Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

Nov
25
comment OTP from Sony BIOS password recover
With a 64 bit modulus you can simply factor via trial division at cost $2^{32}$.
Nov
25
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
My mistake, I wanted to say "at a 128 bit security level". 64 bits of security as you suggest is rather weak.
Nov
25
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
If the order has 128 bits, a normal EC schnorr signature takes 64 bytes and a hashed schnorr signature still costs 48.
Nov
24
revised Recovering El Gamal secret key from signatures
added 1 character in body; edited title
Nov
24
comment Recovering El Gamal secret key from signatures
When the nonce is reused you can simply solve those two equations for the private key.
Nov
24
revised Recovering El Gamal secret key from signatures
deleted 1 character in body; edited tags
Nov
20
comment Are all binary-additive stream ciphers reciprocal?
Note that this isn't the case for CFB mode, which is a xor based stream cipher but doesn't fulfill your particular definition.
Nov
20
revised What happens when cbc+hmac get a replay attack?
added 1 character in body; edited tags; edited title
Nov
19
comment special public keys and modulo n
You need distinct primes. Also if you're using CRT you'll need to change your code a bit to take advantage of the multi prime speedup.
Nov
19
answered What happens when cbc+hmac get a replay attack?
Nov
19
comment Modes of encryption for hard drives?
CTR is not a good idea since an attacker who sees two versions of a block can attack it with the usual many-time-pad attacks. This can happen due to SSD wear leveling.
Nov
19
comment Modes of encryption for hard drives?
XTS is one of the most popular modes. See Disk encryption theory on wikipedia.
Nov
19
answered Where have all the cypherpunks gone?
Nov
19
comment DHE key exchange. Is it really secure?
You're underestimating what "very big" means. No conventional computer will ever be able to count to $2^{256}$ and that doesn't even consider storing that much.
Nov
18
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
If the modulus is so large that you don't find an e via trival division in less than a minute, it's so big that you won't be able to do the rest of RSA. For example no four-digit number is co-prime to 3, 5, 7, 11 and 13.
Nov
18
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
You can factor phi and choose a prime that isn't such a factor. Slow for properly sized numbers, trivial for something like 40. But even with trial division using 3, 5, 7 etc. you will find a divisor within a minute as long as n is small. Inverting e will certainly take longer than finding e.
Nov
18
comment How many characters per block in an El Gamal ECC cryptosystem?
1) Why would you use ElGamal over ECIES? It's already dubious choice for short messages, but using ElGamal in an ECB like mode on long messages is plain insane. 2) AFAIK ElGamal needs padding to be secure, so you can't fill the whole block with actual data.
Nov
14
revised How many of primitive point on the elliptic curve?
added 8 characters in body
Nov
12
comment Are modified implementations of cryptographic algorithms a good idea?
1) The DES link goes to DualEC as well. 2) I wouldn't say that the DualEC backdoor was revealed by snowden, only confirmed.
Nov
11
comment Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
"and that it is thus pointless to have the key wider than half the hash's size" I disagree with that. Larger keys can prevent multi-target attacks against the key.