9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 6 hours ago

Sep
22
comment Using modulus in one time pad?
1) What would you use instead? It's correct and it's convenient. What more do you want? 2) Nowadays we typically use xor (addition modulo 2) which is fast in software and encryption/decryption are the same function. 3) why do you claim M is a large number? It's often 2 or 256 and very rarely larger than 64 bits or so.
Sep
22
comment Random vs. Fixed Paddings
Are you only talking about paddings used with symmetric block ciphers, as in your examples? Or also about paddings used for RSA/Rabin encryption? These kinds of paddings are quite different and should not be discussed in a single question.
Sep
22
comment Random vs. Fixed Paddings
I don't understand what you want to say. 1) If you're talking about padding oracles (adaptive chosen ciphertext), the proper defense is a MAC. 2) If you're talking about semantic security and known/chosen plaintext attacks, it's the job of IVs/nonces to achieve that. 3) If you're talking about asymmetric encryption (RSA, Rabin) you need randomized padding, but RSA padding is conceptually very different from the block cipher paddings the OP mentioned. RSA padding includes properties which in the symmetric case are handled by MAC and IV instead of the padding.
Sep
22
comment Random vs. Fixed Paddings
For symmetric encryption the IV introduces all the randomness you need.
Sep
22
comment Bouncy Castle elliptic curve from explicit parameters (E-521)
BouncyCastle only supports weierstrass for curves. So you'd need to convert the curve and the points from edwards to weierstrass before use. Of course this negates most of the advantage of E521 over curves like P521, the fast and constant time arithmetic in edwards or montgomery form.
Sep
21
awarded  Enlightened
Sep
21
awarded  Nice Answer
Sep
20
revised what is the difference between existential forgery by know message attack and existential forgery by chosen message attack in digital signature?
added 48 characters in body
Sep
20
comment Why is 224 bit ecdsa faster than 192 bit ecdsa?
Based on the size, P224 should be 50-60% more expensive since the size of the exponent increases as well. So the scaling has an exponent between 2.6 and 3 depending on the multiplication algorithm.
Sep
19
comment Why is 224 bit ecdsa faster than 192 bit ecdsa?
Implementers put a lot of effort into speeding up the variants we use in practice. For example the paper Emilia Käsper - Fast Elliptic Curve Cryptography in OpenSSL presents an optimized P224 implementation.
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
@poncho Which means that I can check that the signer didn't choose $\mathrm{GCD}(e,\phi(n))>1$ by asking for a certain number of signatures. This can be made non interactive with the usual hashing techniques. Still it's yet another pitfall for blind signature schemes, made particularly annoying since they are often used with multiple public exponents.
Sep
19
comment Is it possible (how difficult) to find MORE than one valid RSA signature?
For a maliciously generated key with $\mathrm{GCD}(e, \phi(n))>1$ there should be several different values that become the same after raising to the $e$th power.
Sep
18
reviewed Satisfactory MAC using a modified CBC mode of operation
Sep
18
reviewed Excellent Elliptic Curve Cryptography
Sep
18
reviewed Satisfactory Secure MultiParty Computation with secret inputs for secret outputs
Sep
18
comment Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency
I think BLS is (or can be made) unique. Its signatures have half the size of ECDSA signatures.
Sep
16
comment Scalar multiplication of elliptic curve point by a fraction
You need the inverse modulo the order of the group, not modulo the inverse in the underlying field.
Sep
16
answered salsa20 is invertible, useless in CTR mode?
Sep
16
answered Is Rabin's cryptosystem secure against known-plaintext attacks?
Sep
16
comment Why would an RSA library tell me that the public key must be at least 512 bits in size?
229110545576645850236522690668306544921 = 13118050575083334077 * 17465289088900344973 so this looks like a plausible modulus, albeit very weak. 13082845549543033994073971762152947067 = 37 * 1128586338367 * 313303828194079496938273 It's quite unusual to use a large e, typically we use small primes with low hamming weight like 3 or 65537.