D.W.

8,057 reputation

827

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	43 mins ago
stats	profile views	137

	8,057 reputation	bio	website		visits	member for	1 year, 9 months
827 badges		location			seen	43 mins ago

summary answers questions tags badges favorites bounties reputation activity

381 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 2	comment	What is “Blinding” used for in cryptography? @HenrickHellström, the defense I have described (namely, blinding $x$) is a standard defense against timing attacks on RSA. To my knowledge, this method of blinding defends against all known timing attacks against RSA (i.e., against all attacks that are capable of recovering $d$). I do not know of any timing attack that works if $x$ is blinded in this way (i.e., any timing attack that can recover $d$ without knowledge of the value-to-be-raised). If you know of anything that contradicts this, I'd certainly be interested to hear.
Mar 2	comment	Finding roots in $\mathbb{Z}_p$ @fgrieu, good question. Actually, now that I take another look at those two papers, the running time seems to be linear in $n$, whereas we'd really want a running time that is poly($\log n$). I don't know whether there are efficient algorithms for large $n$.
Mar 2	comment	Timing attack on modular exponentiation Since you asked about blinding, some info on blinding is available on this site and on Wikipedia.
Mar 2	comment	Timing attack on modular exponentiation Welcome to Crypto.SE, Smit Johnth. Please understand: we expect you to do a little bit of background research on your own before asking here. In particular, information on this is already available on Wikipedia. There's also info elsewhere on this site (e.g., crypto.stackexchange.com/q/3775/351). I recommend you do a little more background reading, then come back if you have a question not already answered in standard resources.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? @sashank, Your question is very broad. It would help if you gave more specific requirements specific to your particular problem, about exactly what algebraic structure you have on $A$ and $B$ in your particular application. Also, on this site we expect you to do some background research of your own to learn what is already known.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? sashank, I think you might need to specify more precisely exactly what you mean by homomorphic hashing.
Feb 23	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? Your question is based upon the assumption that nobody has considered this alternative. That assumption is wrong. Please rephrase the question to avoid making such tendentious assumptions.
Feb 23	comment	Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model? Samuel, can you edit your question to fix any such typos? These details are important. You can click the little "edit" button at the bottom of your post to correct it. Thank you!
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, I've edited my answer to give a natural answer that arises in distinguishing two probability distributions, but I'm starting to get the impression that I'm not going to be able to help you until you can more precisely state exactly what you want to know (and what you've already tried and where you got to stuck).
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, sorry, I can't make any sense of your question. I think you must have some hidden assumptions, or must be asking a different question than what you really want to know. What does it mean for an algorithm to take exponential time when trying to distinguish two probability ensembles/ It just means that the running time is exponential. I really don't understand what the confusion is. (If you are asking for a natural example of an exponential time algorithm for distinguishing two probability distributions, that's different; if so, edit your question!)
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, any algorithm that spends, say, exponential time doing some computation before producing an output. (I suspect I must not be understanding your question; why don't you try explaining what you real confusion is?) Have you studied running time analysis of algorithms? If not, any good algorithms textbook should have something on big-O notation and running time analysis -- I very much recommend you read it.
Feb 18	comment	AES encryption with shared IV If you follow this strategy, make sure to use a different key for generating the IV from the counter than you use for the actual encryption (where you use that IV), otherwise bad things could possibly happen.
Feb 16	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) @TheLazyEngineer, it sounds like you might be making one of the most common crypto mistakes around: you are using encryption without message authentication, which is usually a mistake. It's important to use message authentication, to prevent forgery (and by the way, if you do, then your concerns about avalanche will go away).
Feb 15	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) I think PRESENT is optimized for hardware implementations. I don't know whether there's a variant with a 44-bit block size. If you're OK with a 64-bit or larger block size, Skipjack and RC5 are also worth a look: they're very convenient for embedded microprocessors.
Feb 15	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) @Thomas, yes. I agree with everything you wrote. On your question: Yes, $1 - e^{-b^2/2^{45}}$ is a more accurate estimate. However, if $b$ is much less than $2^{22}$, then $1 - e^{-b^2/2^{45}}$ is approximately equal to $b^2/2^{45}$ (using the approximation $e^{-x} \approx 1-x$ when $x>0$ is much smaller than 1).
Feb 13	comment	Can one reduce the size of ECDSA-like signatures? "the Prover commits to a random value $k$ and then proves that he knows $x/k$" - This is a nifty insight. Thank you! It seems like it can't be exactly correct: it doesn't seem like it's the Schnorr protocol adapted to prove knowledge of $x/k$, due to the presence of $h$. Intuitively I see why this reasoning makes a connection plausible, though. Is there any way to make this more formal/precise/accurate?
Feb 12	comment	Is semantic security important in a hybrid cryptosystem? You have two questions here: (a) is semantic security important, and (b) should we use PKCS #1 1.5 encryption? I suggest you might want to split off (b) into a separate question.
Feb 11	comment	Attack XOR encryption of binary data compressed by zlib with known key length (very short key) It might help to have a more detailed specification of the situation. What compression algorithm was the data compressed with? DEFLATE? What does "I'm stuck with" mean? Do you have known plaintext? In other words, do you know the entire input to zlib? Part of the input? Do you know anything about the key, or is a uniformly random 64-bit value?
Feb 10	comment	How to bring little changes in DES algorithm @JeffFerland, A request: I'd prefer that moderators not migrate bad questions; bad questions should be closed with feedback to the question-asker about how to improve them so they can be re-opened, rather than migrated to some other site to deal with. Crypto.SE has extensive policies on "homework" questions in its meta site, and this question doesn't meet any of those standards.
Feb 9	comment	Two step encryption Please don't cross-post the same question on two StackExchange sites; that's discouraged. Please pick one to keep, and for the other, click the "flag" button to flag the moderator to ask them to close it.