Reputation
Top tag
Next privilege 75 Rep.
Set bounties
Badges
6
Newest
 Custodian
Impact
~209 people reached

  • 0 posts edited
  • 0 helpful flags
  • 0 votes cast
Oct
13
comment Very short signatures? (eg: 48bits?)
Note that 48 bits will get really weak if the attacker applies a Time Memory Trade Off. Details depend on the actual algorithm, but a simple, and mostly wrong, back of the napkin calculation could be: 1 Terabyte drive ~ $2^{37}$ stored 48-bit values -> ~$2^11$ lookup operations per attack -> several attacks per second (for SSD) to few seconds per attack (for HDD).
Oct
12
comment ECDH or RSA more secure for symmetric key wrapping?
I strongly disagree with your "normal sized secret key can be directly encrypted with a normal sized RSA public key" statement. Doing $m^e mod n$ with a 128-bit $m$, $e=3$ for example will not lead to an overflow , so the attacker only needs to compute the cubic root to find $m$. That problem doesn't exist for $e=63337$, but to claim any RSA with $e=3$ as not normal sized would be rather strong. Instead, use a KEM. As an example: Generate $m$ randomly of same size as $n$, then use a KDF to get the AES key.
Oct
9
awarded  Custodian
Oct
9
reviewed Approve X509 certificates: Two Algorithm Identifiers?
Oct
9
awarded  Teacher
Oct
8
answered X509 certificates: Two Algorithm Identifiers?
Oct
8
comment Security of SRP-6a against impersonating server choosing small/wrong N
Ahh, thanks, you've solved the confusion in my head. I was thinking of an attack I saw presented somewhere (don't remember) where the attacker progressed by guessing $x$ mod 17, then $x$ mod 257, etc. and in each step only having to try a couple of additional bits due to knowledge from the previous exchange. I now see that that doesn't apply here, in part due to the many hashes. And yes, just breaking $a$ and doing a direct brute force on the password is plenty sufficient and an even worse attack, since, among other things, SRP is supposed to be used when the password entropy is low.
Oct
8
awarded  Scholar
Oct
8
accepted Security of SRP-6a against impersonating server choosing small/wrong N
Oct
7
awarded  Autobiographer
Oct
7
awarded  Student
Oct
7
asked Security of SRP-6a against impersonating server choosing small/wrong N
Jan
31
asked Reducing key shares in Damgård-Dupont threshold RSA
Jan
31
awarded  Informed
Jan
29
comment Negative exponents in Shoup's threshold RSA?
Ah, thank you very much. I thought I couldn't divide at all, since I'm not in a field. I completely forgot that $a^{-1} \text{ mod } n$ also exists when $a$ and $n$ are coprime, which, $n$ being the product of two large primes, is reasonably often the case here.
Jan
28
asked Negative exponents in Shoup's threshold RSA?