Reputation
13,631
Next tag badge:
98/100 score
17/20 answers
Badges
1 34 70
Impact
~259k people reached

Jun
20
revised Efficient setup for a Montgomery multiplication
edited tags; edited title
Jun
20
revised Blockwise Montgomery multiplication
edited tags
Jun
20
revised Montgomery Exponentiation - selecting input value R for a given BigInteger
edited tags
Jun
20
revised How can I validate generated session keys in SRP-6a protocol
edited tags
Jun
20
comment Any use for now-defunct Mt Gox Yubikey?
I'm voting to close this question as off-topic because it is not about cryptography.
Jun
20
revised Where is the OID and ASN.1 specified for AES_CMAC?
edited tags
Jun
20
revised extract ciphertext from encrypted SMIME file
edited tags
Jun
20
revised Using C_Sign to create a PKCS7 signature
edited tags
Jun
20
revised PKCS#7 signed data structure in signed PDF document
edited tags
Jun
20
comment 2DES vs. two-key triple encryption, with no decryption step
Related question: Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Jun
19
comment 3DES over Galois Counter Mode (GCM) for authenticated encryption
@MaartenBodewes You wouldn't use a 64 bit polynomial. You'd use 2 blocks as keys/mask for GHash. The biggest problem with 64 bit block ciphers is that the IV size becomes even smaller (32 bits for counter, 32 bit IV). Not sure how big the impact on protocol design is in practice, since a random 96 bit IV isn't a great idea either, so when a good protocols needs a random IV, it uses a KDF to derive a one time key from IV and master key.
Jun
19
awarded  Convention
Jun
19
revised Does this chat protocol exist?
added 44 characters in body
Jun
19
comment Relationship between an elements order and the DLP
Related question: Solving discrete logarithm when p is not a safe prime
Jun
19
reviewed Leave Open Relationship between an elements order and the DLP
Jun
19
comment Relationship between an elements order and the DLP
We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it.
Jun
19
comment In which situations is a length-extension attack a problem?
Similar multi collision attacks apply to all narrow pipe hashes, since for them, finding a state collision isn't harder than finding an output collision.
Jun
19
accepted Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?
Jun
18
awarded  Revival
Jun
18
answered Why can't I use ECB with some obfuscation for transient RAM?