D.W.

8,825 reputation

828

bio	website
	location
	age
visits	member for	1 year, 10 months
	seen	2 days ago
stats	profile views	140

	8,825 reputation	bio	website		visits	member for	1 year, 10 months
828 badges		location			seen	2 days ago

summary answers questions tags badges favorites bounties reputation activity

404 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 3	comment	Simple RC4 key generation scheme @cvoque, ahh, my mistake! Sorry for mis-interpreting the question. I've edited my answer just now to reflect what you were actually asking. Sorry about my confusion.
Mar 3	comment	Is solving a modular linear equation a hard problem when the coefficient is not an invertible element? Please be more specific about what you mean by "solving". There may be multiple solutions (multiple values of $x$ that satisfy the equation). Do you want to find one solution, all solutions, or a specific solution?
Mar 3	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? @PaŭloEbermann, I don't think you did anything wrong. The original question was poorly posed: it asked for an implementation, but it didn't specify what particular scheme it wanted an implementation of. There are many schemes in this space, and it's odd to ask for an implementation without knowing which scheme you want an implementation of. I think your edits improved the question.
Mar 2	comment	What is “Blinding” used for in cryptography? @HenrickHellström, the defense I have described (namely, blinding $x$) is a standard defense against timing attacks on RSA. To my knowledge, this method of blinding defends against all known timing attacks against RSA (i.e., against all attacks that are capable of recovering $d$). I do not know of any timing attack that works if $x$ is blinded in this way (i.e., any timing attack that can recover $d$ without knowledge of the value-to-be-raised). If you know of anything that contradicts this, I'd certainly be interested to hear.
Mar 2	comment	Finding roots in $\mathbb{Z}_p$ @fgrieu, good question. Actually, now that I take another look at those two papers, the running time seems to be linear in $n$, whereas we'd really want a running time that is poly($\log n$). I don't know whether there are efficient algorithms for large $n$.
Mar 2	comment	Timing attack on modular exponentiation Since you asked about blinding, some info on blinding is available on this site and on Wikipedia.
Mar 2	comment	Timing attack on modular exponentiation Welcome to Crypto.SE, Smit Johnth. Please understand: we expect you to do a little bit of background research on your own before asking here. In particular, information on this is already available on Wikipedia. There's also info elsewhere on this site (e.g., crypto.stackexchange.com/q/3775/351). I recommend you do a little more background reading, then come back if you have a question not already answered in standard resources.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? @sashank, Your question is very broad. It would help if you gave more specific requirements specific to your particular problem, about exactly what algebraic structure you have on $A$ and $B$ in your particular application. Also, on this site we expect you to do some background research of your own to learn what is already known.
Feb 27	comment	Are there any practical implementation of a homomorphic hashing or signature scheme? sashank, I think you might need to specify more precisely exactly what you mean by homomorphic hashing.
Feb 23	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? Your question is based upon the assumption that nobody has considered this alternative. That assumption is wrong. Please rephrase the question to avoid making such tendentious assumptions.
Feb 23	comment	Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model? Samuel, can you edit your question to fix any such typos? These details are important. You can click the little "edit" button at the bottom of your post to correct it. Thank you!
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, I've edited my answer to give a natural answer that arises in distinguishing two probability distributions, but I'm starting to get the impression that I'm not going to be able to help you until you can more precisely state exactly what you want to know (and what you've already tried and where you got to stuck).
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, sorry, I can't make any sense of your question. I think you must have some hidden assumptions, or must be asking a different question than what you really want to know. What does it mean for an algorithm to take exponential time when trying to distinguish two probability ensembles/ It just means that the running time is exponential. I really don't understand what the confusion is. (If you are asking for a natural example of an exponential time algorithm for distinguishing two probability distributions, that's different; if so, edit your question!)
Feb 22	comment	Computational indistinguishability and example of non polynomial algorithm @wmnorth, any algorithm that spends, say, exponential time doing some computation before producing an output. (I suspect I must not be understanding your question; why don't you try explaining what you real confusion is?) Have you studied running time analysis of algorithms? If not, any good algorithms textbook should have something on big-O notation and running time analysis -- I very much recommend you read it.
Feb 18	comment	AES encryption with shared IV If you follow this strategy, make sure to use a different key for generating the IV from the counter than you use for the actual encryption (where you use that IV), otherwise bad things could possibly happen.
Feb 16	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) @TheLazyEngineer, it sounds like you might be making one of the most common crypto mistakes around: you are using encryption without message authentication, which is usually a mistake. It's important to use message authentication, to prevent forgery (and by the way, if you do, then your concerns about avalanche will go away).
Feb 15	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) I think PRESENT is optimized for hardware implementations. I don't know whether there's a variant with a 44-bit block size. If you're OK with a 64-bit or larger block size, Skipjack and RC5 are also worth a look: they're very convenient for embedded microprocessors.
Feb 15	comment	Low complexity implementation of a small blocksize cipher (< 64 bit) @Thomas, yes. I agree with everything you wrote. On your question: Yes, $1 - e^{-b^2/2^{45}}$ is a more accurate estimate. However, if $b$ is much less than $2^{22}$, then $1 - e^{-b^2/2^{45}}$ is approximately equal to $b^2/2^{45}$ (using the approximation $e^{-x} \approx 1-x$ when $x>0$ is much smaller than 1).
Feb 13	comment	Can one reduce the size of ECDSA-like signatures? "the Prover commits to a random value $k$ and then proves that he knows $x/k$" - This is a nifty insight. Thank you! It seems like it can't be exactly correct: it doesn't seem like it's the Schnorr protocol adapted to prove knowledge of $x/k$, due to the presence of $h$. Intuitively I see why this reasoning makes a connection plausible, though. Is there any way to make this more formal/precise/accurate?
Feb 12	comment	Is semantic security important in a hybrid cryptosystem? You have two questions here: (a) is semantic security important, and (b) should we use PKCS #1 1.5 encryption? I suggest you might want to split off (b) into a separate question.