10,073 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 49 mins ago

Oct
30
comment RSA Decryption given n, e, and phi(n)
1) Compute d as the Modular multiplicative inverse of e, i.e. $d=e^-1 \bmod \phi(n)$ using extended euclidean 2) compute $m=c^d \bmod n$
Oct
30
revised Stream Cipher : Never use stream cipher key more than once
added 6 characters in body; edited tags
Oct
30
comment Why develop new stream ciphers when block ciphers can be trivally made into streams?
Comparing dissimilar ciphers like AES and RC4 is pretty difficult. On large modern CPUs AES will be much faster.
Oct
30
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
Bernstein likes doing ECDH using x-only ladders without first verifying if the given x value is on the curve or the twist. For example the Curve25519 implementation in NaCl works like that.
Oct
30
comment Why is it hard to calculate Logarithm on Diffie Hellman?
You compute $g^x \bmod p$ via square-and-multiply in time $(\log(p))^3$, which is feasible for a 1000 bit $p$. The naive algorithms you describe are far too expensive.
Oct
30
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
There is a less common scheme called BLS, which produces 32 byte signatures at a 128 bit security level.
Oct
30
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
Modifying an ECC signing lib, especially if it's already Schnorr based like Ed25519, to use hashed Schnorr at a size of 3x security level isn't that hard. Not sure how this interacts with multi-target attacks though.
Oct
30
comment Low exponent attack against RSA
You shouldn't rely on secret RSA moduli: Hans-Joachim Knobloch - Breaking Public Keys - How to Determine an Unknown RSA Public Modulus.
Oct
30
comment Are there cryptographic hash functions that can be computed using only paper and pen without leaking any information about the plaintext?
Is there a textual description of this hash function? I don't want to watch an hour long video for something that almost certainly doesn't meet the requirements of the OP. Learning to keep 60+ bits in mind at the same time is probably possible, but certainly takes quite a bit of effort.
Oct
29
comment Elliptic Curves Readdition
In some ECC forms readdition can reuse some intermediate values of the previous addition speeding up the operation a bit.
Oct
28
comment Why does NTRUEncrypt lack a formal security proof?
You can't prove IND-CPA unconditionally. The best you can hope for is a reduction to a common problem like learning-with-errors. You also need to be really careful about the tightness of security reductions. Many proofs are asymptotic or prove an impractically low security level, so even if there is a reduction, it doesn't mean that the scheme is any good.
Oct
24
comment What can be learned from the ciphertext of LibSodium's crypto_box_detached()?
Three times "no".
Oct
24
comment Format Preserving Encryption for 32 or 64 bit plaintext values
You might be interested in the AEZ Caesar candidate.
Oct
22
comment What is the use of Mersenne Primes in cryptography
Some ECC implementation use extension fields with characteristic $2^{127}-1$. One example is snowshoe.
Oct
22
comment What is the use of Mersenne Primes in cryptography
While we use mersenne primes in crypto, we only use medium sized numbers. So the search for larger (mersenne) primes doesn't have crypto applications.
Oct
22
comment Encrypt a file for random access but only after an initial read of the whole file
@Travis you forgot to salt the password hash.
Oct
22
comment Encrypt a file for random access but only after an initial read of the whole file
@otus It's key dependent processing of the whole file. Since the intention of the OP is to only allow checking if the password is valid after processing the whole file, this should suffice.
Oct
22
comment Is it just as difficult to find a desired output in a hash digest, for MSB vs LSB?
The first byte after the 1 is extremely biased. Character Characters 2 to P occur with about 4.3% probability, characters R to z with 0.07% probability. 1 and Q are somewhere in the middle. I believe this results from the rare characters being impossible if the address has the usual length, only occurring in the rare case where the number is small enough to have a shorter encoding. The bias quickly disappears as you get to less significant digits.
Oct
22
comment Encrypt a file for random access but only after an initial read of the whole file
I wouldn't bother. Just focus on using a good password based KDF (such as scrypt). That way an attacker can verify the file with only a few bytes but they still incur the cost of the KDF for each password.
Oct
22
comment Encrypt a file for random access but only after an initial read of the whole file
@StephenTouset As far as I can tell it does. You first need to commit to a password and then process the whole file to learn the actual key and thus any information about the file.