Reputation
3,486
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
3 17
Newest
 Revival
Impact
~42k people reached

2d
comment Prime factorization
The length of the number does not matter at all for factorization to be hard or lake a long time. If you have a large number with billions of bits, but contains only very small prime factors, then it is still simple to factor and can probably be done within seconds to minutes. Anyway, the much more impacting property is the length of the prime factors
2d
comment Why use randomness in digital signature algorithms?
The slides state, that FDH is secure with at least 4096 bits, if you set limits on the oracle queries as stated a few slides earlier. The security proof is quite loose. I think the security of PSS was tight in the random oracle model, but I am not entirely sure atm.
Apr
23
comment Determine encryption method with input and output
Unless you have more information, your best bet is trial and error. Guessing the encryption method is not cryptography - we assume the method to be known to a serious attacker. Maybe the javascripts of the website will tell you more about what is happening there.
Apr
23
comment How are onetimepads distributed?
OTP has only a very limited scope where it is actually useful, it is more interesting from a theoretical point of view (that it is provable unbreakable - under the assumption that the key known only to the participiating parties and no one else): If you a) have a secure communication now and b) can make sure that the key is stored securely, then you can use OTP in the future to send a message. But the fact that the key needs to be as long as the message itself still limits it quite severely. The disc for a meeting in person or via courier are examples of that "save channel now".
Apr
21
comment Different keys for clients but 1 key on server
Your device needs to tell the server anyway, who is sending a message or where the answer should be send back. If you use a proper KDF, then knowing the ID does not help finding the key for the device (assuming your master key is still save and long enough). If your scenario should also consider e.g. replay attacks, you probably should have some algorithm for key agreement for an actual session key.
Apr
14
comment Prove there is PRG that is not necessarily one-to-one
What does this have to do with PRGs? From that definition, it might look like a PRF or a PRP, but that is something entirely different than a PRG. You can create a PRG from a PRF, but that is not what you are asking about.
Apr
13
comment Why do we get the following equation in case of a One Time Pad?
What is the meaning of index $i$ in this formula? It looks out of place. If you say $\sum_{m \in M}$, your $m$ already iterates over all messages. Especially since you don't define $i$ to be anything and it appears more than once, it leads to some possible confusion
Mar
30
comment Is this a valid scheme to authenticate through a 'human-readable' certificate?
I changed the third part a lot. Replays are gone, because actually you don't have an authentication scheme (my bad, sorry), but just a key exchange protocol without any computational hardness assumptions.
Mar
30
comment In modern definition, what is Enigma, and what caused its downfall?
All 8 points have been answered there. Pretty much everything in here is answered in any book about the history of cryptography. Btw. , your example for an often used phrase is not the one actually being used. It was mostly the full title of the commanding officer at the end, or the very static greeting of the weather report. Both much longer texts, which are publicly known.
Mar
30
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
Fortunately, movies and tv shows have a completely and utterly wrong image of breaking encryption. In reality, there is no way to distinguish a partially correct key. All those ideas of breaking a key or password symbol by symbol is just fiction.
Mar
25
comment Cycles in SHA256
That does not prevent cycles at all. All you do is to get different cycles. But as fgrieu pointed out in his answer: Most values don't belong to a cycle anyway. If the function was a permutation instead, every value would belong to a cycle.One more thing about the estimations of cycle lengths: Both random functions and random permutations can have many cycles of varying lengths. Quite sure, all those numbers are too high for either case.
Mar
25
comment Does perfect secrecy imply uniform ciphertext distribution?
Yes and no. First, you assume a uniform distribution over the keys. That is quite often done implicitly (and it is a good thing), but that is not necessary. And then you calculate the average over all keys, but that's something else than having an actual key. But without the context from the book, I can't tell you, what they actually meant.
Mar
25
comment Bit commitment, two blobs with same bit, without revealing it?
@poncho You're right. But that is one of the general ways to construct a commitment scheme from a public key encryption scheme: You just take a public key (in this case $n$ and $t$, and to find a correct $t$ you even need to know the trapdoor), and then you commit by encrypting the message. Unveiling is done by showing your random coins (and if needed the message).
Mar
25
comment Bit commitment, two blobs with same bit, without revealing it?
The computational problem for this is the quadratic residuosity problem. Basically, this is the Goldwasser-Micali encryption scheme utilized as commitment scheme.
Mar
23
comment Should I remove these use cases of MD5/SHA1 from my program?
Honestly, I have no idea about crypto libraries in PHP. But it seems, you are using the basic commands, while (at least today) the library also supports higher level protocols, like $cipher = new Crypt_AES(CRYPT_AES_MODE_CTR);and you can use PBKDF2, etc. However, this still doesn't say anything about the quality of that library, e.g. a question on security-SE talks about this. But if you want to achieve your high security, you should invest time in researching this.
Mar
23
comment How many attempts does it take to crack a 32-bit password hash with this scenario?
user13741 is right for this one. The reason is simple: If you hash different inputs, you can get the same hash value on several occasions. Basically, you got a $1/2^{32}$ probability for a success on every try. This is a geometric distribution, with estimated value at $2^{32}$ (if looking for one hash value). Subtracting $1$ from the exponent is applicable, when you brute force a key for a symmetric encryption, where you directly try out every possibility. For hashes, $2^{32}$ does not give you that $100\%$ chance.
Mar
23
comment Why would using a random seed with other variables be bad for ecrypting if you can't guess the key?
Because no one said it so far: Schneier's law: "any person can invent a security system so clever that she or he can't think of how to break it.". To sum up a modern point of view: something which has security only against ciphertext only attacks is considered insecure. Arguments like "but you can't guess X from Y" are almost always neglecting actual cryptographic advances during the last 30 years.
Mar
23
comment security of pairing based cryptography
I had only a quick glance, but they present an attack on one single specific group. Advances like these are achieved now and then, but techniques like these usually can not be generalized for every group. From a theoretical point of view: If you just assume to use a pairing friendly group, this is irrelevant. From a practical point of view: Pairing friendly curves are usually not implemented outside of research, because pairings are efficient only in a theoretical sense but not a practical one.
Mar
20
comment How dangerous is it to encrypt with AES 256 if the end user knows the unencrypted value?
Security decisions should never be made without the proper knowledge. Things like that lead to all those little pieces of negative publicity, because someone botched something trivial royally.
Mar
19
comment What prime lengths are used for RSA?
A common assumption is equal length, $q<p<2q$ or at most a length difference of $1$. But that is not really a question about security, it is more about the policy for the usage of RSA. Allowing uneven factors is a potential security risk, because "small factors" can be found more easily. In general, the factoring problem scales with the smallest prime factor, not with the total length. Multiplying $2^{1000000}$ to any RSA modulus does not make it harder to factor.