Reputation
11,065
Next tag badge:
97/100 score
18/20 answers
Badges
1 24 55
Newest
 Custodian
Impact
~178k people reached

Feb
17
comment Can a properly implemented ed25519 private key with public underlying data be cracked?
There are signature algorithms with either a strictly limited number of signatures (typical hash signatures) or which get weaker as more signatures are generated.
Feb
17
comment Block Ciphers and (Non-)Generic Attacks
A generic attack works against all block-ciphers with a given key and block size.
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
Why would you have to choose a larger field? AFAIK GCM only uses the underlying cipher as stream cipher, so the block size shouldn't matter at all (if it is at least the field size, for smaller blocks a bit of special handling might be required)
Feb
12
comment Prime factorization of RSA modulus
$m^{e_1d_1-e_2d_2}=1$ mod $N$ follows from $m^0=1$ and $e_1d_1-e_2d_2=0 \mod \phi(N)$
Feb
12
comment Prime factorization of RSA modulus
Typically $e$ is the public key, not the private key.
Feb
12
comment Safe and computationally efficient way to verify a curve25519 identity?
You can't achieve meaningful security without at least applying a MAC to the data you send. Unless you have severe performance limitiations, I'd go with authenticated encryption, like the CurveCP protocol does. I recommend to implement CurveCP over TCP (you don't need the tricky flow control part, only the simple crypto part). It's not perfect, but still much better than what you're thinking of.
Feb
12
comment Safe and computationally efficient way to verify a curve25519 identity?
You should use an existing higher level protocol, like CurveCP. You're not ready yet to design your own protocol.
Feb
12
comment Safe and computationally efficient way to verify a curve25519 identity?
1) Authentication always needs to be bound to something. A message or an integrity protected channel. You cannot just authenticate. 2) Your scheme suffers from trivial forwarding attacks where an attacker impersonates the server to learn shared keys. 3) You need to apply some form of MAC, not the key itself. Else an attacker impersonating a server can learn arbitrary shared keys.
Feb
11
comment Current standard for hash function security parameter?
The output size for collision resistance should be twice the security level. So for a 128 bit level, use 256 bit hashes.
Feb
11
comment If its possible to derive the public key from a private key, why can't we go in reverse?
I used additive notation. If you prefer multiplicative notation you'd say it's hard to solve $A=G^a$ for $a$. This problem (with either notation) is the discrete logarithm problem, which is believed to be hard on (the commonly used) finite fields and elliptic curves). DLP is easy in some groups and hard in others. We use those where it's hard, because else this kind of crypto would be trivially broken.
Feb
11
comment Should tweak be unique per message?
That makes little sense. You can still use CBC mode with a tweakable block cipher.
Feb
11
comment Should tweak be unique per message?
A tweakable blockcipher is just a building block. You can use many modes of operation on top, which have varying security properties. If you set the tweak to a constant you can use the normal modes. For some modes you'd use a unique tweak for each block in a message, but reuse the tweak across messages, relying on traditional IVs for different messages.
Feb
11
comment If its possible to derive the public key from a private key, why can't we go in reverse?
The short answer is that there is no (known) efficient algorithm that can solve $A = a G$ for $a$, even when $A$ and $G$ are known.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
You can't hardcode it if you want to support all possible values of $x,z$. Garbage values of $z$ won't match the fixed $c$.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
I guess the new function has to be denoted as $T(x, c) = (y, z)$ where $c$ is a constant. So $T^{-1}$ will give you a $x,c$ pair, but with an invalid $c$.
Feb
11
comment Why can't hashes be reversed with toffoli gates?
I think you need additional inputs with fixed value when rewriting the circuit using toffoli's. When you reverse the circuit you don't get back those fixed values.
Feb
7
comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves?
Concerning the two points with x=9 issue: The Ed25519 paper fixes a point with both x and y coordinates, which when converted to Curve25519 has x=9. I'd choose that point instead of arbitrarily picking one.
Feb
7
comment What are some restrictions when converting Montgomery Curves into Weierstrass Curves?
I don't thinks answers the question fully. I'd also expect answers to "Does such a formula exist for all montgomery curves? Does it work for all points on those curves?" since those are restrictions on which curves can be converted.
Feb
5
comment Practical (and secure) PRGs
Why do you want to use a number-theoretic PRNG in the first place? There are many nice stream ciphers which are faster and stronger.
Feb
4
comment Public-Key Deterministic Encryption : Why does not provide perfect security?
There are no public key schemes that are perfectly secure, deterministic or not. A computationally unbounded attacker can always recover the private key from the public key.