CodesInChaos
Reputation
14,465
102/100 score
 Jun 28 comment Does collision resistance imply (or not) second-preimage resistance? A sponge with capacity $n$ is another example. This one is important since NIST considered having SHA-3 with only $2^{n/2}$ preimage resistance. Jun 28 comment Does collision resistance imply (or not) second-preimage resistance? The only thing I can think of is that we usually expect $2^n$ second pre-image resistance, whereas collision resistance is limited to $2^{n/2}$. So from collision resistance we can only prove $2^{n/2}$ second preimage resistance, not the stronger bound we'd like. Jun 28 comment Does collision resistance imply (or not) second-preimage resistance? Please provide a link to the claim that there are collision resistant but not second-preimage resistant hashes. Jun 26 answered Combining Random Hashes - avoiding collisions and ensuring randomness Jun 26 comment Combining Random Hashes - avoiding collisions and ensuring randomness You should write a bit more about the problem you want to solve. What your inputs are, what the outputs should be. What you want to guarantee etc. Your answer is mostly about the problems you encountered with your approach. I suspect that the best solution throws most of that approach away, replacing it by a single standard crypto function. Jun 26 comment Combining Random Hashes - avoiding collisions and ensuring randomness 4) You say the hash should be very fast. Can you give any numbers? 5) All your inputs have exactly 64 bits. Did I understand that correctly? 6) Do you actually need a hash? Perhaps a keyed permutation (i.e. a 64 bit block cipher) is more appropriate? Permutations have no collisions by definition. Jun 26 comment Combining Random Hashes - avoiding collisions and ensuring randomness 1) It's almost always better to choose a single good hash rather than combining multiple hashes. 2) Use a modern crypto hash. 3) With 64 bit hashes, you only get 32 bits of collision resistance. So in the cryptographic sense, you don't get any practical collision resistance. Even pre-image resistance is rather low at 64 bits. Jun 25 revised Is there a way to compress multiple signatures of the same data? added 19 characters in body Jun 25 comment What is the quantum-resistant signature scheme with the smallest signature + pubkey? Isn't the security level of 128 bit hashes just 64 bits since the Grover reduces the pre-image resitance? Jun 24 comment Minimum length of PKI key for signature 1) If you care about key size, don't use RSA or DSA. ECC has much smaller keys. 2) Key size by itself is meaningless since it can be trivially reduced, increasing the signature size by the same amount. Do you actually care about the sum of the size of key and signature? Jun 24 comment Minimum length of PKI key for signature Your question says RSA, the tags say DSA. Jun 24 comment What is the quantum-resistant signature scheme with the smallest signature + pubkey? @RickyDemer eBACs lists a fast Ed25519 implementation at 170k CPU cycles. Most implementations are closer to a million CPU cycles. So 600 calls to a compression function should be in the right ballpark, probably even faster than ECC if you choose a fast hash function. Jun 24 answered Is there a way to compress multiple signatures of the same data? Jun 24 comment What is the quantum-resistant signature scheme with the smallest signature + pubkey? @RickyDemer ECDSA sigs use 4x the security level and public keys 2x the security level. So total of public key and signature is around 100 bytes. Jun 24 awarded Good Answer Jun 23 revised Fastest random number generator Fixed link Jun 23 comment Fastest random number generator Why do you care? It's not like you need more than 256 bits of true random data to seed a great PRNG, which can exceed 10 Gbit/s on a modern CPU. Jun 23 revised Are poly1305 authenticators distinguishable from random data? deleted 22 characters in body Jun 20 comment How big an RSA key is considered secure today? The "do not cost significant performance penalty" depends very much on context. For email that may be true since you usually don't receive several emails per second. For many other contexts, such as SSL, several hundred milliseconds of decryption time for a single handshake are not acceptable. The other big problem is that many RSA implementations do not support such large keys. Jun 19 comment Is a 1024-bit DSA key considered safe? AFAIK a DSA cracker requires a few hundred times the RAM of an RSA cracker, so I'd assume that cracking a DSA key is a few hundred times more expensive than cracking an RSA key of the same size. Further evidence towards DSA being stronger is that the largest solved discrete logarithms over prime fields are smaller than the largest factored semi-primes.