D.W.

7,959 reputation

826

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	2 hours ago
stats	profile views	137

	7,959 reputation	bio	website		visits	member for	1 year, 9 months
826 badges		location			seen	2 hours ago

summary answers questions tags badges favorites bounties reputation activity

374 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 15	comment	DLP based crypto systems with multiple independent generators @HenrickHellström, "Was that not clear?" - Sorry, no, I didn't understand that part of the question. If the generators are per-user, why wouldn't you generate both of them randomly afresh each time you generate a new public key? Why would you bother with half measures?
Mar 15	comment	DLP based crypto systems with multiple independent generators For instance, FIPS doesn't require that everyone else should be able to verify I generated my RSA key correctly. Why should a dlog-based cryptosystem be any different? Answer: it's not. There's no need for that kind of verification (and FIPS doesn't require it).
Mar 15	comment	DLP based crypto systems with multiple independent generators @HenrickHellström, I think you are misinterpreting FIPS. FIPS requires verifiable algorithms for domain parameter generation, i.e., for common parameters, since the interests of the person generating the parameters may differ from the interests of the people using the parameters. That's one thing. But it doesn't require verifiability for single-user parameters.
Mar 14	comment	How to perform Multiplicative Inverse Modulo in IDEA I can't understand your example or your explanation of what you have tried. Do you want to try to edit it, to explain more clearly?
Mar 11	comment	Understanding Feldman's VSS with a simple example All you need is that $p,q$ are both prime and that the discrete logarithm in the size-$q$ subgroup of $(\mathbb{Z}/p\mathbb{Z})^*$ is hard. This is the same as the requirement for, e.g., ElGamal or DSA. So, use any standard algorithm for generating such $p,q$, or any such $p,q$. Or, randomly pick a random 160-bit value $q$, test if it is prime, pick a random 1888-bit value $k$, and test if $p=kq+1$ is prime; repeat until both $p,q$ are prime (there are ways to optimize this so it runs faster, but this will work).
Mar 8	comment	How difficult is it to check if a group element is in a sub group? The answer depends upon the group, and potentially upon how group elements are represented. What group did you have in mind?
Mar 6	comment	Possibility of factorisation of rsa modulus due to vulnerability in java implementation code @kumaravi, no, it is not good enough. I recommend you read poncho's answer again, particularly the part beginning "The reason is..."
Mar 6	comment	What data is saved in RSA private key? I'm not sure I understand the question. Perhaps you could elaborate a bit. What are you trying to accomplish? Why do you want to know? How will you use the answer? Some information on those sorts of topics might increase the odds that we can offer an answer that will be useful to you.
Mar 4	comment	How to secure a mental poker protocol? @ThePiachu, the Wikipedia article you link to includes citations for [SCH98], [STA05], and [GOL05]. Have you read those articles? Do you understand their protocols? They would be a good place to start. No one here is likely to write a detailed tutorial that will spare you the need to read the original research papers. However, if you do the reading and get as far as you can on your own, if you find you get stuck somewhere specific, it's possible people might be able to help you if you can explain where you got stuck and what you tried.
Mar 4	comment	Security of Pohlig-Hellman exponentation cipher? @ThePiachu, I encourage you to ask you to ask a question about your particular application, instead of asking about Pohlig-Hellman. Don't assume Pohlig-Hellman is the best solution; let us advise you on the best solution. There may be better solutions to your problem. [The question you link to is an excellent example of that: for that problem, Pohlig-Hellman is the wrong solution (for some reason the OP has become focused on it, but it's not the best solution); the right solution is based upon private set-intersection protocols, which solve exactly the problem that OP had.]
Mar 3	comment	Simple RC4 key generation scheme @cvoque, ahh, my mistake! Sorry for mis-interpreting the question. I've edited my answer just now to reflect what you were actually asking. Sorry about my confusion.
Mar 3	comment	Is solving a modular linear equation a hard problem when the coefficient is not an invertible element? Please be more specific about what you mean by "solving". There may be multiple solutions (multiple values of $x$ that satisfy the equation). Do you want to find one solution, all solutions, or a specific solution?
Mar 3	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? @PaŭloEbermann, I don't think you did anything wrong. The original question was poorly posed: it asked for an implementation, but it didn't specify what particular scheme it wanted an implementation of. There are many schemes in this space, and it's odd to ask for an implementation without knowing which scheme you want an implementation of. I think your edits improved the question.
Mar 2	comment	What is “Blinding” used for in cryptography? @HenrickHellström, the defense I have described (namely, blinding $x$) is a standard defense against timing attacks on RSA. To my knowledge, this method of blinding defends against all known timing attacks against RSA (i.e., against all attacks that are capable of recovering $d$). I do not know of any timing attack that works if $x$ is blinded in this way (i.e., any timing attack that can recover $d$ without knowledge of the value-to-be-raised). If you know of anything that contradicts this, I'd certainly be interested to hear.
Mar 2	comment	Finding roots in $\mathbb{Z}_p$ @fgrieu, good question. Actually, now that I take another look at those two papers, the running time seems to be linear in $n$, whereas we'd really want a running time that is poly($\log n$). I don't know whether there are efficient algorithms for large $n$.
Mar 2	comment	Timing attack on modular exponentiation Since you asked about blinding, some info on blinding is available on this site and on Wikipedia.
Mar 2	comment	Timing attack on modular exponentiation Welcome to Crypto.SE, Smit Johnth. Please understand: we expect you to do a little bit of background research on your own before asking here. In particular, information on this is already available on Wikipedia. There's also info elsewhere on this site (e.g., crypto.stackexchange.com/q/3775/351). I recommend you do a little more background reading, then come back if you have a question not already answered in standard resources.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? @sashank, Your question is very broad. It would help if you gave more specific requirements specific to your particular problem, about exactly what algebraic structure you have on $A$ and $B$ in your particular application. Also, on this site we expect you to do some background research of your own to learn what is already known.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? sashank, I think you might need to specify more precisely exactly what you mean by homomorphic hashing.
Feb 23	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? Your question is based upon the assumption that nobody has considered this alternative. That assumption is wrong. Please rephrase the question to avoid making such tendentious assumptions.