Reputation
11,701
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~190k people reached

Mar
26
comment Questions about hash functions
@PaŭloEbermann I don't think that this directly contradicts the basic security definitions. Indirectly it might do so, since it enables a MitM attack so you probably can only achieve $2^{n/2}$ pre-image resistance.
Mar
26
revised Lamport signature: How many signatures are needed to forge a signature?
added 160 characters in body
Mar
26
comment Lamport signature: How many signatures are needed to forge a signature?
@mephisto I was thinking about signing a hash (preferably a with an unpredictable prefix, as in Ed25519), but you're right that the OP didn't specify such hash-then-sign step. I've edited my answer to clarify that.
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
It might have one effect: The designers of entries to the password hashing competition will avoid these collisions.
Mar
25
answered Is PBKDF2-HMAC-SHA1 really broken?
Mar
25
comment Is PBKDF2-HMAC-SHA1 really broken?
Collision resistance isn't considered a required property for password hashes. So this is generally just a curiosity, not a vulnerability.
Mar
25
comment Challenge–response authentication which can be done in head?
1) The scenario you described is symmetric, since you and the doorman have a shared secret. 2) You need authentication, not encryption
Mar
22
comment Questions about hash functions
Even with Merkle-Damgard hashes like SHA-256 (which are vulnerable to length extensions attacks) are not vulnerable to length reduction attacks.
Mar
22
comment Rock-paper-scissors over network, how to protect from cheating server?
If the server pretends that it didn't receive Alice's plaintext, Alice will notice and avoid that server in the future.
Mar
20
answered McEliece key size
Mar
20
awarded  Enlightened
Mar
20
awarded  Nice Answer
Mar
19
comment Why is Serpent faster than AES in this benchmark?
@Gael With parallelism I mean that you have the inputs for multiple blocks (with 16 bytes each) available at the same time. In that case you can call a (single threaded) function that takes e.g. 32 blocks and produces 32 encrypted blocks. This function is cheaper for Serpent than encrypting 32 blocks individually. Using Serpent-XTS should be faster than AES-XTS on your current hardware, but once you get a AES-NI capable CPU AES will pull ahead.
Mar
19
comment Why is Serpent faster than AES in this benchmark?
In that case the AES numbers are plausible (16 cycles per byte) compared to ~12 on i3 without AES-NI in the eBACS benchmark.
Mar
19
revised Why is Serpent faster than AES in this benchmark?
added 25 characters in body
Mar
19
revised Why is Serpent faster than AES in this benchmark?
added 326 characters in body
Mar
19
revised Why is Serpent faster than AES in this benchmark?
deleted 176 characters in body; edited title
Mar
19
answered Why is Serpent faster than AES in this benchmark?
Mar
19
comment Why is Serpent faster than AES in this benchmark?
What CPU do you have? Intel? AMD? How fast? Which architecture?
Mar
19
comment Does a dynamic accumulator exist yet?
@DrLecter You still need a trusted party who promises to forget the factorization. While you can generate RSA moduli without knowing their factorization they're very big.