Reputation
12,178
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~204k people reached

Mar
18
comment Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?
Mathematicians don't care how you call the basic operation. We commonly call it addition, but calling it multiplication is just as valid.
Mar
18
comment How do the following new (2013) ECC curves compare in security or efficiency?
The larger the curves the slower (but stronger) they are.
Mar
17
comment Is this an acceptable implementation of ARC4 encryption for my system?
@traxonja If you want authentication and encryption you could consider AES-CCM.
Mar
16
comment Elliptic Curves of different forms
Why do you want to use a montgomery/edwards curve if you then proceed to perform weierstrass form operations on them? To take advantage of montgomery form you need to use differential addition with an appropriate ladder. The whole point of supporting montgomery ladders is that you use them.
Mar
14
awarded  Nice Answer
Mar
13
comment Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements?
Apart from rigidness those "weaknesses" are features of montgomery/edwards curves. Those features don't gain you anything if you use weierstrass form in your implementation.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
@JohannesErnst I'd rather encapsulate it, like {data={...}, sigs=[{sig1}, {sig2}]}. If one signature needs to be signed, the outer signature can encapsulate the previous one, else add them to the array.
Mar
13
comment Are there use cases where a signature itself needs to be signed?
You should take a look at JSON Web Signature (JWS). I didn't read it myself, so I can't vouch for its quality.
Mar
13
revised Why does SHA-1 have 80 rounds?
added 149 characters in body
Mar
13
comment counter to indicate hotp count
@RichieFrame Shouldn't matter.
Mar
13
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I'd rather start with a Curve25519/Ed25519 and replace the field arithmetic operations. Converting to weierstrass misses the point of edwards/montgomery curves. Montgomery addition is differential, so you can't simply reuse the BC code for weierstrass scalar multiplication. Finding a $F_{521}$ implementation shouldn't be too hard, considering it's also used in NIST-P521.
Mar
13
revised Why does SHA-1 have 80 rounds?
added 11 characters in body; edited tags; edited title
Mar
13
answered Why does SHA-1 have 80 rounds?
Mar
13
comment How does the key size per data bit influence the security?
@Marste 1) TLS in its typical use doesn't bother changing the key during the lifetime of a connection 2) Changing the key within a connection strengthens forward secrecy 3) More samples don't help brute-force, but might aid cryptoanalysis. There is also a block size dependent limit, which is only a couple of GB for 64 bit blocks. Older protocols worry about these issues since we didn't have AES yet. Nowadays it's less of a concern.
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
I suspect this library only supports weierstrass form, so you'd need to either convert (bad idea IMO) or implement a custom EccPoint class with edwards arithmetic. But last time I checked BC C# had quite bas ECC implementations. Not resistant to side channel attacks and slow as hell (using affine coordinates).
Mar
12
comment How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?
FpCurve is for prime fields, F2mCurve for binary fields. This field is prime, so you need to choose FpCurve.
Mar
12
revised Where did Martin Hellman acknowledge Ralph Merkle's contribution to public-key cryptography?
added 62 characters in body; edited tags
Mar
12
awarded  Nice Question
Mar
11
comment Is there a flaw in whole disk encryption vs volume or folder encryption?
Yes, you're wrong. Modern cryptography doesn't allow an attacker to learn the key given (plaintext, ciphertext) pairs. This is a "known plaintext" attack.
Mar
10
comment I need a 64-bit cryptographic hash for 96 bits of data
But you can't really get "very high" collision resistance with a 64 bit hash. For example if you have 4 billion entries, collisions become likely, but you can't neglect them with only a few million entries.