9,834 reputation
12450
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 3 months
seen 55 mins ago

Jul
1
comment How much stronger is RSA-2048 compared to RSA-1024?
@woliveirajr RSA-1024 is far weaker than that. AFAIK it's currently borderline feasible to break it for state level adversaries with a few billion to spend. If it's not breakable now, 10 years from now it should be.
Jul
1
comment What does NSA mean by 'Analyzable'?
The algorithms are similar to existing blockciphers, so cryptographers know how to analyze them. Being easy to analyze them is a good thing, because it becomes less likely that somebody suddenly find a new and much better attack.
Jul
1
revised RSA by hand - did I do something wrong? (c = m on encryption)
added 24 characters in body
Jul
1
reviewed Approve suggested edit on Seemingly simple decryption question
Jun
30
comment Block cipher with key longer than block size
Related questions AES Key Length vs Block Length and AES key/ciphertext space sizes
Jun
30
comment Block cipher with key longer than block size
This will likely be the case for some messages (even if the key is a shorter than the block size), but not for all of them. For a good block cipher for any key-pair $k_0 \neq k_1$ almost all messages will encrypt differently.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
@RickyDemer Hm? Standard groups are random Schnorr groups. The only difference is that they're used by many people.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
IMO fixing the group is a good idea. If I were to use finite-field based DH I'd use a standard group, just like I use standard elliptic curves. There are minor advantages in having your own group, but IMO the added complexity isn't worth it.
Jun
29
answered What type of groups does Microsoft's U-Prove use (Schnorr… etc?)
Jun
29
revised How can I use SSL/TLS with Perfect Forward Secrecy?
edited tags
Jun
29
revised Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
edited tags
Jun
29
revised How to communicate by email with forward secrecy and deniability?
edited tags
Jun
29
revised Formal definition of (perfect) forward security/secrecy
edited tags
Jun
29
comment Quantum resistance of Lamport signatures
Security of lamport signatures reduces to the pre-image resistance of the underlying hash function. The best generic quantum algorithm to find pre-images is grover's algorithm with cost $2^{n/2}$.
Jun
29
comment inverse problem about scalar multiplication on elliptic curve
Solving $Q=np$ for $n$ is the discrete logarithm problem and expensive. Solving for $P$ is cheap (assuming the order of the curve is known).
Jun
29
revised inverse problem about scalar multiplication on elliptic curve
edited tags
Jun
29
comment PAK Diffie-Hellman vs. sharing high-entropy key
The problem is how would to generate the shared key without allowing impersonation. If you can do that securely, then go for it. Passwords are just a concession to the feeble human mind.
Jun
29
comment Proof of work for determining whether a number is prime?
@ThePiachu Trial division only works on really small primes since it's cost is exponential in the length of the prime ($2^{n/2}$ trial divisions for an $n$ bit prime). So it scales perhaps up to 160 bits with a lot of work. Good primality tests have polynomial runtime, something like $n^4$. Please read Primality test on wikipedia
Jun
29
comment Proof of work for determining whether a number is prime?
What is the actual problem you're trying to solve? Sounds like an XY problem. Checking if a number is prime is fast (no need to distribute), for factoring there are much faster algorithms than trial divisions and as proof of work this isn't better than partial hash pre-images. So what's the point?
Jun
28
comment ECDSA Compressed public key point back to uncompressed public key point
@ThomasPornin I didn't look into other curve shapes, but at least for Montgomery curves you don't need decompression for DH when you use x/z coordinates.