Reputation
Next tag badge:
119/100 score
19/20 answers
Badges
6 79 150
Impact
~791k people reached

Apr
25
awarded  Nice Answer
Apr
22
comment Is RSA of a random nonce with no padding safe?
@CodeInChaos: yes, my argument does not show why per-encryption randomness is required, which is why I wrote in my response "more generally". You need per-encryption randomness to avoid exhaustive search attacks on the encrypted text (which may or may not be applicable, depending on context -- it depends whether you are encrypting a meaningful message, or a random session key).
Apr
22
revised Why is elliptic curve cryptography not widely used, compared to RSA?
added 1 characters in body
Apr
22
comment Can one reduce the size of ECDSA-like signatures?
@DavidSchwartz: if you aim at 80-bit security, you still need 2^80 distinct signatures (i.e. valid for distinct messages), otherwise exhaustive search on the signature value is a break. So a signature length cannot be less than 80 bits. Algorithms which work on discrete logarithm tend to double that figure (you need a 160-bit group to achieve 2^80 resistance), so 160-bit signatures (that's what you get with BLS). Then, (EC)DSA adds its extra 160 bits, hence the 320-bit DSA signatures.
Apr
17
answered Can one reduce the size of ECDSA-like signatures?
Apr
10
awarded  Nice Answer
Mar
30
awarded  Enlightened
Mar
30
awarded  Nice Answer
Mar
17
awarded  Popular Question
Mar
10
answered Complexity of arithmetic in a finite field?
Mar
7
answered Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?
Mar
6
answered reverse of md5sum
Feb
27
answered synchronization of counters in HOTP
Feb
26
answered What is an efficient random number generation algorithm
Feb
26
comment Standardized parameters for elliptic curve cryptography
Also, the AACS standard (protection on HD-DVD and Blu-ray discs) uses ECDSA in their own curve (see this document)‌​, page 10). When Sony designed the protection system for the PS3, they defined no less than 64 new curves (and they totally botched their ECDSA implementation, but that's another story).
Feb
26
comment Standardized parameters for elliptic curve cryptography
Actually there is considerable overlap: all 15 FIPS 186-2/3 curves are part of the 20 curves that X9.62 lists in its annex L; and all these 20 curves are part of the curves listed in SEC 2. The Brainpool curves are (deliberately) separate.
Feb
18
answered Realize a MAC using a Pseudo-random function?
Feb
18
comment How does the MOV attack work?
Actually, X9.62 (the standard for ECDSA) specifies some verifications when generating your own curve, include verifying that the embedding degree $k$ is greater than $100$. If you want to work over a subgroup of size $n$ (a prime) which divides the curve order, then the embedding degree is the smallest $k \geq 2$ such that $n$ divides $q^k-1$. It then suffices to check that $n$ does not divide $q^k-1$ for all values $k$ from $2$ to $100$.
Feb
18
answered How can I calculate the SHA-256 “midstate”?
Feb
10
answered Is Common Name encoded in the certificate?