11d060a946665fb769d865f4bbb48c
Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
8
Newest
 Curious
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 10 votes cast
Mar
21
accepted Which attacks are possible against raw/textbook elliptic curve?
Feb
2
comment What is the complexity to break second preimage resistance?
Thank you for the response
Feb
2
accepted What is the complexity to break second preimage resistance?
Feb
2
revised What is the complexity to break second preimage resistance?
deleted 33 characters in body
Feb
2
asked What is the complexity to break second preimage resistance?
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
Thanks for the good discussion :)
Feb
1
accepted SHA1 collisions and the impact for ECDSA signatures
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
Agreed, but in the context of SHA1 we are only worrying about collision resistance. So an attacker should have control over $m$ and $m'$. After he has $(r,s)$ and $m$ this will not work if second pre-image collision resistance is still a true property of SHA1.
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
Ah wait, we are talking about two different things. You are talking about collision resistance and I'm talking about second pre-image, could that be the case?
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
With all respect But I don't think I fully agree with you. To calculate $s'$ you need $d_A$ and $r$. Both depend on other values then $z$.
Feb
1
revised SHA1 collisions and the impact for ECDSA signatures
added 179 characters in body
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
If you have the pair $(r,s)$ for a message $m$, you can not simply use the fact that SHA1 has practical collision resistance attacks to provide me with a $m'$ that will validate against $(r,s)$? You would need the private key in order to allow the public key to validate against the signature?
Feb
1
comment SHA1 collisions and the impact for ECDSA signatures
I don't that that is the case for ECDSA, because the signature relies on more than just the value of $z$ (first $Ln$ bits from the hash). $s = k^{-1}(z + r d_A) \mod n.$. Knowing or being able to predict $z$ won't help you with forging the signature. (with $d_A$ the private key and $k$ a random value). At least I think..
Feb
1
revised SHA1 collisions and the impact for ECDSA signatures
deleted 1 character in body
Feb
1
revised SHA1 collisions and the impact for ECDSA signatures
edited body
Feb
1
asked SHA1 collisions and the impact for ECDSA signatures
Nov
10
asked IV re-use for Salsa20
Aug
16
awarded  Curious
Jun
15
comment Practical disadvantages of GCM mode encryption
Hi, quick question. Do you have a reference to the paper that describes the GCM IV reuse vulnerability?
Jun
2
comment Which attacks are possible against raw/textbook elliptic curve?
So there is no equivalent to RSA public key encryption in the ECC world (I'm pretty sure that I'm not overlooking any schemes in my literature.. But having verification would be nice)? ECIES is hybrid, ECDH is a key agreement. ElGamal is a scheme that uses any DH construction.