Reputation
11,556
Next tag badge:
97/100 score
18/20 answers
Badges
1 25 57
Newest
 Informed
Impact
~188k people reached

May
6
comment Is encryption time greater than decryption time?
RSA decryption is much slower than encryption. For AES and DES it should be roughly the same. No clue what DNA is.
May
4
comment Encrypting and Decrypting a 19-digits long BigInteger
Do you need to support any 19 digit integer? Or is the input limited to 64 bits?
May
4
comment What are the vulnerabilities of this homemade encryption algorithm?
I'm voting to close this question as off-topic because it's about breaking a homebrew cipher.
May
4
comment Can I submit an encrypted message to see if its breakable here?
I'm voting to close this question as off-topic because it's about breaking a homebrew cipher.
May
4
comment Can I submit an encrypted message to see if its breakable here?
Nowadays we expect much more of ciphers. In particular they much not leak any information about the plaintext, apart from its length. It must be secure even if the attacker knows (or even chooses) part of the plaintext, etc. No attack must be significantly faster that brute-force. It shouldn't be limited to letters, but should work with arbitrary bytes.
May
2
comment Decypting a Stream Cipher
You need to find the multiplicative inverse of a mod m. Which exists if GCD(a, m)=1.
May
2
comment Can Winternitz be easily converted to a many-time encryption scheme?
@petro444 You can use hashes in CTR mode, but for most hashes that will have bad performance, since they're optimized for consuming data, not for outputting data. Salsa20 and ChaCha are stream ciphers built with a hash at their core.
May
1
comment Can Winternitz be easily converted to a many-time encryption scheme?
Unfortunately I can't find the paper with the impossibility proof.
May
1
comment SHA-512 partial preimage
@StevePeltz Average != median.
May
1
comment Why are there no OTP ciphers?
@VincentAdvocaat The current expectation is that QCs: 1) halve the effective key length of symmetric ciphers (so 256 bit ciphers should still be fine). 2) totally break RSA, DH/DSA and ECC 3) Only offer a small advantage (similar to the one against symmetric crypto) against certain more experimental asymmetric algorithms. So the common conclusion isn't switching to OTPs, but to develop those alternative asymmetric algorithms until they're ready for production.
Apr
30
comment encryption system ElGamal
@fgrieu I'd guess it's just there for some notational reason that doesn't matter in practice. To distinguish the field element from the integer or its representation or something like that.
Apr
30
comment encryption system ElGamal
Have you read the wikipedia article for ElGamal encryption? At which step did you get stuck?
Apr
29
comment What can cause similar MD5 hashes
1) Are you sure you're using correctly implemented MD5? 2) Can you post the hashing code?
Apr
29
comment Why does the ElGamal signature have the specific form that it does?
Probably the first working formula ElGamal found. There are other formulas which work as well (e.g Schnorr and DSA).
Apr
29
comment Yubico's take on U2F key wrapping
Are you using the HMAC key as second parameter?
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong I don't get your point. The cost of multiplication is data independent for most CPUs. So as long as you implement your code without secret dependent array lookups and secret dependent branches, you should trivially end up with a side channel resistant implementation.
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong But montgomery curves have nice properties which allow fast constant time implementations of montgomery ladders.
Apr
27
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)
Apr
27
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
Working on a prototype implementation, I noticed that my assumptions about how iterated hashes cycle were wrong. I didn't know that a few cycles and their tails dominate.
Apr
26
comment Can cycle finding techniques reduce the memory usage of the MitM attack against 2DES and 3DES?
You can't just equate the number of operations with time, you also need to take parallelism into account. (And DJB argues that you can't neglect the cost of memory access circuitry for many attacks either.) With cycle-finding I'd expect the cost of memory to be cheap compared to the cost of all those parallel DES computation circuits. For example such a computer might have ~4 GB of memory and $2^{20}$+ DES circuits, running for ~$2^{36}$ timesteps (where each timestep is one DES invocation).