10,322 reputation
12453
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 48 mins ago

Feb
11
comment If its possible to derive the public key from a private key, why can't we go in reverse?
I used additive notation. If you prefer multiplicative notation you'd say it's hard to solve $A=G^a$ for $a$. This problem (with either notation) is the discrete logarithm problem, which is believed to be hard on (the commonly used) finite fields and elliptic curves). DLP is easy in some groups and hard in others. We use those where it's hard, because else this kind of crypto would be trivially broken.
Feb
11
comment Should tweak be unique per message?
That makes little sense. You can still use CBC mode with a tweakable block cipher.
Feb
11
comment Should tweak be unique per message?
A tweakable blockcipher is just a building block. You can use many modes of operation on top, which have varying security properties. If you set the tweak to a constant you can use the normal modes. For some modes you'd use a unique tweak for each block in a message, but reuse the tweak across messages, relying on traditional IVs for different messages.
Feb
11
comment If its possible to derive the public key from a private key, why can't we go in reverse?
The short answer is that there is no (known) efficient algorithm that can solve $A = a G$ for $a$, even when $A$ and $G$ are known.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
You can't hardcode it if you want to support all possible values of $x,z$. Garbage values of $z$ won't match the fixed $c$.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
I guess the new function has to be denoted as $T(x, c) = (y, z)$ where $c$ is a constant. So $T^{-1}$ will give you a $x,c$ pair, but with an invalid $c$.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
I think you need additional inputs with fixed value when rewriting the circuit using toffoli's. When you reverse the circuit you don't get back those fixed values.
Feb
7
comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves?
Concerning the two points with x=9 issue: The Ed25519 paper fixes a point with both x and y coordinates, which when converted to Curve25519 has x=9. I'd choose that point instead of arbitrarily picking one.
Feb
7
comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves?
I don't thinks answers the question fully. I'd also expect answers to "Does such a formula exist for all montgomery curves? Does it work for all points on those curves?" since those are restrictions on which curves can be converted.
Feb
6
revised Computationaly hard detokenization algorithm for credit card numbers
edited title
Feb
5
revised Why does a one-time-pad key have to be at least as long as a message?
edited title
Feb
5
comment Practical (and secure) PRGs
Why do you want to use a number-theoretic PRNG in the first place? There are many nice stream ciphers which are faster and stronger.
Feb
4
comment Public-Key Deterministic Encryption : Why does not provide perfect security?
There are no public key schemes that are perfectly secure, deterministic or not. A computationally unbounded attacker can always recover the private key from the public key.
Feb
3
comment Is there a technique to confirm that a given large integer value is a product of two primes?
Can you add a bit of information about that ZKP?
Jan
31
comment Why does a perfect secrecy can be achieved when decryption correctness is not totally required?
You can omit part of the information from the output and guess them. Those guesses will be incorrect sometimes. This boils down to using lossy compression before encrypting.
Jan
31
comment How do institutions like banks do RSA with big primes?
1) CRT is only a factor 4 speedup. The OP has trouble understanding why modular exponentiation has anywhere near acceptable performance, a factor 4 is irrelevant in this context. 2) Larger devices will use CRT as well. It's just as nice on a large x86/AMD64 as it is on a constrained device.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
What's the difference between this question, and your other one? How to specify last t bits are only sent when a signature is sent?
Jan
31
revised implication of tweak on bruteforcing a block cipher
added 23 characters in body
Jan
31
comment How to specify last $t$ bits are only sent when a signature is sent?
There are short MACs (but even they need 64 bits for a decent level of securiy), but even BLS signatures need 2x the security level. One can use proof-of-work to shave of a 20 bits or so.
Jan
30
comment Random numbers for Rabin-Miller primality tests
@PnD You should use a well seeded CSPRNG, not a mersenne twiser. The seeding part is essential, /dev/urandom is the minimum quality you should accept as seed.