Reputation
3,486
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
3 17
Newest
 Revival
Impact
~42k people reached

1d
comment Prime factorization
The length of the number does not matter at all for factorization to be hard or lake a long time. If you have a large number with billions of bits, but contains only very small prime factors, then it is still simple to factor and can probably be done within seconds to minutes. Anyway, the much more impacting property is the length of the prime factors
1d
comment Why use randomness in digital signature algorithms?
The slides state, that FDH is secure with at least 4096 bits, if you set limits on the oracle queries as stated a few slides earlier. The security proof is quite loose. I think the security of PSS was tight in the random oracle model, but I am not entirely sure atm.
2d
answered Why use randomness in digital signature algorithms?
2d
comment Determine encryption method with input and output
Unless you have more information, your best bet is trial and error. Guessing the encryption method is not cryptography - we assume the method to be known to a serious attacker. Maybe the javascripts of the website will tell you more about what is happening there.
2d
comment How are onetimepads distributed?
OTP has only a very limited scope where it is actually useful, it is more interesting from a theoretical point of view (that it is provable unbreakable - under the assumption that the key known only to the participiating parties and no one else): If you a) have a secure communication now and b) can make sure that the key is stored securely, then you can use OTP in the future to send a message. But the fact that the key needs to be as long as the message itself still limits it quite severely. The disc for a meeting in person or via courier are examples of that "save channel now".
Apr
22
answered Super-simple encryption of short strings
Apr
21
comment Different keys for clients but 1 key on server
Your device needs to tell the server anyway, who is sending a message or where the answer should be send back. If you use a proper KDF, then knowing the ID does not help finding the key for the device (assuming your master key is still save and long enough). If your scenario should also consider e.g. replay attacks, you probably should have some algorithm for key agreement for an actual session key.
Apr
20
answered Different keys for clients but 1 key on server
Apr
15
answered Asymmetric encryption that is secure for (almost) any foreseeable future
Apr
14
comment Prove there is PRG that is not necessarily one-to-one
What does this have to do with PRGs? From that definition, it might look like a PRF or a PRP, but that is something entirely different than a PRG. You can create a PRG from a PRF, but that is not what you are asking about.
Apr
13
comment Why do we get the following equation in case of a One Time Pad?
What is the meaning of index $i$ in this formula? It looks out of place. If you say $\sum_{m \in M}$, your $m$ already iterates over all messages. Especially since you don't define $i$ to be anything and it appears more than once, it leads to some possible confusion
Mar
30
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
I changed the third part a lot. Replays are gone, because actually you don't have an authentication scheme (my bad, sorry), but just a key exchange protocol without any computational hardness assumptions.
Mar
30
revised Is this a valid scheme to authenticate through a 'human-readable' certificate?
changed the large part, for better understanding
Mar
30
answered Would the Fiat Shamir identification scheme be more secure if I design it with an exponents higher than 2?
Mar
30
answered Is this a valid scheme to authenticate through a 'human-readable' certificate?
Mar
30
comment In modern definition, what is Enigma, and what caused its downfall?
All 8 points have been answered there. Pretty much everything in here is answered in any book about the history of cryptography. Btw. , your example for an often used phrase is not the one actually being used. It was mostly the full title of the commanding officer at the end, or the very static greeting of the weather report. Both much longer texts, which are publicly known.
Mar
30
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
Fortunately, movies and tv shows have a completely and utterly wrong image of breaking encryption. In reality, there is no way to distinguish a partially correct key. All those ideas of breaking a key or password symbol by symbol is just fiction.
Mar
25
comment Cycles in SHA256
That does not prevent cycles at all. All you do is to get different cycles. But as fgrieu pointed out in his answer: Most values don't belong to a cycle anyway. If the function was a permutation instead, every value would belong to a cycle.One more thing about the estimations of cycle lengths: Both random functions and random permutations can have many cycles of varying lengths. Quite sure, all those numbers are too high for either case.
Mar
25
comment Does perfect secrecy imply uniform ciphertext distribution?
Yes and no. First, you assume a uniform distribution over the keys. That is quite often done implicitly (and it is a good thing), but that is not necessary. And then you calculate the average over all keys, but that's something else than having an actual key. But without the context from the book, I can't tell you, what they actually meant.
Mar
25
comment Bit commitment, two blobs with same bit, without revealing it?
@poncho You're right. But that is one of the general ways to construct a commitment scheme from a public key encryption scheme: You just take a public key (in this case $n$ and $t$, and to find a correct $t$ you even need to know the trapdoor), and then you commit by encrypting the message. Unveiling is done by showing your random coins (and if needed the message).