Reputation
880
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 6
Newest
 Yearling
Impact
~9k people reached

  • 0 posts edited
  • 0 helpful flags
  • 37 votes cast
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
@CodeInChaos what construction were you thinking about ? I don't think composition is a terrible idea but there are exemples in which it breaks. Maybe pick $r$ at random then $m_0\gets r\oplus m$ and $m_1 \gets r$ ?
Dec
7
comment Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Interestingly enough while a construction $H^2:x\to H(H(x))$ does not have this length extension property it is still distinguishable from a RO H^2 & HMAC
Dec
7
comment RSA 4096 bit key benchmark
That might help you : Benchmark
Dec
7
awarded  Commentator
Dec
7
comment Factorize RSA knowing several N and E
Yeah, like CodesInChaos I would have tried gcd on the modulis...
Dec
7
comment using Post-quantum asymmetric ciphers instead of RSA
Hasn't NTRU been broken several time by Faugère's work on Gröbner basis ?
Dec
7
awarded  Editor
Dec
7
revised Why are protocols often proven secure under the random oracle model instead of a hash assumption?
added 208 characters in body
Dec
7
answered Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Nov
30
answered Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?
Nov
29
answered Message authentication codes construction
Nov
29
awarded  Critic
Nov
29
awarded  Supporter
Nov
29
answered Can someone tell if my Hand Cipher is secure?
Nov
29
comment How to prove membership of a list without disclosing the list members?
@poncho When you say there's a leak of information you mean that statistically don't you ? In which case the unlikelihood of a collision becomes irrelevant since statistical operators like correlation do not care about computational hardness. Also I might be mistaken in my reasonning but there is an infinity of $R2'$ such that $hash(A||R2||hash(m))=hash(A||R2'||hash(m))$ and unless the $Ri$'s have a specific structure an attacker would be unable to tell apart the actual $R2$ from any of the other $R2'$.
Nov
28
answered What cipher mode is suitable for independantly decryptable short messages?
Nov
28
comment How to prove membership of a list without disclosing the list members?
@poncho or we just found a collision for hash...
Nov
27
comment Safety of DSA key parameters sharing
Thanks for the reference and for the precision
Nov
27
comment Safety of DSA key parameters sharing
This discussion followed from the presentation of the paper Public Keys by Lenstra, Hughes et al at Crypto 2012 but the paper itself doesn't mention DH type keys. As for the "never happens in practice" bit you're probably right.
Nov
27
answered Is the AES encryption scheme CPA secure?