10,282 reputation
12452
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 5 months
seen 2 hours ago

Jun
30
comment Block cipher with key longer than block size
Related questions AES Key Length vs Block Length and AES key/ciphertext space sizes
Jun
30
comment Block cipher with key longer than block size
This will likely be the case for some messages (even if the key is a shorter than the block size), but not for all of them. For a good block cipher for any key-pair $k_0 \neq k_1$ almost all messages will encrypt differently.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
@RickyDemer Hm? Standard groups are random Schnorr groups. The only difference is that they're used by many people.
Jun
30
comment Why use variable p, q, g for Diffie-Hellman?
IMO fixing the group is a good idea. If I were to use finite-field based DH I'd use a standard group, just like I use standard elliptic curves. There are minor advantages in having your own group, but IMO the added complexity isn't worth it.
Jun
29
answered What type of groups does Microsoft's U-Prove use (Schnorr… etc?)
Jun
29
revised How can I use SSL/TLS with Perfect Forward Secrecy?
edited tags
Jun
29
revised Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
edited tags
Jun
29
revised How to communicate by email with forward secrecy and deniability?
edited tags
Jun
29
revised Formal definition of (perfect) forward security/secrecy
edited tags
Jun
29
comment Quantum resistance of Lamport signatures
Security of lamport signatures reduces to the pre-image resistance of the underlying hash function. The best generic quantum algorithm to find pre-images is grover's algorithm with cost $2^{n/2}$.
Jun
29
comment inverse problem about scalar multiplication on elliptic curve
Solving $Q=np$ for $n$ is the discrete logarithm problem and expensive. Solving for $P$ is cheap (assuming the order of the curve is known).
Jun
29
revised inverse problem about scalar multiplication on elliptic curve
edited tags
Jun
29
comment PAK Diffie-Hellman vs. sharing high-entropy key
The problem is how would to generate the shared key without allowing impersonation. If you can do that securely, then go for it. Passwords are just a concession to the feeble human mind.
Jun
29
comment Proof of work for determining whether a number is prime?
@ThePiachu Trial division only works on really small primes since it's cost is exponential in the length of the prime ($2^{n/2}$ trial divisions for an $n$ bit prime). So it scales perhaps up to 160 bits with a lot of work. Good primality tests have polynomial runtime, something like $n^4$. Please read Primality test on wikipedia
Jun
29
comment Proof of work for determining whether a number is prime?
What is the actual problem you're trying to solve? Sounds like an XY problem. Checking if a number is prime is fast (no need to distribute), for factoring there are much faster algorithms than trial divisions and as proof of work this isn't better than partial hash pre-images. So what's the point?
Jun
28
comment ECDSA Compressed public key point back to uncompressed public key point
@ThomasPornin I didn't look into other curve shapes, but at least for Montgomery curves you don't need decompression for DH when you use x/z coordinates.
Jun
28
comment ECDSA Compressed public key point back to uncompressed public key point
For ECDH you probably don't need to uncompress at all. For ECDSA you take the curve equation and solve for the unknown coordinate. The only tricky part is the square-root, which AFAIK can be solved by modular exponentiation.
Jun
28
comment Is my one time pad cipher secure?
@kylek If "suitable for cryptographic use" is enough then you're missing the point of a one-time pad, which is being provably secure by being completely random. If you use pseudo-random pads you could use a stream cipher instead. Just as secure, but much less inconvenient to use.
Jun
27
comment What are the standard procedures in cryptanalysis to analyze unknown ciphertext?
Next time please include essential information in the original question instead of adding it later on. Analyzing pure ciphertext is really hard, but many concrete implementations such as PGP will have a container around the ciphertext, so it's obvious when they were used. Additional context would still be useful, for example do you talk about encrypted emails or encrypted connections?How does the data you captured look? Binary? Base64? Any headers?... With the changes it's probably a better fit for security.SE.
Jun
27
comment What are the standard procedures in cryptanalysis to analyze unknown ciphertext?
The point is that no serious civilian cryptographer does ciphertext only cryptoanalysis. That's a waste of time. You can't break bad ciphers that way, only really really shitty ones. So there are no standard procedures for it.