Reputation
Next tag badge:
89/100 score
20/20 answers
Badges
1 30 60
Newest
 Yearling
Impact
~204k people reached

Jun
19
comment Relationship between an elements order and the DLP
Related question: Solving discrete logarithm when p is not a safe prime
Jun
19
comment Relationship between an elements order and the DLP
We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it.
Jun
19
comment In which situations is a length-extension attack a problem?
Similar multi collision attacks apply to all narrow pipe hashes, since for them, finding a state collision isn't harder than finding an output collision.
Jun
18
comment How can complexity be increased or decreased in AES?
If this is password based encryption, then there is a natural security-performance tradeoff: The cost of the key-derivation-function can be increased or decreased. For example, bcrypt and PBKDF2 have a number of iterations which can be tuned.
Jun
16
comment SHA512 faster than SHA256?
@MaartenBodewes By the time I remembered that, the 5 min edit limit had expired.
Jun
16
comment SHA512 faster than SHA256?
The crossover point should be at 56 bytes, since SHA256 jumps to 2 blocks of 64 bytes each, at that point. SHA256 might get ahead again at 120 bytes, since then it's 3 blocks for SHA256 and 2 blocks (128 bytes each) for SHA512.
Jun
14
comment Should I use ECB or CBC encryption mode for my block cipher?
1) The additional complexity of CBC or CTR is small compared to the complexity of the blockcipher itself. The performance hit is negligible using CTR mode. 2) CBC can be decrypted if you lose data in the middle since each plaintext blocks only depends on two consecutive ciphertext blocks. But it's rarely a good idea to decrypt modified data.
Jun
14
comment Supersingular Isogeny Key Exchange Software
I heard something about 200ms/op for current implementations. Considering how new it is and its mediocre performance, I'd rather use lattice crypto.
Jun
12
comment Should I use ECB or CBC encryption mode for my block cipher?
What's ccb? Did you mean cbc?
Jun
11
comment Cryptanalysis and Copying encrypted volumes
1) moder encryption aims to be immune to known or even chosen plaintext attacks. So as long as the crypto is unbroken, known plaintext doesn't matter. 2) truecrpt leaks which 16 byte blocks are identical if you have two xontainers using the same key.
Jun
11
comment Is DES slow in hardware or only in software?
You might want to expand the blocksize point.
Jun
11
comment Is DES slow in hardware or only in software?
Note that bitsliced DES isn't that slow in software, but you can only use it if you can process multiple blocks in parallel. This is the case for ECB, CTR and CBC decryption, but not CBC encryption. Similar to Why is Serpent faster than AES in this benchmark?
Jun
8
comment Converting ECC Code from python to Java. Extended Euclidean Algorithm not working.
Python carries out the tuple assignment at the same time, your java assignments happen sequentially. This means lm and low already have their new values when you assign them to hm and high, whereas in python they still have the old value.
Jun
8
comment Converting ECC Code from python to Java. Extended Euclidean Algorithm not working.
I'm voting to close this question as off-topic because it is a programming problem.
Jun
2
comment Which attacks are possible against raw/textbook elliptic curve?
ECIES corresponds to RSA-KEM, with both you hash the shared secret using a KDF. Typical ECC signatures are similar to RSA-FDH, since in both cases you use a hash as big as the modulus as a number.
May
31
comment Why using AES in ECB (Electronic Code Book) mode a bad idea?
There are other parallelizable modes as well. Such as XTS and OCB. But to recommend a mode we need to understand your requirements.
May
30
comment Authenticating small packets
AES CCM might be a better idea than GCM since it only needs one primitive. GCM is usually implemented with relatively big lookup tables, so it's probably not a good fit for your platform.
May
26
comment How to calculate RSA CRT parameters from public key and private exponent
The $\lambda$ in that calculation, isn't necessarily the usual $\lambda(n)$, right? Only a multiple of it.
May
25
comment Using ECB as RSA encryption mode, but encrypted messages are unique
Don't use PKCS#1v1.5 padding, use OAEP.
May
24
comment Are pseudorandom permutation really permutation in mathematical sense?
It's a permutation, but of the $2^{64}$ possible 64 bit blocks, not of the 64 bits within a single block. If a blockcipher were no permutation, you couldn't decrypt a block.