Thomas Pornin
Reputation
43,930
149/100 score
 Jan 27 awarded Enlightened Jan 26 reviewed Edit What is a block cipher? Jan 26 revised What is a block cipher? Better title and improved grammar Jan 19 answered AES CBC mode or AES CTR mode recommended? Jan 10 answered Is it possible to break a hash-based block cipher? Jan 10 awarded Nice Answer Jan 9 reviewed Approve Why is ciphertext from low entropy plaintext not compressible? Jan 8 answered Why is RSA usually limited to messages up to 1 block Jan 6 answered Simple homomorphic crypto for 32-bit integers Jan 3 answered Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems? Dec 30 answered Efficient Symmetric Mutual Entity Authentication Protocol Dec 22 awarded Good Answer Dec 7 answered Are really, really long passwords any securer than short ones? Dec 7 reviewed Approve RSA 4096 bit key benchmark Nov 30 comment Exhausting the entropy of a hash function There are details. There are also online dictionary attacks, which are performed against the live target server, without knowing the hash value. Specific preimage resistance of the hash function is irrelevant for that. But if the attacker knows the hash value, then yes, there is no need, even academic, to push the password entropy beyond the preimage resistance of the hash function. Nov 30 answered Exhausting the entropy of a hash function Nov 29 answered Constructing RSA private key, given public key Nov 29 answered What cipher mode is suitable for independantly decryptable short messages? Nov 24 answered Does a trace of SSL packets provide a proof of data authenticity? Nov 23 comment Mapping between subgroups and the integers $q$ is a prime so it is odd ($2$ is the only even prime). Therefore $q = 2k+1$ for some integer $k$. So, $p = 2q+1 = 4k+3$, which means that $p = 3 \mod 4$. Whe computing modulo a prime $p$ which is equal to 3 modulo 4, $-1$ is not a quadratic residue, so $x$ and $-x$ cannot be both quadratic residues (but one of them necessarily is).