Reputation
12,178
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~204k people reached

1d
comment point addition in NaCl/libsodium (Curve25519)
NaCl isn't an ECC library, it only offers higher level operations like key-exchange and signatures and doesn't have point addition in its public API. You should be able to find an edwards form point addition function in its Ed25519 implementation.
1d
comment Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem
Related problem: Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?
Jul
23
comment what is the best Encryption algorithm to encrypt real time voice
Unless you're using very low power hardware, performance shouldn't matter much since voice needs <10kB/s. I'd use UDP and encrypt each packed separately using authenticated encryption. AES-GCM and Salsa20Poly1305 are popular choices.
Jul
22
comment Question about the key in RC4
@lena What's your target hardware? The relative performance of ciphers varies a lot between different CPUs.
Jul
19
comment Why don't use random padding in RSA?
AFAIK what Yehuda described is called RSA KEM. I believe it comes with a pretty strong security proof.
Jul
18
comment How is an epsilon of 1/1000 non-negligible?
1) This question is about what it means for an attacker's advantage to be negligible. Your answer doesn't address that at all. 2) Exploiting a weak PRNG to factor an RSA modulus generated by it isn't related to brute-force. 3) If you're referring to the "many moduli have a prime in common" problem, that was caused by very badly seeded PRNGs outputting identical data of several hundred bits for the first request of random data. This is unrelated to small biases.
Jul
18
comment Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”?
@mikeazo Should I trust CipherCloud? has been closed and deleted. While this question isn't as as non constructive, it still has the "I want to criticize that product but must do it disguised as a question" trait.
Jul
18
comment Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”?
I'm closing this because it's not a genuine question about cryptography. It's a post designed to make fun of ridiculous marketing claims, just phrased as a question. If you enjoy debunking bad crypto, you might want to create a blog, similar to Bruce Schneier's doghouse.
Jul
18
comment Deterministic ECDSA signatures?
@DrLecter The OP wants verifiably deterministic signatures and already linked that RFC.
Jul
15
comment Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?
csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm might be relevant.
Jul
15
comment What good is a hash accompanying a program?
Related question on security.se: Does hashing a file from an unsigned website give a false sense of security?
Jul
15
comment Ephemeral Diffie-Hellman in a symmetric crypto context
Does the shared secret have high entropy?
Jul
15
comment AES-CBC pre-determined IV vs. null IV
Note that symmetric crypto means that key generators are possible. Using asymmetric keys only cracks but not key generators are possible, but they produce longer product keys.
Jul
14
comment how to implement order preserving encryption except cryptdb
Cryptdb is an implementation, not an algorithm. Are you really looking for an algorithm, or do you want an implementation? AFAIK cryptdb has an accompanying paper describing the algorithms it uses.
Jul
14
comment where to store the salt for “crypto_pwhash” in a web application with no local storage
@mikeazo I think this question would have been fine on crypto.se as well.
Jul
14
comment Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?
That approach is secure. Perhaps there are even some SHA-3 candidates which use this approach, though I can't think of one.
Jul
14
comment Stern identification scheme to signature scheme
Related: Fiat–Shamir heuristic
Jul
14
comment Massey-Omura three pass protocol prime modulus share
I'd guess that it works like DH in that regard, you can use a shared public modulus, as long as it's big enough. 2048 bits or so.
Jul
13
comment Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'
The order of the field is $p=2^{255}-19$. Sometimes it's convenient to reduce modulo $2p = 2^{256}-38$
Jul
12
comment Which concrete applications benefit from Oblivious RAM constructions?
It'd be nice if you could include a short summary in your answer.