Reputation
40,492
Next tag badge:
130/100 score
19/20 answers
Badges
6 94 162
Newest
 Necromancer
Impact
~998k people reached

Mar
10
answered Complexity of arithmetic in a finite field?
Mar
7
answered Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?
Mar
6
answered Computational feasible to reverse MD5SUM?
Feb
27
answered synchronization of counters in HOTP
Feb
26
answered What is an efficient random number generation algorithm
Feb
26
comment Standardized parameters for elliptic curve cryptography
Also, the AACS standard (protection on HD-DVD and Blu-ray discs) uses ECDSA in their own curve (see this document)‌​, page 10). When Sony designed the protection system for the PS3, they defined no less than 64 new curves (and they totally botched their ECDSA implementation, but that's another story).
Feb
26
comment Standardized parameters for elliptic curve cryptography
Actually there is considerable overlap: all 15 FIPS 186-2/3 curves are part of the 20 curves that X9.62 lists in its annex L; and all these 20 curves are part of the curves listed in SEC 2. The Brainpool curves are (deliberately) separate.
Feb
18
answered Realize a MAC using a Pseudo-random function?
Feb
18
comment How does the MOV attack work?
Actually, X9.62 (the standard for ECDSA) specifies some verifications when generating your own curve, include verifying that the embedding degree $k$ is greater than $100$. If you want to work over a subgroup of size $n$ (a prime) which divides the curve order, then the embedding degree is the smallest $k \geq 2$ such that $n$ divides $q^k-1$. It then suffices to check that $n$ does not divide $q^k-1$ for all values $k$ from $2$ to $100$.
Feb
18
answered How can I calculate the SHA-256 “midstate”?
Feb
10
answered Is Common Name encoded in the certificate?
Feb
7
comment How are timestamps verified?
There are several ways to timestamp a PDF file. You can handle it as an opaque blob, and produce an external time stamp (or evidence record). You can also embed the time stamp in the file, because the PDF format includes some provisions for it; such a time stamp can be verified from within Adobe Reader itself. Universign supports both; see: universign.eu/en/web-services
Feb
6
comment What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?
@DanNeely: a block cipher with 256-bit keys is supposed to offer resistance up to work factor $2^{256}$; there should not exist any (theoretical) attack which would be less expensive. An attack with cost $2^{200}$ is considered to be a "break" for a block cipher with a 256-bit key; but not for a block cipher with a 128-bit key, for which we "only" require resistance up to $2^{128}$ operations. The extra rounds help in obtaining that level of resistance.
Feb
6
answered How are timestamps verified?
Feb
6
answered How to account for moore's law in estimating time-to-crack?
Feb
2
reviewed Approve commitments tag wiki excerpt
Feb
2
comment Is RSA of a random nonce with no padding safe?
@Gilles: if padding is deterministic, and you encrypt the same $K$ (padded to $\pi(K)$) for three different recipients, with $e = 3$, then you send the value $\pi(K)^3$ modulo $n_1$, $n_2$ and $n_3$. By the Chinese Remainder Theorem, this is sufficient to rebuild $\pi(K)$ modulo $n_1n_2n_3$, and since $\pi(K) \lt n_i$, the modulo disappears. This is the historical justification for using $e = 65537$ instead of $e = 3$, but the real issue is that a deterministic padding for RSA encryption is definitely unsafe. You MUST have a random padding.
Feb
2
awarded  encryption
Feb
1
answered Is RSA of a random nonce with no padding safe?
Feb
1
answered How can I convert a DER ECDSA signature to ASN.1?