Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Jul
18
comment Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”?
I'm closing this because it's not a genuine question about cryptography. It's a post designed to make fun of ridiculous marketing claims, just phrased as a question. If you enjoy debunking bad crypto, you might want to create a blog, similar to Bruce Schneier's doghouse.
Jul
18
comment Deterministic ECDSA signatures?
@DrLecter The OP wants verifiably deterministic signatures and already linked that RFC.
Jul
15
comment Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?
csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm might be relevant.
Jul
15
comment What good is a hash accompanying a program?
Related question on security.se: Does hashing a file from an unsigned website give a false sense of security?
Jul
15
comment Ephemeral Diffie-Hellman in a symmetric crypto context
Does the shared secret have high entropy?
Jul
15
comment AES-CBC pre-determined IV vs. null IV
Note that symmetric crypto means that key generators are possible. Using asymmetric keys only cracks but not key generators are possible, but they produce longer product keys.
Jul
14
comment how to implement order preserving encryption except cryptdb
Cryptdb is an implementation, not an algorithm. Are you really looking for an algorithm, or do you want an implementation? AFAIK cryptdb has an accompanying paper describing the algorithms it uses.
Jul
14
comment Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?
That approach is secure. Perhaps there are even some SHA-3 candidates which use this approach, though I can't think of one.
Jul
14
comment Stern identification scheme to signature scheme
Related: Fiat–Shamir heuristic
Jul
14
comment Massey-Omura three pass protocol prime modulus share
I'd guess that it works like DH in that regard, you can use a shared public modulus, as long as it's big enough. 2048 bits or so.
Jul
13
comment Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'
The order of the field is $p=2^{255}-19$. Sometimes it's convenient to reduce modulo $2p = 2^{256}-38$
Jul
12
comment Which concrete applications benefit from Oblivious RAM constructions?
It'd be nice if you could include a short summary in your answer.
Jul
12
comment How to compute two EC point multiplication?
The OP can define $*$ to mean whatever they want it to mean. They chose to define it as the solution of the CDH problem.
Jul
11
comment Why Elliptic Curves?
Related questions: Why can ECC key sizes be smaller than RSA keys for similar security?, Trying to better understand the failure of the Index Calculus for ECDLP
Jul
11
comment How is an epsilon of 1/1000 non-negligible?
Consider an attacker who induces your client to send its password 1000 times. They'll be able to recover most of the password by combining the information learned from each transmission. This is similar to the attacks against RC4 in TLS.
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Pohlig-Hellman?
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Related: SRA, pohlig-hellman, three-pass protocol
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM Xor is not secure as commutative encryption.
Jul
10
comment Why we need ECDSA when we have ECDH?
You might be interested in BLS signatures, they're essentially Diffie-Hellman between the message hash interpreted as group element and the signers key. But they require a group in which the decisional Diffie-Hellman problem is easy to verify the signature.
Jul
7
comment What is the difference between a PRF and a PRF+?
Looks identical to HKDF-Expand.