Reputation
14,430
Next tag badge:
102/100 score
17/20 answers
Badges
1 36 76
Newest
 Nice Answer
Impact
~288k people reached

Apr
24
comment Prime factorization
Since factoring a 512 bit semiprime costs about $100, it's clearly more than a standard computer can do in a few hours. Your number has 392 bits, so factoring would be relatively cheap, but I don't know if it'd fall below your limit. If the number has small factors, ECM should be faster than GNFS.
Apr
23
comment Security aspects of using a global values as nonce and additional data for AES?
Strictly speaking, you must never reuse a (key, nonce) pair.
Apr
23
comment How are onetimepads distributed?
Both parties could meet in person and exchange a disk containing the pad. Or perhaps you send a diplomatic courier with the key material in a sealed bag. The annoying key-distribution is one of the reasons why one-time-pads aren't very popular.
Apr
22
comment Can Grover's algorithm be parallelized?
@mikeazo I think I was asking the wrong question. I've changed it a bit, to be closer to what matters for attacks on cryptography.
Apr
22
comment What is the “compression function” in Merkle-Damgård?
Yes. MD is a domain extender which turns a fixed input size hash into a variable input size hash.
Apr
22
comment Super-simple encryption of short strings
1) Why use encryption at all? I'd rather use a lookup table/tokenization. 2) If you want to use crypto, why use format-preserving-encryption? 2) Anonymizing data sets is hard. It's often possible to correlate data from different sources to deanonymize such data.
Apr
22
comment side channel attacks against TDES (compared to AES)
So it wasn't just a timing attack, but a power analysis attack? In that case you're pretty much doomed with any general purpose CPU. If you want to prevent attacks where the attacker has physical access to the device, you should use special purpose hardware designed to make these attacks harder. The choice of cipher matters far less compared to how much effort the hardware designer put into preventing those attacks.
Apr
22
comment side channel attacks against TDES (compared to AES)
I don't think the AES side-channels are as big as you think. If you're referring to DJB's paper, he used a very precise timer on the server to attack AES.
Apr
20
comment what are the NTRU keysize and application in industry ?
NTRU is patented, which has hampered adoption.
Apr
20
comment DHKE choice of private keys
You can apply the same logic to any particular private key. The attacker guessing correctly that your private key is 1 is just as unlikely as the attacker correctly guessing it's another value. 1 isn't special.
Apr
20
comment DHKE choice of private keys
Doesn't a 128 bit exponent result in a 64 bit security level? A 256 bit exponent might be wiser.
Apr
20
comment DHKE choice of private keys
Obviously the shared secret would be the same as the public key if the private key is 1. But I don't see how that's a problem. A good stream cipher occasionally outputs zero bytes as well, in which case the ciphertext byte will equal the plaintext byte.
Apr
20
comment DHKE choice of private keys
I wonder why $1$ is missing in your examples, it looks like a perfectly fine private key to me. I'd choose the private key $x$ to fulfill $0<x<q$ where $q$ is the order of the generator (typically $(p-1)/2$).
Apr
20
comment DHKE choice of private keys
If you forbid $p-1$, shouldn't you also forbid $(p-1)/2$?
Apr
20
comment Is it ever unsafe to compress an EC point?
@poncho Curve25519 has $p \equiv 5 \pmod 8$. P-224 has $p \equiv 1 \pmod 4$. But there are efficient algorithms for computer square-roots in both of those fields.
Apr
20
comment Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
(Twisted) Edwards form point compression shouldn't be covered by a patent, but you can't use it for the NIST curves.
Apr
18
comment Why does applying 56-bit DES twice only give 57 bits of security?
Note that an actual attacker wouldn't create a table with $2^{56}$. They'd use distinguished points/cycle finding to reduce the memory use.
Apr
18
comment Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
@MichaelKjörling Yes. If you use random keys, 3-key 3DES is at least as strong as 2-key 3DES, but it doesn't provide the 168 bits of security we'd expect from an ideal 168 bit cipher. MitM has nearly the same cost against both 2-key and 3-key 3DES. But since "attack" is often defined as "faster than brute-force" and brute-force is slower with a 168 bit key, MitM now counts as an attack. (If you'd allow related-key attacks the 3-key variant would probably end up worse, but related keys are not applicable to well designed protocols, so I didn't mention that in my answer.)
Apr
16
comment Is this a good entropy collector and whitening technique?
What would you use as key for CBC-MAC? In practice a fixed public key should be fine, but means you can't reduce your security to AES being a PRP.
Apr
16
comment RSA modulus (N) from public key and calculating N from p, q not equal
Endianness or sign bits are two common error sources.