Reputation
13,631
Next tag badge:
98/100 score
17/20 answers
Badges
1 34 70
Impact
~259k people reached

Apr
22
asked Can Grover's algorithm be parallelized?
Apr
22
answered What is the “compression function” in Merkle-Damgård?
Apr
22
comment What is the “compression function” in Merkle-Damgård?
Yes. MD is a domain extender which turns a fixed input size hash into a variable input size hash.
Apr
22
comment Super-simple encryption of short strings
1) Why use encryption at all? I'd rather use a lookup table/tokenization. 2) If you want to use crypto, why use format-preserving-encryption? 2) Anonymizing data sets is hard. It's often possible to correlate data from different sources to deanonymize such data.
Apr
22
revised side channel attacks against TDES (compared to AES)
deleted 77 characters in body; edited tags
Apr
22
comment side channel attacks against TDES (compared to AES)
So it wasn't just a timing attack, but a power analysis attack? In that case you're pretty much doomed with any general purpose CPU. If you want to prevent attacks where the attacker has physical access to the device, you should use special purpose hardware designed to make these attacks harder. The choice of cipher matters far less compared to how much effort the hardware designer put into preventing those attacks.
Apr
22
comment side channel attacks against TDES (compared to AES)
I don't think the AES side-channels are as big as you think. If you're referring to DJB's paper, he used a very precise timer on the server to attack AES.
Apr
22
awarded  Informed
Apr
21
awarded  Enlightened
Apr
21
awarded  Nice Answer
Apr
21
revised Is SSL getting faster because it's getting less secure?
added 101 characters in body
Apr
21
reviewed No Action Needed Why rogued certificate from hash collision is harmful
Apr
21
reviewed No Action Needed Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
Apr
20
comment what are the NTRU keysize and application in industry ?
NTRU is patented, which has hampered adoption.
Apr
20
comment DHKE choice of private keys
You can apply the same logic to any particular private key. The attacker guessing correctly that your private key is 1 is just as unlikely as the attacker correctly guessing it's another value. 1 isn't special.
Apr
20
comment DHKE choice of private keys
Doesn't a 128 bit exponent result in a 64 bit security level? A 256 bit exponent might be wiser.
Apr
20
comment DHKE choice of private keys
Obviously the shared secret would be the same as the public key if the private key is 1. But I don't see how that's a problem. A good stream cipher occasionally outputs zero bytes as well, in which case the ciphertext byte will equal the plaintext byte.
Apr
20
comment DHKE choice of private keys
I wonder why $1$ is missing in your examples, it looks like a perfectly fine private key to me. I'd choose the private key $x$ to fulfill $0<x<q$ where $q$ is the order of the generator (typically $(p-1)/2$).
Apr
20
comment DHKE choice of private keys
If you forbid $p-1$, shouldn't you also forbid $(p-1)/2$?
Apr
20
comment Is it ever unsafe to compress an EC point?
@poncho Curve25519 has $p \equiv 5 \pmod 8$. P-224 has $p \equiv 1 \pmod 4$. But there are efficient algorithms for computer square-roots in both of those fields.