236 reputation
27
bio website
location
age
visits member for 2 years
seen Mar 11 at 6:07

Mar
7
comment Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?
The mathematics behind error correcting codes seems a bit more complicated than "mere linear algebra". At the very least, it involves analyzing polynomials over finite fields.
Jan
15
comment One-Time-Pad with key-reuse: Faster way of decrypting?
Here's what I'd do. Find a corpus and generate a Markov model for the text. This will give you an approximately probability for the original plaintexts given any sequence of xor differences for how ever many characters of history you chose. It will happen that some xor differences are incredibly distinctive meaning you can guess the corresponding plaintext with high confidence. For example, you could probably find all the spaces and punctuation this way, at which point the rest should be easy.
Dec
21
comment SHA-256: (Probabilistic?) partial preimage possible?
@Hanno if it were that easy someone would have done it. SAT solving has been used successfully in cryptanalysis, but usually it's to assist with an attack found by manual analysis. With any modern cipher, you can't just plug the whole thing into a solver and hope to get anywhere.
Dec
21
comment Is there a name for this 'enhanced' caeser shift and if so, is it trivial to break?
Even a general Vigenere cipher is pretty easy to break with low entropy plaintext, and this is just a special case of that.
Dec
21
comment How can uniformity of hash functions (e.g. SHA-256) be proved?
It relies on partial pre-image resistance, not uniformity. It's trivial to create hash functions with provably uniform output (such as the identity function) but that doesn't mean they're secure.
Dec
17
comment Help with linear cryptanalysis
Using a more accurate probability calculation, my best equation has an estimated bias of around $2^{-74.6}$, which is obviously worse than brute force.
Dec
17
comment Help with linear cryptanalysis
I've read several of those papers, as well as Matsui's original paper. But I haven't seen anything better than what I'm already doing. I'm beginning to suspect that the cipher I'm trying to break just has too much mixing and too many rounds to be vulnerable to linear crpytanalysis, despite the weak sbox. Comparing the design to DES, which linear crypto was invented to attack, it seems that DES doesn't have the mixing stage (T and the extra xor) that rj2 does. With DES, it's just a straight permutation, but here the intermediate bits are being xored together.
Dec
14
comment Randomized stream cipher using multivariant quadratic equations
Why are $n^2$ plaintext bits required instead of $n^2/2$?
Aug
6
comment Practical consequences of using functional encryption for software obfuscation
The constants involved in FHE mean it is not even remotely practical. Also, obfuscation will never been practical in situations where maximum performance is critical since there is an inherent penalty to not being able to understand the code you're executing (branch misprediction, cache misses, etc.) It's conceivable that advances in obfsucation may someday let it be executed within a small factor of native performance though (Say 100x slowdown), in which case it would see potential applications.
Jul
3
comment Can two cipher letters per plaintext letter easily defeat character frequency analysis?
Given sufficient ciphertext, you can still do frequency analysis. All you did was make the alphabet much larger.
Jul
3
comment Seemingly simple decryption question
This isn't a known plaintext attack. It's not really cryptography at all. What you're trying to do is reverse engineering, and would likely be better off in a different forum.
Jun
28
comment Is my one time pad cipher secure?
The answer to "Is my custom crypto implementation secure?" is always "probably not".
Jun
24
comment If we can find prime numbers larger than 17 milion digits, why can't we find all 1024bit primes?
Generally when you see stuff about largest primes, it's all Mersenne Primes, which don't really have anything to do with general purpose primality testing. And neither has anything to do with cracking RSA.
May
29
comment What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
@fgrieu Personally, when I see a string of partial attacks on e=3, that leads me to worry about future development of more general attacks. Why not reduce the risk now at minimal cost by using a larger exponent?
Jan
7
comment Break double encryption
If you can't fit a full table, why not try using a smaller table?
Dec
10
comment RSA Key generation Public exponent too big
But if e is too small, and you don't pad correctly, it will be insecure.
Dec
10
comment Factorize RSA knowing several N and E
Why do you care if the factors are prime? RSA is always done using a product of two (probable) primes, so any nontrivial factor will be prime.
Nov
24
comment Questions about William's p+1
It can find anything with $B_2$ less than say, 10,000 in minutes. 20 bits would take around 42 hours.
Nov
24
comment Questions about William's p+1
At the current rate, it will take my script 10-20 years to solve that, assuming that you used 32 bit factors. But that is unoptimized python running on a five year old laptop. I guess I need to find a more optimized implementation. Or you could use smaller factors.
Nov
24
comment Questions about William's p+1
@fgrieu Whenever I try to copy your number, I get a bunch of nonascii junk mixed in. Are you sure you pasted it correctly?