Reputation
12,018
Next tag badge:
98/100 score
18/20 answers
Badges
1 29 60
Newest
 Revival
Impact
~199k people reached

May
9
comment RSA: How to calculate the private exponent?
You could factor $n$. 33=3*11
May
8
comment Question about discrete log - why can one attacker not solve for g but two colluders can?
Isn't this question about roots, not logarithms?
May
7
comment Algorithm for n-of-m keys with partial results
If you use a one-time key, then being trusted to hold that one time key is equivalent to being trusted to hold the plaintext. Then secret-share the one-time key and encrypt the shares with the public keys of the share holders.
May
7
comment Key Check Value standard pratice for asymetric cryptography?
For your secret sharing scenario my first instinct is using an all-or-nothing transform on the plaintext together with some redundancy, similar to OAEP. Should probably the unkeyed equivalent of a strong pseudo-random-permutation.
May
7
comment Key Check Value standard pratice for asymetric cryptography?
Public key fingerprints are used by SSH (and other protocols).
May
7
comment Why does Diffie-Hellman need be a cyclic group?
Related questions: Diffie-Hellman on infinite groups and How does the wider cryptographic community view non-abelian group based cryptography?
May
6
comment Is encryption time greater than decryption time?
RSA decryption is much slower than encryption. For AES and DES it should be roughly the same. No clue what DNA is.
May
4
comment Encrypting and Decrypting a 19-digits long BigInteger
Do you need to support any 19 digit integer? Or is the input limited to 64 bits?
May
4
comment What are the vulnerabilities of this homemade encryption algorithm?
I'm voting to close this question as off-topic because it's about breaking a homebrew cipher.
May
2
comment Decypting a Stream Cipher
You need to find the multiplicative inverse of a mod m. Which exists if GCD(a, m)=1.
May
2
comment Can Winternitz be easily converted to a many-time encryption scheme?
@petro444 You can use hashes in CTR mode, but for most hashes that will have bad performance, since they're optimized for consuming data, not for outputting data. Salsa20 and ChaCha are stream ciphers built with a hash at their core.
May
1
comment Can Winternitz be easily converted to a many-time encryption scheme?
Unfortunately I can't find the paper with the impossibility proof.
May
1
comment SHA-512 partial preimage
@StevePeltz Average != median.
May
1
comment Why are there no OTP ciphers?
@VincentAdvocaat The current expectation is that QCs: 1) halve the effective key length of symmetric ciphers (so 256 bit ciphers should still be fine). 2) totally break RSA, DH/DSA and ECC 3) Only offer a small advantage (similar to the one against symmetric crypto) against certain more experimental asymmetric algorithms. So the common conclusion isn't switching to OTPs, but to develop those alternative asymmetric algorithms until they're ready for production.
Apr
29
comment What can cause similar MD5 hashes
1) Are you sure you're using correctly implemented MD5? 2) Can you post the hashing code?
Apr
29
comment Why does the ElGamal signature have the specific form that it does?
Probably the first working formula ElGamal found. There are other formulas which work as well (e.g Schnorr and DSA).
Apr
29
comment Yubico's take on U2F key wrapping
Are you using the HMAC key as second parameter?
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong I don't get your point. The cost of multiplication is data independent for most CPUs. So as long as you implement your code without secret dependent array lookups and secret dependent branches, you should trivially end up with a side channel resistant implementation.
Apr
29
comment Montgomery Ladder vs Double-and-Add
@David天宇Wong But montgomery curves have nice properties which allow fast constant time implementations of montgomery ladders.
Apr
27
comment Are more S boxes more secure in a SP-Network?
1) The increased pressure on the CPU cache might be more expensive than what you gain from being able to reduce the number of rounds. 2) You can't add special s-box instructions to the CPU if there are many sboxes (see AES-NI)