Thomas Pornin
Reputation
38,867
123/100 score
 Sep 30 comment Need some understanding on RSA public key exponent It should be noted that when you generate a RSA key pair, you need to invert $e$ modulo $p-1$ and $q-1$; the natural algorithm for that is the extended GCD (binary GCD is easiest to implement) so you end up computing the GCD anyway. Sep 26 answered Shared modulus attack on RSA Sep 15 answered ciphertext packing for bandwidth optimization Sep 2 awarded Guru Aug 23 awarded Nice Answer Aug 19 awarded Nice Answer Aug 17 awarded Enlightened Aug 17 awarded Nice Answer Aug 12 comment Can ECDSA signatures be safely made “deterministic”? Deterministic signatures allow for easier tests of implementations -- you use a known private key, inject a known message to sign, and see if the output is the expected signature. If you do not get to choose or at least know the private key, then deterministic generation is not enforceable. Aug 12 comment Can ECDSA signatures be safely made “deterministic”? @Jus12: you cannot verify from the outside whether the signature was done deterministically or not -- except by asking twice for the same signature. If you have a black box that computes signatures, make it sign twice the same data; if you get twice the same output, then chances are that the signature algorithm is deterministic. On a single signature, by design, you should not be able to tell how the internal k value was generated. Aug 11 awarded Guru Jul 27 comment Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5? @ddddavidee: thanks; I fixed the link in the answer. Jul 27 revised Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5? Fixed link to Bleichenbacher's article Jul 26 awarded Stellar Question Jul 23 answered Why is Rabin encryption equivalent to factoring? Jul 16 awarded Nice Answer Jul 16 comment Unpredictability of X.509 serial numbers Integers are integers -- they are not bounded, otherwise we call them modular integers. It so happens that modern computers are most comfortable with integers modulo 32 or 64 bits (i.e. "32-bit or 64-bit integers") but they can still handle larger integers, as they do for RSA. For backward compatibility, X.509 (RFC 5280) says that the serial number shall be positive and its encoded value should fit in 20 bytes, which means that you have 159 bits to play with (serial number shall be between 0 and 2^159-1, inclusive). Jul 15 awarded Enlightened Jul 15 awarded Nice Answer Jul 14 answered Is there a multiple asymmetric encryption algorithm, which requires all private keys to reveal the secret?