Reputation
43,810
Next tag badge:
134/100 score
19/20 answers
Badges
6 104 176
Newest
 tls
Impact
~1.1m people reached

17h
awarded  tls
1d
answered Why do we use hex output for hash functions?
Apr
28
awarded  Revival
Apr
23
comment What is the fastest block cipher in the (Intel) world?
On a Core2, Kasper and Schwabe implemented AES at 7.59 cpb, which is substantially better than 11 cpb. This implementation runs 8 instances in parallel, which is fine for CTR, not so much for CBC encryption (CBC decryption can be done in parallel, though); as an added bonus, it is constant-time.
Apr
23
answered what is meaning of operator “ := ” in cryptography?
Apr
23
answered What is the fastest block cipher in the (Intel) world?
Apr
19
comment Is there a theorem to determine the elliptic curve parameters based on the group order?
Take care that these curves have embedding degree 2, so they are much weaker than usual curves for "normal sizes" (e.g. 256 bits). This is a nice curve if you want to use a pairing and know what you are doing.
Apr
19
answered Is Schannel supposed to use SHA1 for (EC)DHE params?
Apr
19
answered How to construct a collision resistant hash function that is not a one-way function?
Apr
19
answered Would A5/1 with a much larger state be a good choice of stream cipher for hardware?
Apr
19
answered Is there a theorem to determine the elliptic curve parameters based on the group order?
Apr
18
awarded  Good Answer
Apr
18
comment understanding a length extension attack
@MehranTorki: the length which is encoded in the padding is the length. Not "the length modulo the block size". It is a multiple of 512, but you must still know which multiple of 512 it is. Is it 512, 1024, 1049088?
Apr
18
comment understanding a length extension attack
@MehranTorki: to actually compute SHA-1 of m||p||z you need to process m||p||z||p' where p' is the padding that corresponds to the length of m||p||z. You don't have to know m||p because you (as the attacker) start from the known hash value (SHA-1 of m) but you still need to assemble a proper p', and that entails knowing the length of m||p||z -- which basically requires knowing the length of m within a few bytes.
Apr
18
comment understanding a length extension attack
@MehranTorki: to complete the hash computation, the attacker must append its own padding, that encodes the length of m||p||z, so the attacker must know the length of m||p. Thus, he must know the length of m at least approximately (within one block of the true length).
Apr
17
awarded  Guru
Apr
15
comment What is necessary for generating an elliptic curve?
Classic implementations of EC will be cubic, just like RSA (so a 2048-bit curve will imply computations 512 times slower than a 256-bit curve). You can go down to quadratic if you limit exponent size (you work in a 256-bit subgroup of the whole curve) but then generating the curve with such a subgroup will be very challenging (not counting usage issues such as point validation). With a special-format prime you can gain some cycles (Karatsuba for n*log n multiplications) but it won't show up that much for that kind of operand size.
Apr
14
answered What is necessary for generating an elliptic curve?
Apr
14
comment What is necessary for generating an elliptic curve?
The formulas above work only for Koblitz curves, which are very few, and, arguably, won't be generated -- they are already there, so to speak. Also, with a non-prime $m$ (and $m = 2048$ is certainly non-prime), this necessarily implies that there will be non-trivial subgroups, which is harmful to security.
Apr
13
awarded  Good Answer