28,882 reputation
12156
bio website
location
age
visits member for 2 years, 11 months
seen 4 mins ago

22h
comment Vigenère cipher: Security when key length and plaintext length are the same
@tylo: I can't think of anything else anyone could add (except for possibly the mention of Venona as an example) -- why don't you convert your comment into an answer?
1d
reviewed Close Secure way to store fixed size string of digits
1d
reviewed Leave Open Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
1d
comment Different padding rules for Merkle-Damgard and Keccak/sponge function
@CGFoX: you can't have two distinct messages that pad into the same. For example, if one message (in binary) was 101101 and the other was 10110100, the first would pad to 101101100000, and the second would pad to 101101001000 -- they don't look the same.
1d
comment Different padding rules for Merkle-Damgard and Keccak/sponge function
@CGFoX: it is (and, in fact, they do -- they just add a length field as well). However, I believe that the original MD designers may have been afraid that wasn't sufficient -- that if somewhere were to find a fixed point, then it would allow a collision (and the length field would invalidate that).
1d
comment Different padding rules for Merkle-Damgard and Keccak/sponge function
@CGFoX: we always add precisely one 1, and then add zeros; if the input ended with a '1' bit (or '0x01' byte), we'll still pad by adding a '1' bit (or, if we're dealing with bytes, an 0x80 0x00 0x00 ... 0x00 pattern)
1d
answered Different padding rules for Merkle-Damgard and Keccak/sponge function
1d
answered Textbook RSA with exponent e=3
1d
reviewed No Action Needed Which algorithm do you recommend for practical use to generate unique passwords for each website?
2d
comment How is this affine function a pair wise independent permutation?
@sashank: no; the probability that $f(A)=C$ is $1/2^n$; $f(B)$ is independent of $f(A)$ except we know that $f(B)\ne f(A)$, hence given the first holds, there are $2^n-1$ possible values that $f(B)$ can take on. It is equidistributed other than that, and hence joint probability that $f(A)=C$ and $f(B)=D$ is $1/2^n \times 1/(2^n-1) = (2^{2n}-2^n)^{-1}$
2d
reviewed Close How can I solve this modular equation?
2d
comment RSA with modulus n=p²q
Like ECIES; decryption is a lot faster than RSA; for encryption, you can do precomputation so you can do most of the work before you see the message.
2d
answered RSA with modulus n=p²q
2d
comment RSA with modulus n=p²q
@CGFoX: however, wouldn't that slow down the operation? What would the advantage be over doing standard RSA, and picking larger primes?
2d
comment MAC using a modified CBC mode of operation
@fgrieu: why don't you convert your comment into an answer? That way, it can be upvoted and accepted.
2d
reviewed No Action Needed Is my implementation of a PRG at least intuitively secure?
2d
comment AES CTR rekeys rapidly, does this produce patterns?
The submitter really is asking us to review his pet cryptography project -- that's not what this site is about.
Jul
21
reviewed Close Best Asymmetric Encryption Standard for Communications?
Jul
21
comment Choice of multiplication polynomial in Rijndael s-box affine mapping
Do you have any evidence that these metrics have anything to do with the security of AES? Are there any theoretical (reduced round) attacks known against AES that would be foiled by an sbox that is better by these metrics?
Jul
21
reviewed Close Which of following new (2013) ECC curves is the most secure or efficient?