Reputation
11,691
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~189k people reached

Apr
30
comment encryption system ElGamal
Have you read the wikipedia article for ElGamal encryption? At which step did you get stuck?
Apr
29
comment What can cause similar MD5 hashes
1) Are you sure you're using correctly implemented MD5? 2) Can you post the hashing code?
Apr
29
comment Why does the ElGamal signature have the specific form that it does?
Probably the first working formula ElGamal found. There are other formulas which work as well (e.g Schnorr and DSA).
Apr
29
comment Yubico's take on U2F key wrapping
Are you using the HMAC key as second parameter?
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong I don't get your point. The cost of multiplication is data independent for most CPUs. So as long as you implement your code without secret dependent array lookups and secret dependent branches, you should trivially end up with a side channel resistant implementation.
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong But montgomery curves have nice properties which allow fast constant time implementations of montgomery ladders.
Apr
28
reviewed Approve Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings
Apr
27
reviewed Reviewed Why are there only positive value points on an elliptic curve?
Apr
27
revised Why are there only positive value points on an elliptic curve?
added 79 characters in body
Apr
27
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)
Apr
27
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Working on a prototype implementation, I noticed that my assumptions about how iterated hashes cycle were wrong. I didn't know that a few cycles and their tails dominate.
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
You can't just equate the number of operations with time, you also need to take parallelism into account. (And DJB argues that you can't neglect the cost of memory access circuitry for many attacks either.) With cycle-finding I'd expect the cost of memory to be cheap compared to the cost of all those parallel DES computation circuits. For example such a computer might have ~4 GB of memory and $2^{20}$+ DES circuits, running for ~$2^{36}$ timesteps (where each timestep is one DES invocation).
Apr
26
reviewed Approve Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Apr
26
reviewed No Action Needed If you hashed a hash an infinite number of times would you end up with a unique hash?
Apr
26
reviewed No Action Needed Password length versus hash length?
Apr
26
reviewed No Action Needed Key iteration count while using random keyfile larger than master key
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
1) In the simplest case we could truncate. If we need a tweak to repeat the whole experiment with a different hash function (not sure if that's required) we can use any kind of tweakable hash (preferably a cheap one) 2) I don't think the block-size matters at all with most modes of operation (including ECB, CBC and CTR). We simply need a long enough known plaintext/ciphertext pair.
Apr
26
comment Why does applying 56-bit DES twice only give 57 bits of security?
@fgrieu I originally planned to verify the technique experimentally with small keys before posting about it, but since I don't have the time for that at the moment, I've asked it as a question: Can cycle findinding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Apr
26
asked Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Apr
25
revised SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256)
added 185 characters in body