Thomas Pornin
Reputation
43,810
134/100 score
 Mar 1 awarded Enlightened Mar 1 awarded Nice Answer Feb 29 comment How to check that you got the right key when brute forcing an encryption? In RSA the public key consists in two integers, the larger of which is the "modulus". It is a non-prime integer. If you know the prime factors of the modulus, then you know the private key, because these prime factors are the private key. Of course, obtaining the prime factors is hard, to the point that it is infeasible if the modulus is large enough -- which is why we can make the modulus public: it does not reveal the prime factors. Feb 28 answered How to check that you got the right key when brute forcing an encryption? Feb 28 reviewed Approve Should we MAC-then-encrypt or encrypt-then-MAC? Feb 28 reviewed Approve Should we MAC-then-encrypt or encrypt-then-MAC? Feb 24 awarded Nice Answer Feb 18 awarded Nice Answer Feb 17 awarded Good Answer Feb 17 awarded Nice Answer Feb 17 answered Layman's explanation of encryption backdoors Feb 17 comment Layman's explanation of encryption backdoors To be precise, backdoors in PRNG offer plausible deniability because these things are hard to do properly, so if the backdoor is found, the public relations damage is more easily contained by claiming mere incompetence. Feb 17 awarded Nice Answer Jan 31 answered How to determine RSA block size for decryption Jan 31 answered Proving property of Modified Rabin Signature Jan 29 comment How does one calculate a primitive root for Diffie-Hellman? @Broseph: actually $q$ needs to be more than $2t$ bits long. The reason is that a discrete logarithm can be broken in two ways: either generically (based on the size of $q$), or with index calculus (based on the size of $p$). Index calculus is sub-exponential, meaning that you must make $p$ much bigger. In practice, to get "80-bit security", you need $q$ to be at least 160 bits, and $p$ should be at least 1000 bits. If you choose $p = 2q+1$, then the criterion on $p$ is the one that matters (for an 1000-bit $p$, a 999-bit $q$ is overkill, but you need a $p$ that big anyway). Jan 28 awarded Necromancer Jan 23 comment ECDSA Compressed public key point back to uncompressed public key point @Myath: in binary curves it is a bit more complex to explain, but a rather efficient compression method still exists. I have updated my answer with some extra explanations. Jan 23 revised ECDSA Compressed public key point back to uncompressed public key point Added explanations for binary curves. Jan 22 answered How to split up $GF(2^{128})$ into smaller fields?