Reputation
40,432
Next tag badge:
130/100 score
19/20 answers
Badges
6 94 162
Newest
 Necromancer
Impact
~996k people reached

Jan
29
comment How does one calculate a primitive root for Diffie-Hellman?
@Broseph: actually $q$ needs to be more than $2t$ bits long. The reason is that a discrete logarithm can be broken in two ways: either generically (based on the size of $q$), or with index calculus (based on the size of $p$). Index calculus is sub-exponential, meaning that you must make $p$ much bigger. In practice, to get "80-bit security", you need $q$ to be at least 160 bits, and $p$ should be at least 1000 bits. If you choose $p = 2q+1$, then the criterion on $p$ is the one that matters (for an 1000-bit $p$, a 999-bit $q$ is overkill, but you need a $p$ that big anyway).
Jan
23
comment ECDSA Compressed public key point back to uncompressed public key point
@Myath: in binary curves it is a bit more complex to explain, but a rather efficient compression method still exists. I have updated my answer with some extra explanations.
Jan
3
comment Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
@Myath: ah no, that's the tricky point. If the server proceeds with a random key in case of bad padding, an inconsistent Finished does NOT reveal that the padding was bad -- maybe the padding was good, and the server merely used whatever pre-master secret it thus obtained (and is unknown to the attacker).
Nov
5
comment Can ECDSA signatures be safely made “deterministic”?
32 bytes, so 256 bits. There are roughly 2^256 valid signatures for a given message and private key. They correspond to the roughly 2^256 possible values for the internal value k (the one which is supposed to be generated randomly in "standard ECDSA", and is generated deterministically in deterministic ECDSA).
Nov
1
comment Is it possible to reduce the size of an RSA key?
Since a 2048-bit RSA key is commonly said to be "112-bit equivalent", we could even lower the seed length to 112 bits with no loss in security. We may even scrape a few bits because each try in brute force attack would require, on average, a few hundreds of GCD with big integers, and that's not exactly cheap. On the other hand, take note that regenerating the key from the seed will be rather expensive, likely intolerably so in many embedded systems.
Oct
11
comment Weaknesses of RFC6628
We can add that for all password-based authentication protocols, what the server knows must allow for offline dictionary attacks, since an attacker who could get a complete snapshot of the server could simulate a client and a server on his own machines, and see when the simulated server is content with the password provided by the simulated client. This is rather unavoidable; thus, it is not a vulnerability of SRP specifically, but rather a vulnerability of authenticating clients with passwords.
Sep
30
comment Need some understanding on RSA public key exponent
It should be noted that when you generate a RSA key pair, you need to invert $e$ modulo $p-1$ and $q-1$; the natural algorithm for that is the extended GCD (binary GCD is easiest to implement) so you end up computing the GCD anyway.
Aug
12
comment Can ECDSA signatures be safely made “deterministic”?
Deterministic signatures allow for easier tests of implementations -- you use a known private key, inject a known message to sign, and see if the output is the expected signature. If you do not get to choose or at least know the private key, then deterministic generation is not enforceable.
Aug
12
comment Can ECDSA signatures be safely made “deterministic”?
@Jus12: you cannot verify from the outside whether the signature was done deterministically or not -- except by asking twice for the same signature. If you have a black box that computes signatures, make it sign twice the same data; if you get twice the same output, then chances are that the signature algorithm is deterministic. On a single signature, by design, you should not be able to tell how the internal k value was generated.
Jul
27
comment Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
@ddddavidee: thanks; I fixed the link in the answer.
Jul
16
comment Unpredictability of X.509 serial numbers
Integers are integers -- they are not bounded, otherwise we call them modular integers. It so happens that modern computers are most comfortable with integers modulo 32 or 64 bits (i.e. "32-bit or 64-bit integers") but they can still handle larger integers, as they do for RSA. For backward compatibility, X.509 (RFC 5280) says that the serial number shall be positive and its encoded value should fit in 20 bytes, which means that you have 159 bits to play with (serial number shall be between 0 and 2^159-1, inclusive).
Jul
12
comment Is this commutative encryption protocol secure?
To my knowledge, nobody has found yet a way to do a secure key exchange with only symmetric cryptography algorithms. This does not prove that it is impossible, only that if it can be done then it is probably non-obvious and quite tricky.
Jun
14
comment Meaning of entropy of a bitstring in NIST SP 800 - 90A
If passing tests was enough, competitions like eSTREAM would be meaningless. Anyone can run some statistical tests on a PRNG; but it takes years and many cryptographers to assess the actual security.
Jun
14
comment Meaning of entropy of a bitstring in NIST SP 800 - 90A
What I mean is that while statistics can detect things that attackers also know, attackers may know things that statistics do not detect. E.g. for a purportedly "strong" PRNG, if a statistical test detects a bias, then the PRNG is weak; but if the test detects nothing, then one must not conclude that the PRNG is strong. In practice, even bad PRNG are "perfect" from a statistical point of view.
May
12
comment How can I convert a DER ECDSA signature to ASN.1?
It is specified in the standard for DHE parameters, and in the other standard for ECDHE parameters. In the former case (DHE), it is the concatenation of the client random, the server random, and the encoded DH values (TLS encoding, not ASN.1/DER). With ECDHE, this is an encoding of the curve description and the server ECDH public value, this time without the client and server randoms.
Apr
7
comment How can rainbow tables be used for a dictionary attack?
@FredericoSchardong: see this article for some thorough analysis. It is not an easy read. Informally, when you build rainbow/Hellman tables, you accumulate chains with distinct end points; the more chains you insert, the higher the probability that the next chain merges with one already in the table, and thus was lost CPU. At some point it no longer is worth it; you'd better start a new table. The "1.7" factor comes from that effect.
Mar
11
comment RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?
In their article, the EdDSA authors mostly say that: "Standard PRF hypotheses imply that this pseudorandom session key r is indistinguishable from a truly random string generated independently for each M, so there is no loss of security". This is a bit too terse to be called "extensive analysis" but it makes sense. For more analysis, you may read the Leurent & Nguyen article cited from RFC 6979 (under the reference "LN2009"); that article includes some analysis and pointers.
Dec
6
comment When to use RSA and when ElGamal asymmetric encryption
Considering that RSA, the algorithm, was published and fully described in 1978, several years before RSA, the company, was actually founded (in 1982), your assertion is dubious. It would imply that not only NSA paid the company to modify the algorithm, but also gave them access to some time travel technology so that they may get back to 1978 to enact the said modification. (I guess I am in denial of the NSA time travelling powers. Shame on me.)
Nov
26
comment What is the post-quantum cryptography alternative to Diffie-Hellman?
I am not saying that a "quantum-threatened" asymmetric encryption algorithm can be used safely for key agreement even in the presence of an attacker with a quantum computer. What I am saying is that any asymmetric encryption algorithm can be used for key agreement; so any quantum-safe asymmetric encryption algorithm is also a quantum-safe key agreement algorithm.
Nov
23
comment Three-way hash collision
When $n$ is large, $n^3/6$ and $n(n-1)(n-2)/6$ are almost the same thing. When talking about approximations (as is the case here), this kind of shortening is valid.