800 reputation
25
bio website
location
age
visits member for 2 years, 1 month
seen Nov 8 at 13:04

Dec
18
comment Good enough deterministic PRNG based on hashes
Good point, I forgot about the key reduction step
Dec
17
comment Good enough deterministic PRNG based on hashes
"In particular if the seed is longer than 128 bytes it becomes totally insecure" why ?
Dec
13
comment Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset
There's even a tradeoff between the running time of your algorithm and the success probability since instead of failing if the input doesn't fall in the acceptable subset you can randomize your input via a multiplication by $g^r$ (with random $r$) and run it again. I think that's called Random Self Reducibility
Dec
7
comment RSA 4096 bit key benchmark
I guess it's just vocabulary here but rather than ECDH an elliptic curve alternative for mary would be ECIES which uses ECDH as a key establishment scheme
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
@CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ?
Dec
7
comment Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Interestingly enough while a construction $H^2:x\to H(H(x))$ does not have this length extension property it is still distinguishable from a RO H^2 & HMAC
Dec
7
answered RSA 4096 bit key benchmark
Dec
7
awarded  Commentator
Dec
7
comment Factorize RSA knowing several N and E
Yeah, like CodesInChaos I would have tried gcd on the modulis...
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ?
Dec
7
awarded  Editor
Dec
7
revised Why are protocols often proven secure under the random oracle model instead of a hash assumption?
added 208 characters in body
Dec
7
answered Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Nov
30
answered Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?
Nov
29
answered Message authentication codes construction
Nov
29
awarded  Critic
Nov
29
awarded  Supporter
Nov
29
answered Can someone tell if my Hand Cipher is secure?
Nov
29
comment How to prove membership of a list without disclosing the list members?
@poncho When you say there's a leak of information you mean that statistically don't you ? In which case the unlikelihood of a collision becomes irrelevant since statistical operators like correlation do not care about computational hardness. Also I might be mistaken in my reasonning but there is an infinity of $R2'$ such that $hash(A||R2||hash(m))=hash(A||R2'||hash(m))$ and unless the $Ri$'s have a specific structure an attacker would be unable to tell apart the actual $R2$ from any of the other $R2'$.
Nov
28
answered What cipher mode is suitable for independantly decryptable short messages?