10,848 reputation
12455
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 8 months
seen 9 hours ago

17h
comment Blum primes [x=3(mod 4)] zero knowledge proof?
"I can, without revealing factors, show that n has two prime factors" -- how? I'm not aware of any way to do this. Using MPC to jointly produce a modulus is the approach that comes closest to achieving this.
1d
comment Are modes of operation algorithms practical?
Kerckhoffs's principle
1d
comment Now that quantum computers have been out for a while, has RSA been cracked?
@MichaelJonathanSimpson When you're worried about quantum computers, larger RSA keys won't offer much peace of mind. The number of required ideal qbits is linear in the key size. With error correction that increase might be steeper, but still not that big. Once a QC can factor a 2048 bit key it will probably only be a few years to factoring a 4096 bit key.
1d
comment Cycles in SHA256
With a blockcipher (which is a permutation), the cycle length would be around $2^{255}$ with a hash the cycle length is around $2^{128}$. But of course these are just statistical values and both shorter and longer cycles exist.
Mar
23
comment What is the best hash for HMAC?
There are only two significant SHA-2 variants, SHA-256 and SHA-512. All the other variants only differ by truncation and have different IVs.
Mar
23
comment Is it safe to use PBEWithMD5AndDES?
If this is really DES and not 3DES then it's very weak.
Mar
22
comment Difference between the TLS cipher suites?
Nobody uses DSS suites/certificates. If you want better performance, go with the elliptic curve equivalent, ECDHE_ECDSA
Mar
21
comment Coding of unsigned int to prevent guessing next ID
Either use a 32 bit blockcipher like Skip32 or use proper format preserving encryption (tricky to implement).
Mar
21
comment Are factorization algorithms parallelizable?
@fkraiem I consider the efficiency of factoring algorithms on-topic for crypto.se.
Mar
21
comment Are factorization algorithms parallelizable?
1) don't use BBS 2) The standard factoring algorithm is the number field sieve. There exists a variant called Batch NFS which at least in theory reduces the average cost for factoring if you attack multiple moduli. But I don't know if it leads to a practical improvement for typical key sizes. I'm also not sure to which degree it can be parallelized.
Mar
21
comment Security of simple Skein PBKDF mentioned in the paper
It's not memory hard and is comparable to PBKDF2. Scrypt and bcrypt are still better.
Mar
21
comment Is it safe to prefix the a key with a known value?
Since HMAC exhibits weird behaviour with variable length keys, I wouldn't really count it as an exception.
Mar
20
comment RC4 , Is it possible to find the key if we know the plaintext and ciphertext?
Only if you use many related keys.
Mar
20
comment How can ECDSA signatures be shortened (to be used as a product key)?
Perhaps they implemented BLS signatures. They only produce 2*n bit signatures for n bits of security, compared with 4*n bit signatures with ECDSA. There are also variants of Schnorr/DSA signatures that only produce 3*n bit signatures.
Mar
20
comment ECDSA for encryption
@chrisdew A hybrid system is the way to go with ECC. The alternative is EC-ElGamal and that's clearly an inferior choice. The overhead for ECIES with AES-GCM over a 256 bit curve is 48 bytes, 32 for the ephemeral public key and 16 for the MAC. Or you could simply use NaCl's Box operation, which is conceptually very similar to ECIES.
Mar
19
comment ECDSA for encryption
ECIES (or something similar) is the way to go. I don't see why AES based authenticated encryption wouldn't be a good fit. Of course reusing a key for encryption and signing is a bit of a risk, but IMO it's an acceptable one.
Mar
18
comment Unable to open old encrypted PKZIP 2.0 files despite having the password
I'm voting to close this question as off-topic because it is not about the functioning of a particular program and not cryptography itself.
Mar
16
comment What is the most light-weight symmetric cipher thats still usefull?
What's your CPU? How much RAM and ROM do you have? How many CPU cycles can you afford for each byte of the message?
Mar
16
comment RSA Decryption from samples
See Dan Boneh - Twenty Years of Attacks on the RSA Cryptosystem Section 4.2 Hastad's Broadcast Attack.
Mar
16
comment RSA Decryption from samples
What's the public exponent? If e=3 decryption is simple (see Watson's answer). If e is bigger than the number of copies, this attack shouldn't work. But lack of proper padding (preferably OAEP) is still a very bad idea.