679 reputation
411
bio website
location
age
visits member for 2 years, 2 months
seen Sep 14 at 12:16

Sep
12
comment What exactly could be accomplished with a backdoor in Dual_EC_DRBG?
Is that computationally hard, even knowing all (potentially) hidden curve parameters?
Sep
12
asked What exactly could be accomplished with a backdoor in Dual_EC_DRBG?
Sep
11
comment Is there a theoretical maximum useful keysize given the block-size?
@Avijit Very interesting suggestion and link, thanks! I've updated my answer accordingly.
Sep
11
revised Is there a theoretical maximum useful keysize given the block-size?
added 295 characters in body
Sep
11
comment Could RDRAND (Intel) compromise entropy?
@fgrieu The new code could augment the implementation with additional checks for unexpected behavior (e.g. additionally perform the XOR in software and compare the results). Compensating for such checks without knowing their implementation in advance seems very difficult.
Sep
10
answered Is there a theoretical maximum useful keysize given the block-size?
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 695 characters in body
Sep
10
comment Could RDRAND (Intel) compromise entropy?
I've now addressed that idea in an update. I guess that such a backdoor would be really hard to get right even for the current code, but it looks like treating RdRand as a regular entropy source without crediting any bits couldn't hurt either.
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 695 characters in body
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 146 characters in body
Sep
10
answered Could RDRAND (Intel) compromise entropy?
Sep
9
asked Relation between key size and PRNG state size
Sep
6
comment RSA key pair generation using PRNG with same seed
Maybe this answers your question: crypto.stackexchange.com/questions/1662/…
Sep
6
accepted Can stream ciphers (usually) be “run backwards”?
Sep
6
asked Can stream ciphers (usually) be “run backwards”?
Aug
23
awarded  Commentator
Aug
23
comment What signature schemes allow recovering the public key from a signature?
I didn't know about RFC6979 yet; it seems like a really good idea. Thanks!
Aug
23
accepted What signature schemes allow recovering the public key from a signature?
Aug
23
comment What signature schemes allow recovering the public key from a signature?
Thanks for the detailed comments on all my assumptions, seems like the property isn't as useful/dangerous as I originally thought.
Aug
23
comment What signature schemes allow recovering the public key from a signature?
One use case would be Bitcoin transaction verification; here is a discussion on bitcointalk that partially motivated this question: bitcointalk.org/index.php?topic=6430.0