Reputation
Top tag
Next privilege 150 Rep.
Create new tags
Badges
5
Newest
 Supporter
Impact
~906 people reached

  • 0 posts edited
  • 0 helpful flags
  • 9 votes cast
Aug
23
accepted How many bits to flip in an RSA public key to do signature forgery?
Jul
21
comment Entropy of two concatenated random values
If your entropy in the RNG is 256 bits and you dump it into a PRNG, then by concatenating two 256 bit values generate from the PRNG, the entropy should be 256 bit correct? Could you elaborate on how you get 257 bits entropy? Also where is the 640-bit value coming from in your explanation?
Jul
21
comment How many bits to flip in an RSA public key to do signature forgery?
@poncho, thank you for the explanation. I am sorry that I failed to see how you get 1.44. Without knowing the value of $e$, how did you get this concrete result?
Jul
21
comment How many bits to flip in an RSA public key to do signature forgery?
@otus, flipping bits in the key.
Jul
20
comment How many bits to flip in an RSA public key to do signature forgery?
@poncho, could you explain why $n$ mod $e$ = 1 is the case when we use standard RSA modulus? also why ($n$ - $n^{'}$) mod $e$ $\neq$ 0?
Jul
18
comment How many bits to flip in an RSA public key to do signature forgery?
I did not completely follow the paragraph "When we include the condition with e, ..., the probability is even higher." After you compute the probability of prime after the modulus n is flipped, do you need to compute the probability that gcd(e, n-1) = 1? I dont see how this probability is linked to your calculation 1/(e-1).
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
"alternatively, there would a probability approximately...", I think the number after this sentence is multiplication rather than exponentiation.
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
Thank you for the answer. A "random" odd integer of size circa n has a circa $2/log_{e}n$ probability of prime. I assume this $e$ is not the public exponent and is the natural logarithm constant, correct? Is it possible to point me to a reference of this claim?
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
@RickyDemer, for an active attacker who chooses $x$, he can obtain Bob's identity by decryption which makes sense. However, once the attacker sees the traffic from Alice's machine. Can the attacker initiate the same protocol with Alice's machine, i.e., Attacker sends g^x' and Alice sends back g^y', E_K(S_B(g^y', g^x')), so that attacker can decrypt and obtain Alice's identity? (I mean this is probably beyond the protocol's promise since it is a second protocol session, but what prevents the attacker from doing so?)
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
Let us continue this discussion in chat.
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
The link is standard stuff. I can accept the logical conclusion from this that if you use a block cipher such as AES and key size 128. Then attacker will get a larger space, i.e., brute force AES keys compared to the case where no encryption is used, i.e., brute force all the public keys on the internet. And this protocol only gives anonymity during this protocol session. But Why A is protected against active attack while B is protected against passive attack?
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
My words may be too strong. What is the definition of keeping the identity of the initiator confidential? Do you mean there is a negligible probability of revealing the identity? In that case, does all the public keys on the internet be sufficient to guarantee a negligible probability?
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
@RickyDemer, even without encryption, how does the attacker know which public key to choose to verify the identity from billions of billions public keys on the internet. If he has a specific subset to choose from, then this scheme is already broken from identity point of view. Of course, I am not familiar with the metrics to evaluate anonymity.
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
Thanks for the pointer. See my updated post.
Jul
17
revised Why does encryption in STS protocol protect against identity attacks?
added 633 characters in body; edited title
Jul
17
asked Why does encryption in STS protocol protect against identity attacks?
Jul
16
asked How many bits to flip in an RSA public key to do signature forgery?
Jul
9
accepted RSA with $\lambda(n)$ or $\varphi(n)$
Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell, I was confused in the previous one and now it is cleared. New questions: which step in the RSA algorithm do we reject small e? That is not part of the RSA algorithm, isn't it?
Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell, I agree that detecting small exponent has nothing to do with the key generation algorithm. But I guess Ricky's point is that since lambda is smaller or equal to phi, when we select $e$, it is more probable that $d$ ends up with a small value, i.e., the order of the group defined by $lambda$ is smaller than the order of the group defined by $phi$.