20,515 reputation
32573
bio website
location
age
visits member for 3 years, 2 months
seen 3 hours ago

Dec
18
comment Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
@user52914, hire a cryptographer to prove it for you? At a meta level: this has now deviated pretty far from the original topic of this question, so I don't think it's on-topic on this question. FYI, Crypto.SE is not a discussion forum: it's a question-and-answer site. One question per question. If you have a question about the design of a particular system, I think you'll need to post a separate question. If you do that, make sure you post detailed enough information about the design of the system that analysis is possible.
Dec
18
answered Why is h(m||k) insecure?
Dec
18
answered How to generate a random integer in interval $[1, 2^n-1]$ from random integer in interval $[0, 2^n-1]$?
Dec
18
answered Tweaking textbook RSA to make the encryption a Pseudorandom function
Dec
17
revised Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
added 333 characters in body
Dec
17
comment Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
@user52914, as far as I can see, nothing terribly bad should happen. Releasing $y_1+y_3$ and $y_2+y_3$ doesn't reveal much more information than releasing $y_1-y_2$. And releasing $y_1-y_2$ does not help find $y_1$ or $y_2$ (though if you somehow manage to learn one of $y_1$ or $y_2$, obviously knowledge of $y_1-y_2$ reveals the other).
Dec
16
answered Is there a big RSA Data Set
Dec
16
answered Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
Dec
12
revised Why doesn't this replay attack work on ECDSA?
added 1473 characters in body
Dec
12
answered Why doesn't this replay attack work on ECDSA?
Dec
12
answered S-box with differential uniformity = 2
Dec
9
answered Why is OCB-AES mode not becoming a standard for authenticated encryption?
Dec
9
answered Deterministic key generation
Dec
6
revised Speeding up partially known plaintext preimage recovery attack on MD5
added 956 characters in body
Dec
6
comment Speeding up partially known plaintext preimage recovery attack on MD5
@poncho, ahh, yes, you are (of course) absolutely right. I missed that modchan told us the length of B. I've edited my answer accordingly. Thank you!
Dec
6
comment How can I add more rounds to AES?
@quantumSoup, yes, but Bruce also wrote: "choosing the number of rounds for a cipher is a combination of experience and guesswork. The AES rounds of 10, 12, and 14 were arbitrary, but represented the designers' best guess as to what would be secure. In my 2000 paper, I recommended increasing the number of rounds considerably, based on my best guess at the time. The round recommendations I gave above -- 16, 20, 28 -- are designed to restore AES's security cushion. They're off the top of my head, and certainly not the last word on the topic."
Dec
6
answered Speeding up partially known plaintext preimage recovery attack on MD5
Dec
5
comment Webcam random number generator
@Thomas, Usually, the purpose of cryptography is to be secure against malicious attackers, not to "be creative". If you want to be secure, then you should use best practices, even if it feels like that's "repeating itself". A creative-but-insecure solution isn't going to help anyone.
Dec
5
answered How can I add more rounds to AES?
Dec
4
reviewed Approve suggested edit on Does RSA-OEAP have integrity and authenticity properties?