $*$ to mean whatever they want it to mean. They chose to define it as the solution of the CDH problem.
Jul
12
revised How to compute two EC point multiplication?
added 21 characters in body
Jul
11
comment Why Elliptic Curves?
Related questions: Why can ECC key sizes be smaller than RSA keys for similar security?, Trying to better understand the failure of the Index Calculus for ECDLP
Jul
11
comment How is an epsilon of 1/1000 non-negligible?
Consider an attacker who induces your client to send its password 1000 times. They'll be able to recover most of the password by combining the information learned from each transmission. This is similar to the attacks against RC4 in TLS.
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Pohlig-Hellman?
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Related: SRA, pohlig-hellman, three-pass protocol
Jul
10
revised Are there transitive ciphers (either symmetric and asymmetric)
edited body; edited tags
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM Xor is not secure as commutative encryption.
Jul
10
comment Why we need ECDSA when we have ECDH?
You might be interested in BLS signatures, they're essentially Diffie-Hellman between the message hash interpreted as group element and the signers key. But they require a group in which the decisional Diffie-Hellman problem is easy to verify the signature.
Jul
7
comment What is the difference between a PRF and a PRF+?
Looks identical to HKDF-Expand.
Jul
7
revised Inner product with homomorphic encryption
added 105 characters in body
Jul
6
reviewed Close In what cases will RSA not work?
Jul
6
comment Can I reduce the MAC size in TLS?
If you want short MACs, use HMAC. GHash is quite fragile when used with short MACs, I certainly wouldn't go below 80 bits with GHash.
Jul
5
comment How to choose McEliece's parameters?
The paper Daniel J. Bernstein, Tung Chou, and Peter Schwabe: McBits: fast constant-time code-based cryptography lists a bunch of parameterizations as well. Since the paper is from 2013, the security estimates should take the attacks you mentioned into account.