Reputation
11,923
Next tag badge:
98/100 score
18/20 answers
Badges
1 28 59
Newest
 Constituent
Impact
~198k people reached

May
11
comment How to decrypt a text which is ciphered same length key?
See also: How does one attack a two-time pad (i.e. one time pad with key reuse)?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
sc_clamp makes no sense on encoded points. It operations on scalars.
May
9
comment Why is Triple DES not vulnerable to meet in the middle attacks?
Very similar to the question Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Is your code publicly available?
May
9
comment Point addition and doubling in Ed25519 (ref10)?
If you only need one coordinate of the output, you can convert to montgomery form, compute the scalar multiplication and convert back. You only need your approach if you need both coordinates.
May
9
comment Point addition and doubling in Ed25519 (ref10)?
Why do you want to avoid the conversion to Montgomery for DH? It's a bit slower than using (Y/Z) coordinates in Edwards form due to an additional field inversion, but almost certainly faster than what you're attempting to build. Conversion back to edwards at the end of the scalar multiplication is free, but I didn't do so for compatibility with existing Curve25519 shared secrets.
May
8
comment Decrypt a public encrypted message and Sign a signature, how the math is different?
With RSA you generally use different padding. With other schemes encryption and signing usually have very little in common.
May
7
comment Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?
You have no chance if the malware has been implemented properly.
May
7
comment ECC partially blind signature scheme verification
I'd consider using RSA based blind signatures. It's simple, robust and supports tons of additional features. The main downsides are the lower performance and larger signatures.
May
6
comment Is knowing the private key of RSA equivalent to the factorization of $N$?
If you know $e$, $d$ and $n$, you can efficiently factor $n$. Just knowing $d$ is not enough if $e$ is big.
May
5
comment Does Microsoft use Dual_EC_DRBG by default?
According to wikipedia you introduced DUAL_EC_DRBG in Windows Vista, but your post doesn't mention Vista and Server 2008. What's their status regarding DUAL_EC? Sorry for nitpicking, but I read a few too many carefully worded denials recently. According to imichaelmiers's answer there was a change in the default in a Service Pack for Vista, with both versions (Hash and AES-CTR) considered safe.
May
5
comment Mapping integers to Ed25519 and back again?
You might want to take a look at Elligator 2, but it has some limitations.
May
2
comment Back up an information as $n$ pieces and require exactly $n-1$ to recover it
Search for "erasure coding" and "secret sharing"
May
2
comment Can 64-bit “PRINCEcore” practically be brute forced?
Once you're over the initial development cost of custom hardware, this isn't very expensive. I think it's about as much work as mining a single bitcoin block at the current difficult. Or differently said, it would take the current bitcoin mining network only a few minutes. Should be 10k USD or something of that magnitude.
May
2
comment Why should I use an Initialization Vector (IV) when I have unique keys?
It's more of a multi-target pre-image attack rather than a collision attack. Personally I'd only bother with IVs when they key has "only" 128 bits. For 256 bit keys even those multi target attacks are too far out of reach.
May
1
comment Does not using padding mean a lack of security?
There are two kinds of padding: 1) Padding required by the mode of operation (for CBC but not CTR) 2) Padding that aims to make traffic analysis harder. These kinds of padding should not be confused.
May
1
comment Accelerated hashing on consumer-grade CPU?
Are you hashing many short messages, or few long ones? In the latter case you must use a tree hash to have any hope of parallelization.
Apr
30
comment Why must IV be sent with each packet?
You need a new IV for each message. You can't reuse the last block of the previous message. Doing that caused the BEAST attack against SSL. The assumption behind CBC's chaining is that an attacker can't see part of the ciphertext and then influence later plaintext.
Apr
30
comment How do you test the security of your cipher?
Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors.
Apr
30
comment Why must IV be sent with each packet?
The IV must be different for each message. If you can use an implicit IV, such as a counter you don't need to send it explicitly. (At least with a mode that only needs unique IVs like CTR. For random IVs as in CBC you need some modifications, but in principle this is still possible)