20,164 reputation
32371
bio website
location
age
visits member for 3 years
seen 58 mins ago

Apr
29
comment Pseudocode for constant time modular exponentiation
You might have missed the "constant time" in the title (and also mentioned once more in the question). I don't blame you, because that wasn't emphasized in the question as it might have been, and the question didn't mention what prior research he'd done (a shortcoming of the question). But I don't think Alex Gaynor was looking for a generic description of the RSA algorithm; I think he was looking for a description of how to make a constant-time implementation of RSA. That said, I agree that the question could have been clearer.
Apr
29
comment Pseudocode for constant time modular exponentiation
@figlesquidge, I beg to differ. It does answer the question (just not in way the author had expected). This is an XY problem: the author wants a constant-time RSA implementation (that's the X) and thinks the right approach is to implement it himself even though he doesn't understand the math (Y). I'm telling him that Y is not the answer to X; that the right answer is Z (use well-vetted code, or hire a cryptographer). P.S. "Don't do it" is a perfectly acceptable answer if you explain why: meta.stackexchange.com/q/8891/160917
Apr
29
comment Pseudocode for constant time modular exponentiation
@CodesInChaos, The fact that GnuPG failed does not mean that it is a good idea for a beginner who lacks a strong math background to try to implement RSA on their own. If the OP cannot understand mathematical descriptions of solutions to the problem, the OP probably shouldn't be trying to implement this himself (maybe he needs to hire a qualified cryptographer). Would you hire a random person off the street to design a bridge, if they told you they couldn't understand some of the core elements of bridge engineering (finite elements, differential equations, structural modeling)?
Apr
28
comment Simplified Key Wrapping to Achieve Only Confidentiality?
Ignoring authenticity/integrity is a really bad idea. It has led to successful attacks on confidentiality in the past. I strongly recommend against this sort of thing; use authenticated encryption or an authenticated key wrap algorithm that does provide integrity + authenticity.
Apr
26
comment Tiger Tree Hash vs generic Merkle Tree
Would you care to edit your question to define TTH? Maybe spell out the acronym, give a link, etc.? Also, I encourage you to describe what research you've already done to try to answer the question on your own.
Apr
26
comment Timestamping using a hashed linked list and public known events
@jliendo, I've edited my answer accordingly. The bottom line remains the same.
Apr
26
comment Zero-knowledge proof of a product
This is an excellent start, but it proves that $xy \equiv z \pmod q$, rather than that $xy=z$. I think if you choose $q$ to be $>2k$ bits long, and combine it with a range proof of the size of $x,y,z$, though, this might work. Thank you!
Apr
26
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
@fgrieu, awesome, thank you for the detailed comments! Would you like to either create your own answer or to edit this answer into a form that addresses these issues? I'm not quite sure how to take into account the first issue you mention (about 1% chance of success), so would need help on that. Thank you again!
Apr
26
comment Can I prove set membership and uniqueness without revealing the element?
P.S. I see: the Wikipedia article on commitment schemes is a bit sucky, and it has led you astray. Wikipedia seems to imply that $C(x)=g^x$ is a commitment scheme, but in fact, that's not a good commitment scheme. The Wikipedia article does go to admit that such a scheme is not hiding, but it fails to connect the dots and realize this means that the scheme wasn't a (secure) commitment scheme after all, and thus does not make a good example of a commitment scheme. So, don't rely upon Wikipedia as your main source of information about commitment schemes.
Apr
26
comment Can I prove set membership and uniqueness without revealing the element?
@DrLecter, yeah, you definitely have a misconception about commitment schemes. $g^a$ is not a secure commitment to $a$. It is not hiding (neither computationally hiding nor information-theoretically hiding). As a result, it is not classified as a secure commitment scheme. A secure commitment scheme must be both binding and hiding. Therefore, what you are talking about is not a DL commitment -- it's not a commitment at all; it's just a broken thing that doesn't work. Of course, when I mention using a commitment scheme, I assume you use a secure commitment scheme, not something broken.
Apr
25
comment Can I prove set membership and uniqueness without revealing the element?
@DrLecter, I think you have a confusion/misconception about DL commitments. I'm not sure what specifically you have in mind when you mention "DL commitments", but any commitment scheme (whether information-theoretically hiding or computationally hiding) will conceal what was committed to -- nothing is leaked. It doesn't matter whether the value being committed to is low entropy or not; secure commitment schemes promise not to leak what was committed, even if the value has low entropy. If it's not hiding, it's not a secure commitment scheme. For instance, $C(x)=g^x$ isn't secure.
Apr
25
comment Nonlinearity of the J-K Flip Flop
@WilliamHird, I think you might have a misconception. It sounds like you want to design a secure stream cipher, and your approach is to try to find a function that in isolation has some combinatorial properties. This has two problems: (1) to design a secure stream cipher, you need to look holistically at the entire design; you can't just pick out one component/function used in the stream cipher and say that "since it has properties X,Y,Z, the cipher is secure"; (2) designing secure ciphers is very hard, and you're unlikely to do better than existing state-of-the-art schemes.
Apr
21
comment Stateless hash based public key cryptography?
@HenrickHellström, the blog post (the first URL) has some more details. We save only the first level -- that's generated during key generation and treated as part of the private key. We regenerate the subtrees on the fly as needed. How are they generated? They can be generated via a GGM construction from a seed (e.g., computed as a PRF of some master key that's part of the private key, plus an identifier that identifies which subtree we're looking at). There's no need to save the subtrees, since they can be generated deterministically on demand as needed. Does that answer your questions?
Apr
17
comment Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?
Can you explain what you mean by "compose the modulus of some other quadratic ring"? Do you mean that instead of multiplying two integers to get the modulus, we multiply two elements of some quadratic ring? Have you worked out what the corresponding version of Euler's lemma is? What is the order of the multiplicative group of such rings? What's the motivation for your question? Are you hoping to get a cryptosystem that will be faster than RSA, for a given security level?
Apr
16
comment Are there any elliptic curve asymmetric encryption algorithms?
Thanks, DrLecter! Makes sense! On re-reading the question, the question is not as clear as I initially thought. The question says "Is there an algorithm which employs elliptic curve cryptography, fast asymmetric encryption, [...]" - I took that to mean it wants the encryption operation to be fast, like in RSA, but it's entirely possible that might not be the right reading. Perhaps the original author will take a moment to edit the question and make what he/she is looking for clearer.
Apr
16
comment Are there any elliptic curve asymmetric encryption algorithms?
Those are all good schemes, but doesn't the question ask for encryption to be fast like in RSA? Do any of these schemes support encryption that is as fast as RSA's encryption? As far as I can tell, none of them are -- have I misunderstood? I think there's a tradeoff: RSA encryption will be faster than the ECC schemes; the ECC schemes will be faster for everything else, and will have shorter keys.
Apr
14
comment In Pedersen Key Distribution, can the public key be persistent?
Are you saying there is an attack if you re-use $(p,g,h)$ too many times? Are you saying that existing proofs don't make any promises if you re-use $(p,g,h)$ too many times? Can you give some intuition for what the nature of the alleged trouble is? I find it hard to believe that there is a real problem. It is bog-standard to re-use the public key $(p,g,h)$ in discrete-log-based cryptosystems; is there any reason that Pederson would be different?
Apr
7
comment How could Fully Homomorphic Encryption support power operations?
My perspective: The answer says that XOR and AND are universal, and thus any operation, including addition and multiplication, can be built out of XOR and AND gates. That is a correct statement. So the answer seems fine to me. But we can agree to disagree (or have a slightly different reaction) -- nothing wrong with that!
Apr
7
comment How could Fully Homomorphic Encryption support power operations?
@poncho, I don't understand your comment. This answer looks correct to me. The answer never says "ADD==XOR", does it? XOR and AND are universal; no need for NAND.
Apr
7
comment How could Fully Homomorphic Encryption support power operations?
You already answered your own question. "It enables arbitrary functions..." Power is a function.