Reputation
Next tag badge:
119/100 score
19/20 answers
Badges
6 79 150
Impact
~791k people reached

2d
comment Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
@ddddavidee: thanks; I fixed the link in the answer.
Jul
16
comment Unpredictability of X.509 serial numbers
Integers are integers -- they are not bounded, otherwise we call them modular integers. It so happens that modern computers are most comfortable with integers modulo 32 or 64 bits (i.e. "32-bit or 64-bit integers") but they can still handle larger integers, as they do for RSA. For backward compatibility, X.509 (RFC 5280) says that the serial number shall be positive and its encoded value should fit in 20 bytes, which means that you have 159 bits to play with (serial number shall be between 0 and 2^159-1, inclusive).
Jul
12
comment Is this commutative encryption protocol secure?
To my knowledge, nobody has found yet a way to do a secure key exchange with only symmetric cryptography algorithms. This does not prove that it is impossible, only that if it can be done then it is probably non-obvious and quite tricky.
Jun
14
comment Meaning of entropy of a bitstring in NIST SP 800 - 90A
If passing tests was enough, competitions like eSTREAM would be meaningless. Anyone can run some statistical tests on a PRNG; but it takes years and many cryptographers to assess the actual security.
Jun
14
comment Meaning of entropy of a bitstring in NIST SP 800 - 90A
What I mean is that while statistics can detect things that attackers also know, attackers may know things that statistics do not detect. E.g. for a purportedly "strong" PRNG, if a statistical test detects a bias, then the PRNG is weak; but if the test detects nothing, then one must not conclude that the PRNG is strong. In practice, even bad PRNG are "perfect" from a statistical point of view.
May
12
comment How can I convert a DER ECDSA signature to ASN.1?
It is specified in the standard for DHE parameters, and in the other standard for ECDHE parameters. In the former case (DHE), it is the concatenation of the client random, the server random, and the encoded DH values (TLS encoding, not ASN.1/DER). With ECDHE, this is an encoding of the curve description and the server ECDH public value, this time without the client and server randoms.
Apr
7
comment How can rainbow tables be used for a dictionary attack?
@FredericoSchardong: see this article for some thorough analysis. It is not an easy read. Informally, when you build rainbow/Hellman tables, you accumulate chains with distinct end points; the more chains you insert, the higher the probability that the next chain merges with one already in the table, and thus was lost CPU. At some point it no longer is worth it; you'd better start a new table. The "1.7" factor comes from that effect.
Mar
11
comment RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?
In their article, the EdDSA authors mostly say that: "Standard PRF hypotheses imply that this pseudorandom session key r is indistinguishable from a truly random string generated independently for each M, so there is no loss of security". This is a bit too terse to be called "extensive analysis" but it makes sense. For more analysis, you may read the Leurent & Nguyen article cited from RFC 6979 (under the reference "LN2009"); that article includes some analysis and pointers.
Dec
6
comment When to use RSA and when ElGamal asymmetric encryption
Considering that RSA, the algorithm, was published and fully described in 1978, several years before RSA, the company, was actually founded (in 1982), your assertion is dubious. It would imply that not only NSA paid the company to modify the algorithm, but also gave them access to some time travel technology so that they may get back to 1978 to enact the said modification. (I guess I am in denial of the NSA time travelling powers. Shame on me.)
Nov
26
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
I am not saying that a "quantum-threatened" asymmetric encryption algorithm can be used safely for key agreement even in the presence of an attacker with a quantum computer. What I am saying is that any asymmetric encryption algorithm can be used for key agreement; so any quantum-safe asymmetric encryption algorithm is also a quantum-safe key agreement algorithm.
Nov
23
comment Three-way hash collision
When $n$ is large, $n^3/6$ and $n(n-1)(n-2)/6$ are almost the same thing. When talking about approximations (as is the case here), this kind of shortening is valid.
Nov
2
comment Openssl & RSA : how many public exponents are possible?
@owlstead: if you use RSA without a proper padding procedure, then it is malleable, and this is easier to exploit if $e$ is small. However, the issue there is not a small $e$, but lack of proper padding.
Oct
24
comment AES-GCM Disadvantage
One may add a performance issue: the not-too-slow implementations of GCM use tables that exhaust L1 caches on small architectures (like the 32-bit Mips found in cheap home routers). It has been reported that on such systems, EAX mode outperforms GCM.
Oct
23
comment Interpretation of the results of NIST (p)NRG suite
Here it is the other way round. Usually, in statistics, you want to detect a non-random effect (e.g. a correlation between a specific gene mutation and a given illness), so you want a small p-value, that would mean "no way this is pure luck, there must be some correlation". Here we really don't want correlations or biases, so we want big p-values.
Sep
18
comment What is the length of an RSA signature?
That trick can be extended; e.g. you can skip a complete byte (8 bits) if the verifier is ready to compute 256 RSA verifications, while it is trying to guess the missing bits. Maybe more importantly, in ISO/IEC 9796-2, part of the signed data can be embedded "for free" in the signature, so while the signature value has size $n$ bits (or $n-1$ with the trick you describe), the overhead implied by the presence of the signature can be substantially smaller, depending on the situation.
Aug
25
comment Efficiently map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?
If all possible inputs are known a priori then you can put 64 million entries into exactly 64 million buckets with no collision -- but the mapping will have to know the 64 million entries. And the gist of my answer is that this cannot, in general, be done without using enough ROM or RAM to actually encode the 64 million possible values one way or another.
Aug
12
comment linear computations over bilinear pairings
Two elements in a group are opposite to each other if their product is 1 (or their sum is 0, if you use an additive notation for the group).
Aug
4
comment Point addition equation in projective co ordinates
Yes, you get the same point at the end. That's the idea of non-unique coordinates: you have the choice of representation, but they all stand for the same curve point.
Aug
3
comment Is perfect-forward secrecy achieved with RSA?
One may note that SSL used to support ephemeral RSA keys. It was defined as part of the "RSA_EXPORT" cipher suites, in SSL 3.0 and TLS 1.0 (support was dropped in TLS 1.1). When an RSA_EXPORT cipher suite was chosen and the server's public key length was 513 bits or more, the server had to send a ServerKeyExchange message with a RSA key pair in it. I am not sure many SSL implementations supported it, though.
Jul
15
comment Is RSA of a random nonce with no padding safe?
Using the rightmost (least significant) bits should be safe (the leftmost bits are a bit biased), but the argument is a bit more complex; using a hash function is safer.