11d060a946665fb769d865f4bbb48c
Reputation
Top tag
Next privilege 125 Rep.
Vote down
 Feb 2 comment What is the complexity to break second preimage resistance? Thank you for the response Feb 1 comment SHA1 collisions and the impact for ECDSA signatures Thanks for the good discussion :) Feb 1 comment SHA1 collisions and the impact for ECDSA signatures Agreed, but in the context of SHA1 we are only worrying about collision resistance. So an attacker should have control over $m$ and $m'$. After he has $(r,s)$ and $m$ this will not work if second pre-image collision resistance is still a true property of SHA1. Feb 1 comment SHA1 collisions and the impact for ECDSA signatures Ah wait, we are talking about two different things. You are talking about collision resistance and I'm talking about second pre-image, could that be the case? Feb 1 comment SHA1 collisions and the impact for ECDSA signatures With all respect But I don't think I fully agree with you. To calculate $s'$ you need $d_A$ and $r$. Both depend on other values then $z$. Feb 1 comment SHA1 collisions and the impact for ECDSA signatures If you have the pair $(r,s)$ for a message $m$, you can not simply use the fact that SHA1 has practical collision resistance attacks to provide me with a $m'$ that will validate against $(r,s)$? You would need the private key in order to allow the public key to validate against the signature? Feb 1 comment SHA1 collisions and the impact for ECDSA signatures I don't that that is the case for ECDSA, because the signature relies on more than just the value of $z$ (first $Ln$ bits from the hash). $s = k^{-1}(z + r d_A) \mod n.$. Knowing or being able to predict $z$ won't help you with forging the signature. (with $d_A$ the private key and $k$ a random value). At least I think.. Jun 15 comment Practical disadvantages of GCM mode encryption Hi, quick question. Do you have a reference to the paper that describes the GCM IV reuse vulnerability? Jun 2 comment Which attacks are possible against raw/textbook elliptic curve? So there is no equivalent to RSA public key encryption in the ECC world (I'm pretty sure that I'm not overlooking any schemes in my literature.. But having verification would be nice)? ECIES is hybrid, ECDH is a key agreement. ElGamal is a scheme that uses any DH construction. Jun 2 comment Which attacks are possible against raw/textbook elliptic curve? Indeed. I'm referring to RSA public key encryption. Jun 2 comment Which attacks are possible against raw/textbook elliptic curve? There are no other EC schemes which i'm missing here? RSA can safely encrypt up to 245 bytes if I remember correctly (exchanging session keys using some defined format for example). EC has no such means of exchanging session keys. If you want that you should use it in a key agreement scheme. Mar 19 comment HMAC tag to verify the key (verification in the reverse direction) $S_0$ and $S_1$ are random, never re-used and hard to compute. So that should not be a problem. Jun 6 comment Why is verification using DSA slower than verification with RSA? @HenrickHellström: Thank you for the response. Jun 6 comment Why is verification using DSA slower than verification with RSA? A quick follow up, is there a big difference in authentication and verification complexity between RSA with a 1024 modulus and a 2048 modulus? May 31 comment What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA Thanks for the very clear explanation! May 28 comment Why is verification using DSA slower than verification with RSA? Thanks you for the response and the clear answer! Apr 16 comment May the problem with DES using OFB mode be generalized for all feistel ciphers Thank you for the additional information!! Apr 16 comment May the problem with DES using OFB mode be generalized for all feistel ciphers Yes, ive updated the original response. Apr 10 comment May the problem with DES using OFB mode be generalized for all feistel ciphers Sorry for my late reaction. Thank you for answer my question! Apr 8 comment May the problem with DES using OFB mode be generalized for all feistel ciphers Thanks for the response! But with DES, if i encrypt P1 with $k$ i get C1, if i encrypt C1 with $k$ agian, i get back P1? Or only when DES is used with "weak keys"?