CodesInChaos
Reputation
12,269
90/100 score
 Feb 11 comment Why can't hashes be reversed with toffoli gates? I think you need additional inputs with fixed value when rewriting the circuit using toffoli's. When you reverse the circuit you don't get back those fixed values. Feb 7 comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves? Concerning the two points with x=9 issue: The Ed25519 paper fixes a point with both x and y coordinates, which when converted to Curve25519 has x=9. I'd choose that point instead of arbitrarily picking one. Feb 7 comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves? I don't thinks answers the question fully. I'd also expect answers to "Does such a formula exist for all montgomery curves? Does it work for all points on those curves?" since those are restrictions on which curves can be converted. Feb 6 revised Computationaly hard detokenization algorithm for credit card numbers edited title Feb 5 revised Why does a one-time-pad key have to be at least as long as a message? edited title Feb 5 comment Practical (and secure) PRGs Why do you want to use a number-theoretic PRNG in the first place? There are many nice stream ciphers which are faster and stronger. Feb 4 comment Public-Key Deterministic Encryption : Why does not provide perfect security? There are no public key schemes that are perfectly secure, deterministic or not. A computationally unbounded attacker can always recover the private key from the public key. Feb 3 comment Is there a technique to confirm that a given large integer value is a product of two primes? Can you add a bit of information about that ZKP? Jan 31 comment Why does a perfect secrecy can be achieved when decryption correctness is not totally required? You can omit part of the information from the output and guess them. Those guesses will be incorrect sometimes. This boils down to using lossy compression before encrypting. Jan 31 comment How do institutions like banks do RSA with big primes? 1) CRT is only a factor 4 speedup. The OP has trouble understanding why modular exponentiation has anywhere near acceptable performance, a factor 4 is irrelevant in this context. 2) Larger devices will use CRT as well. It's just as nice on a large x86/AMD64 as it is on a constrained device. Jan 31 comment Is it ok to send part of digital signature if we have bandwidth constraints? What's the difference between this question, and your other one? How to specify last t bits are only sent when a signature is sent? Jan 31 revised implication of tweak on bruteforcing a block cipher added 23 characters in body Jan 31 comment How to specify last $t$ bits are only sent when a signature is sent? There are short MACs (but even they need 64 bits for a decent level of securiy), but even BLS signatures need 2x the security level. One can use proof-of-work to shave of a 20 bits or so. Jan 30 comment Random numbers for Rabin-Miller primality tests @PnD You should use a well seeded CSPRNG, not a mersenne twiser. The seeding part is essential, /dev/urandom is the minimum quality you should accept as seed. Jan 30 comment How do institutions like banks do RSA with big primes? You reduce modulo n after each multiplication. You only need about 1000 squaring and 1000 multiplications (on 1000 bit numbers) when you use square-and-multiply to compute the exponentiation. So the whole thing takes about 1ms total. Jan 30 comment How do institutions like banks do RSA with big primes? A computer can do a few billion multiplications per second. So them being able to multiply 1000 bit numbers quickly shouldn't be a big surprise. One 1000 bit multiplication takes ~1000 32 bit multiplications or ~250 64 bit multiplications. Not that much. Jan 30 comment How is HKDF-Expand better than a simple hash? It's more flexible. Allows longer outputs and different strings to identify different outputs. Jan 30 comment Derive both MAC and AES keys from same PBKDF2? Actually they do help you. Simply use PRK, info and L as input and check if OKM matches. But extract is a one liner, simply call HMAC(salt, ikm). Jan 30 comment Derive both MAC and AES keys from same PBKDF2? I just remembered that I actually implemented HKDF in C# a couple of months ago: gist.github.com/CodesInChaos/8710228 Jan 30 comment Best way to get 32 bytes from PBKDF2 One simple workaround is deriving a 20 byte master key with expensive PBKDF2, and then applying PBKDF2 with 1 iteration and long output to it. As another simple technique applicable when you only need 32-64 bytes, you can simply hash the output of PBKDF2 once with SHA256 or SHA512 to expand it.