Reputation
Next tag badge:
score
answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

May
9
revised Point addition and doubling in Ed25519 (ref10)?
added 27 characters in body
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Why do you want to avoid the conversion to Montgomery for DH? It's a bit slower than using (Y/Z) coordinates in Edwards form due to an additional field inversion, but almost certainly faster than what you're attempting to build. Conversion back to edwards at the end of the scalar multiplication is free, but I didn't do so for compatibility with existing Curve25519 shared secrets.
May
9
answered Point addition and doubling in Ed25519 (ref10)?
May
8
comment Decrypt a public encrypted message and Sign a signature, how the math is different?
With RSA you generally use different padding. With other schemes encryption and signing usually have very little in common.
May
7
awarded  Enlightened
May
7
awarded  Nice Answer
May
7
revised Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?
deleted 29 characters in body
May
7
comment Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?
You have no chance if the malware has been implemented properly.
May
7
comment ECC partially blind signature scheme verification
I'd consider using RSA based blind signatures. It's simple, robust and supports tons of additional features. The main downsides are the lower performance and larger signatures.
May
7
revised Can Skein be used as a secure MAC in format H(k || m)?
added 8 characters in body
May
6
comment Is knowing the private key of RSA equivalent to the factorization of $N$?
If you know $e$, $d$ and $n$, you can efficiently factor $n$. Just knowing $d$ is not enough if $e$ is big.
May
5
comment Does Microsoft use Dual_EC_DRBG by default?
According to wikipedia you introduced DUAL_EC_DRBG in Windows Vista, but your post doesn't mention Vista and Server 2008. What's their status regarding DUAL_EC? Sorry for nitpicking, but I read a few too many carefully worded denials recently. According to imichaelmiers's answer there was a change in the default in a Service Pack for Vista, with both versions (Hash and AES-CTR) considered safe.
May
5
comment Mapping integers to Ed25519 and back again?
You might want to take a look at Elligator 2, but it has some limitations.
May
5
revised Security benefits of Ed25519 generating signatures deterministically
edited tags; edited title
May
3
revised Shor's Algorithm values
added 18 characters in body
May
2
revised Pseudocode for constant time modular exponentiation
edited title
May
2
comment Back up an information as $n$ pieces and require exactly $n-1$ to recover it
Search for "erasure coding" and "secret sharing"
May
2
comment Can 64-bit “PRINCEcore” practically be brute forced?
Once you're over the initial development cost of custom hardware, this isn't very expensive. I think it's about as much work as mining a single bitcoin block at the current difficult. Or differently said, it would take the current bitcoin mining network only a few minutes. Should be 10k USD or something of that magnitude.
May
2
comment Why should I use an Initialization Vector (IV) when I have unique keys?
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach.
May
1
comment Does not using padding mean a lack of security?
There are two kinds of padding: 1) Padding required by the mode of operation (for CBC but not CTR) 2) Padding that aims to make traffic analysis harder. These kinds of padding should not be confused.