748 reputation
411
bio website
location
age
visits member for 2 years, 4 months
seen Nov 13 at 19:26

Sep
17
comment Could RDRAND (Intel) compromise entropy?
I agree - if properly done, hashing it into the pool would make any kind of backdoor much more difficult to implement. Maybe it will be changed again - RdRand has been moved around in random.c quite a lot already.
Sep
17
revised Could RDRAND (Intel) compromise entropy?
added 730 characters in body
Sep
12
comment What exactly could be accomplished with a backdoor in Dual_EC_DRBG?
Is that computationally hard, even knowing all (potentially) hidden curve parameters?
Sep
12
asked What exactly could be accomplished with a backdoor in Dual_EC_DRBG?
Sep
11
comment Is there a theoretical maximum useful keysize given the block-size?
@Avijit Very interesting suggestion and link, thanks! I've updated my answer accordingly.
Sep
11
revised Is there a theoretical maximum useful keysize given the block-size?
added 295 characters in body
Sep
11
comment Could RDRAND (Intel) compromise entropy?
@fgrieu The new code could augment the implementation with additional checks for unexpected behavior (e.g. additionally perform the XOR in software and compare the results). Compensating for such checks without knowing their implementation in advance seems very difficult.
Sep
10
answered Is there a theoretical maximum useful keysize given the block-size?
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 695 characters in body
Sep
10
comment Could RDRAND (Intel) compromise entropy?
I've now addressed that idea in an update. I guess that such a backdoor would be really hard to get right even for the current code, but it looks like treating RdRand as a regular entropy source without crediting any bits couldn't hurt either.
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 695 characters in body
Sep
10
revised Could RDRAND (Intel) compromise entropy?
added 146 characters in body
Sep
10
answered Could RDRAND (Intel) compromise entropy?
Sep
9
asked Relation between key size and PRNG state size
Sep
6
comment RSA key pair generation using PRNG with same seed
Maybe this answers your question: crypto.stackexchange.com/questions/1662/…
Sep
6
accepted Can stream ciphers (usually) be “run backwards”?
Sep
6
asked Can stream ciphers (usually) be “run backwards”?
Aug
23
awarded  Commentator
Aug
23
comment What signature schemes allow recovering the public key from a signature?
I didn't know about RFC6979 yet; it seems like a really good idea. Thanks!
Aug
23
accepted What signature schemes allow recovering the public key from a signature?