Reputation
12,188
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~205k people reached

Jul
14
comment Massey-Omura three pass protocol prime modulus share
I'd guess that it works like DH in that regard, you can use a shared public modulus, as long as it's big enough. 2048 bits or so.
Jul
13
comment Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'
The order of the field is $p=2^{255}-19$. Sometimes it's convenient to reduce modulo $2p = 2^{256}-38$
Jul
12
comment Which concrete applications benefit from Oblivious RAM constructions?
It'd be nice if you could include a short summary in your answer.
Jul
12
comment How to compute two EC point multiplication?
The OP can define $*$ to mean whatever they want it to mean. They chose to define it as the solution of the CDH problem.
Jul
11
comment Why Elliptic Curves?
Related questions: Why can ECC key sizes be smaller than RSA keys for similar security?, Trying to better understand the failure of the Index Calculus for ECDLP
Jul
11
comment How is an epsilon of 1/1000 non-negligible?
Consider an attacker who induces your client to send its password 1000 times. They'll be able to recover most of the password by combining the information learned from each transmission. This is similar to the attacks against RC4 in TLS.
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Pohlig-Hellman?
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
Related: SRA, pohlig-hellman, three-pass protocol
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM Xor is not secure as commutative encryption.
Jul
10
comment Why we need ECDSA when we have ECDH?
You might be interested in BLS signatures, they're essentially Diffie-Hellman between the message hash interpreted as group element and the signers key. But they require a group in which the decisional Diffie-Hellman problem is easy to verify the signature.
Jul
7
comment What is the difference between a PRF and a PRF+?
Looks identical to HKDF-Expand.
Jul
6
comment Can I reduce the MAC size in TLS?
If you want short MACs, use HMAC. GHash is quite fragile when used with short MACs, I certainly wouldn't go below 80 bits with GHash.
Jul
5
comment How to choose McEliece's parameters?
The paper Daniel J. Bernstein, Tung Chou, and Peter Schwabe: McBits: fast constant-time code-based cryptography lists a bunch of parameterizations as well. Since the paper is from 2013, the security estimates should take the attacks you mentioned into account.
Jul
5
comment space complexity of quantum collision search
Related paper Daniel J. Bernstein. "Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete?" Workshop Record of SHARCS'09: Special-purpose Hardware for Attacking Cryptographic Systems.
Jul
5
comment Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
SIV mode might be interesting for you.
Jul
5
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
Interesting essay: Boaz Barak - Structure vs. Combinatorics in Computational Complexity
Jul
5
comment What informal indicators exist for estimating the computational infeasibility of cryptographic problems?
Related question How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
Jul
5
comment What are the advantages of using OFB (Output Feedback Mode)?
Could you add a reference for CTR having better security bounds?
Jul
4
comment What are the advantages of using OFB (Output Feedback Mode)?
CBC and CFB decryption are parallelizable, so the speed advantage of CTR should only apply to encryption, not decryption.
Jul
4
comment Logjam-style attack on Factoring?
There is an technique called Batch NFS but I don't know about the details.