Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Jul
11
comment How is an epsilon of 1/1000 non-negligible?
Consider an attacker who induces your client to send its password 1000 times. They'll be able to recover most of the password by combining the information learned from each transmission. This is similar to the attacks against RC4 in TLS.
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Pohlig-Hellman?
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Related: SRA, pohlig-hellman, three-pass protocol
Jul
10
revised Are there transitive ciphers (either symmetric and asymmetric)
edited body; edited tags
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM Xor is not secure as commutative encryption.
Jul
10
comment Why we need ECDSA when we have ECDH?
You might be interested in BLS signatures, they're essentially Diffie-Hellman between the message hash interpreted as group element and the signers key. But they require a group in which the decisional Diffie-Hellman problem is easy to verify the signature.
Jul
7
comment What is the difference between a PRF and a PRF+?
Looks identical to HKDF-Expand.
Jul
7
revised Inner product with homomorphic encryption
added 105 characters in body
Jul
6
reviewed Close In what cases will RSA not work?
Jul
6
comment Can I reduce the MAC size in TLS?
If you want short MACs, use HMAC. GHash is quite fragile when used with short MACs, I certainly wouldn't go below 80 bits with GHash.
Jul
5
comment How to choose McEliece's parameters?
The paper Daniel J. Bernstein, Tung Chou, and Peter Schwabe: McBits: fast constant-time code-based cryptography lists a bunch of parameterizations as well. Since the paper is from 2013, the security estimates should take the attacks you mentioned into account.
Jul
5
comment space complexity of quantum collision search
Related paper Daniel J. Bernstein. "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?" Workshop Record of SHARCS'09: Special-purpose Hardware for Attacking Cryptographic Systems.
Jul
5
comment Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
SIV mode might be interesting for you.
Jul
5
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
Interesting essay: Boaz Barak - Structure vs. Combinatorics in Computational Complexity
Jul
5
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
Related question How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Jul
5
revised What is SRP-Z from?
deleted 6 characters in body; edited tags
Jul
5
comment What are the advantages of using OFB (Output Feedback Mode)?
Could you add a reference for CTR having better security bounds?
Jul
5
reviewed Approve What are the advantages of using OFB (Output Feedback Mode)?
Jul
4
comment What are the advantages of using OFB (Output Feedback Mode)?
CBC and CFB decryption are parallelizable, so the speed advantage of CTR should only apply to encryption, not decryption.
Jul
4
comment Logjam-style attack on Factoring?
There is an technique called Batch NFS but I don't know about the details.