679 reputation
411
bio website
location
age
visits member for 2 years, 2 months
seen Sep 14 at 12:16

Jul
15
comment Is RSA of a random nonce with no padding safe?
Out of curiosity: Will this scheme also work without the final step $k = H(x)$, e.g. by simply taking the $n$ left- or rightmost bits of $x$?
Mar
5
comment Why is “multiplying” $g^x$ and $g^y$ not possible?
Back to my highschool math textbooks it is then. Thank you!
Sep
17
comment Could RDRAND (Intel) compromise entropy?
I agree - if properly done, hashing it into the pool would make any kind of backdoor much more difficult to implement. Maybe it will be changed again - RdRand has been moved around in random.c quite a lot already.
Sep
12
comment What exactly could be accomplished with a backdoor in Dual_EC_DRBG?
Is that computationally hard, even knowing all (potentially) hidden curve parameters?
Sep
11
comment Is there a theoretical maximum useful keysize given the block-size?
@Avijit Very interesting suggestion and link, thanks! I've updated my answer accordingly.
Sep
11
comment Could RDRAND (Intel) compromise entropy?
@fgrieu The new code could augment the implementation with additional checks for unexpected behavior (e.g. additionally perform the XOR in software and compare the results). Compensating for such checks without knowing their implementation in advance seems very difficult.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
I've now addressed that idea in an update. I guess that such a backdoor would be really hard to get right even for the current code, but it looks like treating RdRand as a regular entropy source without crediting any bits couldn't hurt either.
Sep
6
comment RSA key pair generation using PRNG with same seed
Maybe this answers your question: crypto.stackexchange.com/questions/1662/…
Aug
23
comment What signature schemes allow recovering the public key from a signature?
I didn't know about RFC6979 yet; it seems like a really good idea. Thanks!
Aug
23
comment What signature schemes allow recovering the public key from a signature?
Thanks for the detailed comments on all my assumptions, seems like the property isn't as useful/dangerous as I originally thought.
Aug
23
comment What signature schemes allow recovering the public key from a signature?
One use case would be Bitcoin transaction verification; here is a discussion on bitcointalk that partially motivated this question: bitcointalk.org/index.php?topic=6430.0
Aug
23
comment What signature schemes allow recovering the public key from a signature?
With "recovering the private key", I was referring to the troubles with ECDSA and reused nonces that somewhat famously resulted in Sony's PS3 master keys being published and about 55 Bitcoins being stolen. Of course, when using a proper random nonce, this is not possible. One might say that it's only the implementor's fault, but proper randomness can sometimes be hard to acquire... I've now removed that sentence; vaguely referencing ECDSA's security model probably doesn't add anything to the question.
Aug
23
comment Can one have an authentic, but repudiable, message without a previously shared secret?
@poncho: That's correct, Alice can't create exactly the same message. However, since by the protocol, K is randomly chosen for every message, the only information that can't be repudiated by bob is "at some point, Bob authenticated a message using K". Depending on the application, that might be acceptable.
Feb
17
comment Why does WPA-PSK not use Diffie-Hellman key exchange?
Michael already suggested a method that provides stronger security: A Diffie-Hellman exchange. This would require an attacker to actively perform a man-in-the-middle-attack, as opposed to starting Wireshark and entering the PSK. I'm also wondering why they didn't implement it like that.
Feb
12
comment Is semantic security important in a hybrid cryptosystem?
Your're right, that was a typo - I meant random plaintext as input to the asymmetric cipher. I've changed the question accordingly. Thanks!
Jul
31
comment Does TLS use RC4-drop[n]?
Now it makes sense, thanks again. I was confused by RFC 4345 mentioning the possibility of recovering the key from the first keystream output bytes, but now I think they probably just want to be on the safe side and are not referring to actual attacks in that paragraph.
Jul
31
comment Does TLS use RC4-drop[n]?
Thanks, that pretty much answers my question. Just to make sure, regarding the second issue: There is no (known) way to derive the RC4 key from a single keystream alone, right? So even when the very first thing that is sent in a RC4 encrypted connection is gigabytes of known plaintext (zeroes, for example), the key cannot be easily recovered? (Assuming that the initial key has never been used before, even partially - unlike WEP etc.)