Reputation
13,641
Next tag badge:
99/100 score
17/20 answers
Badges
1 34 70
Impact
~260k people reached

Nov
19
comment DHE key exchange. Is it really secure?
You're underestimating what "very big" means. No conventional computer will ever be able to count to $2^{256}$ and that doesn't even consider storing that much.
Nov
18
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
If the modulus is so large that you don't find an e via trival division in less than a minute, it's so big that you won't be able to do the rest of RSA. For example no four-digit number is co-prime to 3, 5, 7, 11 and 13.
Nov
18
comment Is there a way to systematically calculate the public exponent $e$ in RSA?
You can factor phi and choose a prime that isn't such a factor. Slow for properly sized numbers, trivial for something like 40. But even with trial division using 3, 5, 7 etc. you will find a divisor within a minute as long as n is small. Inverting e will certainly take longer than finding e.
Nov
18
comment How many characters per block in an El Gamal ECC cryptosystem?
1) Why would you use ElGamal over ECIES? It's already dubious choice for short messages, but using ElGamal in an ECB like mode on long messages is plain insane. 2) AFAIK ElGamal needs padding to be secure, so you can't fill the whole block with actual data.
Nov
12
comment Are modified implementations of cryptographic algorithms a good idea?
1) The DES link goes to DualEC as well. 2) I wouldn't say that the DualEC backdoor was revealed by snowden, only confirmed.
Nov
11
comment Attacks of the MAC construction $\mathcal{H}(m||k)$ for common hashes $\mathcal{H}$?
"and that it is thus pointless to have the key wider than half the hash's size" I disagree with that. Larger keys can prevent multi-target attacks against the key.
Nov
10
comment what is SALSA20 Nonce and its requirements
Related question Why does the crypto_box functionality in NaCl library exposes the nonce to the programmer
Nov
7
comment What is the value of Q such that Q|P-1 where P is a prime number?
Assuming this is about generating a finite field with a subgroup of order Q, we usually choose Q first, then choose a r such that P=Q*r+1 with P of appropriate size. Repeat with different Q or r until P is prime. That way you don't need to do any factoring. For Diffie-Hellman we often choose r=2 and vary Q, for signatures fixing Q and varying r can be preferable.
Nov
5
comment What is more secure, a ciphertext encrypted with AES-256 or encrypted with 3 different AES-128 keys?
Your title says 3 AES-128 keys, the body says 2. Which one are you talking about?
Nov
4
comment Square roots, prime factorization
Since the OP has now solved the problem, I encourage you to turn the hint into a proper answer that describes the whole solution.
Nov
4
comment Can DH_anon really be exploited by an attacker?
A client that allows anon DH is still vulnerable to MitM with anon DH even if the server disabled it. (unless perhaps it does something unusual like client certificates or other cryptographic authentication)
Nov
4
comment RC4 encryption/ decryption with hashing
Why new code based on RC4 in 2014? There is a lot of work on getting rid of RC4 because it's potentially weak.
Oct
31
comment RSA Decryption given n, e, and phi(n)
1) If there are errors in your first answer, edit it to correct it, instead of posting a new one. 2) I recommend including the essential parts of your code in the answer. An answer in stackexchange should be able to stand on its own, without external resources that might disappear over time.
Oct
30
comment RSA Decryption given n, e, and phi(n)
Use a big integer library, most programming languages either contain one (at least C# and Python do) or have a readily available third party implementation. (unfortunately the wolfram alpha link above doesn't work, it truncated phi)
Oct
30
comment RSA Decryption given n, e, and phi(n)
1) Compute d as the Modular multiplicative inverse of e, i.e. $d=e^-1 \bmod \phi(n)$ using extended euclidean 2) compute $m=c^d \bmod n$
Oct
30
comment Why develop new stream ciphers when block ciphers can be trivally made into streams?
Comparing dissimilar ciphers like AES and RC4 is pretty difficult. On large modern CPUs AES will be much faster.
Oct
30
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
Bernstein likes doing ECDH using x-only ladders without first verifying if the given x value is on the curve or the twist. For example the Curve25519 implementation in NaCl works like that.
Oct
30
comment Why is it hard to calculate Logarithm on Diffie Hellman?
You compute $g^x \bmod p$ via square-and-multiply in time $(\log(p))^3$, which is feasible for a 1000 bit $p$. The naive algorithms you describe are far too expensive.
Oct
30
comment Are there any digital signature algorithms in common use that result in 32-byte signatures?
There is a less common scheme called BLS, which produces 32 byte signatures at a 128 bit security level.
Oct
30
comment Low exponent attack against RSA
You shouldn't rely on secret RSA moduli: Hans-Joachim Knobloch - Breaking Public Keys - How to Determine an Unknown RSA Public Modulus.