10,064 reputation
12451
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 8 hours ago

Dec
6
comment Why are these techniques not feasible to crack RSA?
Your last sentence isn't just misleading, it's plain wrong. Calculating $\phi(n)$ and factoring $n$ are equivalent. The RSA problem is about solving $c=m^e \pmod n$ for $m$. While best known way is to factor $n$ and compute $\phi(n)$, it might be possible to solve this equation without learning $\phi(n)$
Dec
6
comment Can insecure algorithms be combined to form a secure algorithm?
But they aim at pseudo-randomness, not collision resistance and they xor the hashes instead of concatenating them.
Dec
6
comment Why are these techniques not feasible to crack RSA?
@AliGajani If you know $\phi(n)$,your technique works. In fact it's how $d$ is computed during RSA key generation. But an attacker does not know $\phi(n)$, so they can't use this technique.
Dec
5
comment counting points not on elliptic curve
Your notation is confusing since you use $a,b$ as curve parameters and as the coordinates of a point.
Dec
5
comment Can cryptocurrency mining devices be used for cryptanalysis?
@HenrickHellström Password hashing with different password guesses is parallel as well. If you had fixed SHA-256 cores and flexible logic between the calls, that could be used for both hashing and mining. But I doubt miners contains those flexible parts required to repurpose them to crack PBKDF2.
Dec
4
comment The real-life meaning of proving over a group that doesn't support the oracle?
An oracle gives an advantage to the attacker. So absence of the oracle shouldn't hurt security. (Though for some schemes, absence of the oracle means that the legitimate user can't be implemented efficiently. For example BLS requires uses cheap DDH to validate the signature.)
Dec
4
comment How can I use SSL/TLS with Perfect Forward Secrecy?
NIST curves are a bit suspicious since they contain large constants chosen without proper application of nothing-up-my-sleeve techniques. But we don't have any idea how such a weakness would work.
Dec
3
comment RSA performance
@Ajit If you were to somehow encrypt a long message with RSA, the performance would decrease linearly with the length of the message. Since RSA is pretty expensive, that'd be rather slow (perhaps 100kB/s). But almost nobody does that (use hybrid encryption instead), and the common RSA standards don't specify how to do so.
Dec
3
comment Why can an RSA signature be authenticated ONLY with the signer's public key?
It doesn't come down to probability if the match is deliberate. For example to claim "I wrote this message, there is my signature on it".
Dec
3
comment Why doesn't this dummy mutual authentication protocol provide mutual authentication?
Another problem is that Bob who received a (R, [R+1]A) pair from Alice, can use that pair to impersonate Alice to any third party.
Dec
3
comment Why doesn't this dummy mutual authentication protocol provide mutual authentication?
You can't simply "authenticate". You need to authenticate something. For example a specific message or connection. Else Eve who receives an incoming connection from Alice might simply open a connection to Bob, ask him for [R]B, send that back to Alice, obtaining [R+1]A and send that to Bob. At that point she has authenticated as Alice to Bob and as Bob to Alice.
Dec
3
comment Why doesn't this dummy mutual authentication protocol provide mutual authentication?
Is [R]B the encryption of R using the key B?
Dec
3
comment Why can an RSA signature be authenticated ONLY with the signer's public key?
One way to prevent this is including the public key in the hashed data. I think Thomas Pornin wrote a paper about these issues: Digital Signatures Do Not Guarantee Exclusive Ownership
Dec
3
comment RSA performance
You shouldn't encrypt the message itself with RSA (at least for long messages). Create a random AES key,encrypt message with that key, encrypt AES key with RSA. That way you only pay the much smaller AES cost for the message, and only a single costly RSA encryption.
Dec
3
comment Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?
Not always, but in practice it will often be even for relatively weak hashes $h_2$. The most important property required of $h_2$ is that preserves at least $2n$ bits of entropy, where $n$ is the target security level. (even that's not sufficient in pathological cases)
Dec
3
comment Using the same RSA keypair to sign and encrypt
Depends on tricky details of the padding scheme you use and your implementation. It'd generally discouraged to reuse keys like that.
Dec
3
comment What is the chance of a collision when using SHA-3?
1) There is no SHA-3 yet. Keccak has won the competition, but some details haven't been specified. 2) That depends on the output size, which you didn't specify. A hash outputs bytes, not characters. 3) Don't hash passwords with SHA-3. Use bcrypt, scrypt or PBKDF2 4) collisions have little relevance to password hashing, what matters is one-wayness or first pre-image resistance.
Dec
2
comment Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
It's ignored because it isn't an attack against the algorithms themselves. It's an attack against the sloppy formulation of security claims in the papers describing those algorithms. Essentially they wrote security claims against classical computers without stating that these only apply to classical computers (which is obvious to any cryptographer). I suspect this is just a product of DJB being pissed that NIST insisted $2^n$ preimage resistance, which cubehash couldn't offer with acceptable performance. Ironically they wanted to lift that requirement after keccak won.
Dec
2
comment What is the function of the secret key “r” in Poly1305?
$r$ being secret is essential. The only point of $s$ is to prevent an attacker from learning $r$.
Nov
30
comment Why is Lamport-Diffie secure?
As far as we know, there there are collision resistant hashes (if necessary we can even weaken that to random prefix collision resistance) which resist quantum computers with slightly larger security parameter.