Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

May
4
reviewed Reviewed Is ECB mode safe to use with RSA encryption?
May
4
reviewed No Action Needed How do I prove IND-CPA security of RSA-OAEP?
May
2
comment Decypting a Stream Cipher
You need to find the multiplicative inverse of a mod m. Which exists if GCD(a, m)=1.
May
2
comment Can Winternitz be easily converted to a many-time encryption scheme?
@petro444 You can use hashes in CTR mode, but for most hashes that will have bad performance, since they're optimized for consuming data, not for outputting data. Salsa20 and ChaCha are stream ciphers built with a hash at their core.
May
1
answered Can Winternitz be easily converted to a many-time encryption scheme?
May
1
revised Block cipher does not provide security by itself
added 169 characters in body
May
1
answered Block cipher does not provide security by itself
May
1
comment SHA-512 partial preimage
@StevePeltz Average != median.
May
1
comment Why are there no OTP ciphers?
@VincentAdvocaat The current expectation is that QCs: 1) halve the effective key length of symmetric ciphers (so 256 bit ciphers should still be fine). 2) totally break RSA, DH/DSA and ECC 3) Only offer a small advantage (similar to the one against symmetric crypto) against certain more experimental asymmetric algorithms. So the common conclusion isn't switching to OTPs, but to develop those alternative asymmetric algorithms until they're ready for production.
Apr
29
comment What can cause similar MD5 hashes
1) Are you sure you're using correctly implemented MD5? 2) Can you post the hashing code?
Apr
29
comment Why does the ElGamal signature have the specific form that it does?
Probably the first working formula ElGamal found. There are other formulas which work as well (e.g Schnorr and DSA).
Apr
29
comment Yubico's take on U2F key wrapping
Are you using the HMAC key as second parameter?
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong I don't get your point. The cost of multiplication is data independent for most CPUs. So as long as you implement your code without secret dependent array lookups and secret dependent branches, you should trivially end up with a side channel resistant implementation.
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong But montgomery curves have nice properties which allow fast constant time implementations of montgomery ladders.
Apr
28
reviewed Approve Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings
Apr
27
reviewed Reviewed Why are there only positive value points on an elliptic curve?
Apr
27
revised Why are there only positive value points on an elliptic curve?
added 79 characters in body
Apr
27
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)
Apr
27
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Working on a prototype implementation, I noticed that my assumptions about how iterated hashes cycle were wrong. I didn't know that a few cycles and their tails dominate.
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
You can't just equate the number of operations with time, you also need to take parallelism into account. (And DJB argues that you can't neglect the cost of memory access circuitry for many attacks either.) With cycle-finding I'd expect the cost of memory to be cheap compared to the cost of all those parallel DES computation circuits. For example such a computer might have ~4 GB of memory and $2^{20}$+ DES circuits, running for ~$2^{36}$ timesteps (where each timestep is one DES invocation).