Reputation
12,269
Next tag badge:
90/100 score
20/20 answers
Badges
1 31 61
Newest
 Enlightened
Impact
~211k people reached

Jun
22
comment What is more efficient, pairing based cryptography or non pairing based cryptography?
@Nubila I just posted two schemes that require pairings, what more do you want?
Jun
22
comment RSA: How effective is this keypair-trash attack
How many universes are you willing to turn into databases in order to hold this data? 1024 bit RSA keys are already borderline breakable, yet a database big enough to contain even a tiny fraction of all relevant prime factors (not even the keys themselves, which are far more numerous) would exceed a single universe.
Jun
21
comment Determine safety of exercise hash functions
Since there are no restrictions on what $h_{666}$ is, and the question says "may be less safe", you're allowed to assume the worst about $h_{666}$. For A) you could assume that it returns a constant value. For C) what if $h_{666}=h_{md5}(m) \oplus h_{sha1}(m) \oplus h_B(m)$ plus some constant padding?
Jun
21
comment Determine safety of exercise hash functions
@fgrieu I think the zero-padding referred to the individual hashes, expanding them all to 666 bits so you can xor them, not the the messages.
Jun
21
comment Determine safety of exercise hash functions
Which security properties do you want?
Jun
20
comment What is Polymorphic encryption?
Can you elaborate on the context where you heard this? The closest thing I know is polymorphic malware.
Jun
20
comment Any use for now-defunct Mt Gox Yubikey?
I'm voting to close this question as off-topic because it is not about cryptography.
Jun
20
comment 2DES vs. two-key triple encryption, with no decryption step
Related question: Why is triple-DES using three different keys vulnerable to a meet-in-the-middle-attack?
Jun
19
comment 3DES over Galois Counter Mode (GCM) for authenticated encryption
@MaartenBodewes You wouldn't use a 64 bit polynomial. You'd use 2 blocks as keys/mask for GHash. The biggest problem with 64 bit block ciphers is that the IV size becomes even smaller (32 bits for counter, 32 bit IV). Not sure how big the impact on protocol design is in practice, since a random 96 bit IV isn't a great idea either, so when a good protocols needs a random IV, it uses a KDF to derive a one time key from IV and master key.
Jun
19
comment Relationship between an elements order and the DLP
Related question: Solving discrete logarithm when p is not a safe prime
Jun
19
comment Relationship between an elements order and the DLP
We don't have a good question about small subgroup attacks and IMO we should have one. But I'm not sure if we should use this one (edited if necessary), or if we should create a well written canonical question, and close this one as duplicate of it.
Jun
19
comment In which situations is a length-extension attack a problem?
Similar multi collision attacks apply to all narrow pipe hashes, since for them, finding a state collision isn't harder than finding an output collision.
Jun
18
comment How can complexity be increased or decreased in AES?
If this is password based encryption, then there is a natural security-performance tradeoff: The cost of the key-derivation-function can be increased or decreased. For example, bcrypt and PBKDF2 have a number of iterations which can be tuned.
Jun
16
comment SHA512 faster than SHA256?
@MaartenBodewes By the time I remembered that, the 5 min edit limit had expired.
Jun
16
comment SHA512 faster than SHA256?
The crossover point should be at 56 bytes, since SHA256 jumps to 2 blocks of 64 bytes each, at that point. SHA256 might get ahead again at 120 bytes, since then it's 3 blocks for SHA256 and 2 blocks (128 bytes each) for SHA512.
Jun
14
comment Should I use ECB or CBC encryption mode for my block cipher?
1) The additional complexity of CBC or CTR is small compared to the complexity of the blockcipher itself. The performance hit is negligible using CTR mode. 2) CBC can be decrypted if you lose data in the middle since each plaintext blocks only depends on two consecutive ciphertext blocks. But it's rarely a good idea to decrypt modified data.
Jun
14
comment Supersingular Isogeny Key Exchange Software
I heard something about 200ms/op for current implementations. Considering how new it is and its mediocre performance, I'd rather use lattice crypto.
Jun
12
comment Should I use ECB or CBC encryption mode for my block cipher?
What's ccb? Did you mean cbc?
Jun
11
comment Cryptanalysis and Copying encrypted volumes
1) moder encryption aims to be immune to known or even chosen plaintext attacks. So as long as the crypto is unbroken, known plaintext doesn't matter. 2) truecrpt leaks which 16 byte blocks are identical if you have two xontainers using the same key.
Jun
11
comment Is DES slow in hardware or only in software?
You might want to expand the blocksize point.