Reputation
11,701
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~190k people reached

Apr
22
awarded  Informed
Apr
21
awarded  Enlightened
Apr
21
awarded  Nice Answer
Apr
21
revised Is SSL getting faster because it's getting less secure?
added 101 characters in body
Apr
21
reviewed No Action Needed Why rogued certificate from hash collision is harmful
Apr
21
reviewed No Action Needed Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
Apr
20
comment what are the NTRU keysize and application in industry ?
NTRU is patented, which has hampered adoption.
Apr
20
comment DHKE choice of private keys
You can apply the same logic to any particular private key. The attacker guessing correctly that your private key is 1 is just as unlikely as the attacker correctly guessing it's another value. 1 isn't special.
Apr
20
comment DHKE choice of private keys
Doesn't a 128 bit exponent result in a 64 bit security level? A 256 bit exponent might be wiser.
Apr
20
comment DHKE choice of private keys
Obviously the shared secret would be the same as the public key if the private key is 1. But I don't see how that's a problem. A good stream cipher occasionally outputs zero bytes as well, in which case the ciphertext byte will equal the plaintext byte.
Apr
20
comment DHKE choice of private keys
I wonder why $1$ is missing in your examples, it looks like a perfectly fine private key to me. I'd choose the private key $x$ to fulfill $0<x<q$ where $q$ is the order of the generator (typically $(p-1)/2$).
Apr
20
comment DHKE choice of private keys
If you forbid $p-1$, shouldn't you also forbid $(p-1)/2$?
Apr
20
comment Is it ever unsafe to compress an EC point?
@poncho Curve25519 has $p \equiv 5 \pmod 8$. P-224 has $p \equiv 1 \pmod 4$. But there are efficient algorithms for computer square-roots in both of those fields.
Apr
20
comment Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
(Twisted) Edwards form point compression shouldn't be covered by a patent, but you can't use it for the NIST curves.
Apr
18
comment Why does applying 56-bit DES twice only give 57 bits of security?
Note that an actual attacker wouldn't create a table with $2^{56}$. They'd use distinguished points/cycle finding to reduce the memory use.
Apr
18
comment Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
@MichaelKjörling Yes. If you use random keys, 3-key 3DES is at least as strong as 2-key 3DES, but it doesn't provide the 168 bits of security we'd expect from an ideal 168 bit cipher. MitM has nearly the same cost against both 2-key and 3-key 3DES. But since "attack" is often defined as "faster than brute-force" and brute-force is slower with a 168 bit key, MitM now counts as an attack. (If you'd allow related-key attacks the 3-key variant would probably end up worse, but related keys are not applicable to well designed protocols, so I didn't mention that in my answer.)
Apr
16
comment Is this a good entropy collector and whitening technique?
What would you use as key for CBC-MAC? In practice a fixed public key should be fine, but means you can't reduce your security to AES being a PRP.
Apr
16
comment RSA modulus (N) from public key and calculating N from p, q not equal
Endianness or sign bits are two common error sources.
Apr
15
revised Use cases for “online” authenticated encryption?
added 24 characters in body
Apr
14
comment Are there equivalent IVs in DES/CBC?
The first block (8 bytes) should differ if you use another IV.