Reputation
36,475
Next tag badge:
399/400 score
85/80 answers
Badges
1 32 77
Newest
 Enlightened
Impact
~524k people reached

2h
reviewed No Action Needed bilinear paing arithmetic - cryptographic accumulators
2h
reviewed No Action Needed Are covert and rational adversaries same?
2h
reviewed No Action Needed Elliptic Curve Cryptography Encryption and text representation implementation
2h
reviewed No Action Needed PGP public RSA key format
2h
comment One time pad in CBC mode?
@Stefan: against a correctly implemented OTP, KPA's and CPA's are impossible.
2h
answered One time pad in CBC mode?
2h
comment Is HMAC-MD5 still secure for commitment or other common uses?
In addition, most MACs (e.g. CMAC, Carter-Wegman MACs) make it easy to create collisions (and even second preimages) if you know the key. HMAC (based on a collsion-resistant hash) is one of the few that doesn't make it easy. Kaminsky just showed that HMAC-MD5 doesn't have a property that most MACs also don't have.
2h
comment Is authentication length always a subset of encryption length?
@MaartenBodewes: minor note: while the obvious method of implementing GCM has you processing the AAD before the encrypted data, it's not that hard to process them in a different order.
3h
comment How to calculate RSA CRT parameters from public key and private exponent
@CodesInChaos: nope, it's just a temporary variable name.
19h
comment Discrete log in Galois Extension Field
Actually, there's been a number of recent results about quickly computing Discrete Logs in extension fields of small characteristic, such as eprint.iacr.org/2013/400.pdf . While using $\mu$ prime would appear to be immune to these results, I'd still be cautious about it. If there any particular reason why you can't use a prime field?
20h
comment Finding public exponent e
@SOJPM: stupid question (and this might be something to ask as a separate question) can Pohlig-Hellman be adapted to work in this scenario? We know the group is large (we don't know the exact size, but a good guess is that the order of $c$ is within a few bits of $n$), but we know (or at least suspect) that $c^e = m$ for some small $e$. How do we use Pohlig-Hellman work to search over small $e$'s, without stepping into the huge group?
21h
comment Finding public exponent e
Actually, if you think $2^{20} < e < 2^{40}$ is at all likely, then doing a Big Step/Little Step is feasible; for $n \approx 2^{20}$, you compute $m\cdot c^{-j}$ for odd $1 \le j < n$, and compute $c^{in}$ (for $0 \le i < n$), and scan the two lists for a common value; this checks all possible e's in the range $[1, n^2]$ in $O(n)$ time
23h
comment Finding public exponent e
We know that for the correct $e, d$, we have $z^{ed} = z$. The obvious way to validate a $e$ is to select a random $z$, compute $z^d$, and then compare $(z^d)^e$ to $z$. This makes the brute-forcing of all $e < 2^{32}$ not too horribly expensive (as checking the next $e$ is just a modular multiplication and compare). If you want to put in the effort, using the big-step/little-step makes it practical to test this for all $e < 2^{64}$. However, if we know that $e> 2^{32}$, going directly to Weiner's may make more sense
1d
revised How to calculate RSA CRT parameters from public key and private exponent
added 157 characters in body
1d
answered How to calculate RSA CRT parameters from public key and private exponent
1d
comment How to calculate RSA CRT parameters from public key and private exponent
Actually, that answer (despite being given by Thomas Pornin, who is generally accurate) is wrong; $ed-1$ needn't be a multiple of $\phi(n)$. Actually, Thomas notes this himself; for some reason, he doesn't give the full answer (possibly because he didn't want to get into number theory)
1d
comment Name of this attack?
$X_s$? What is $X_s$ is the notation you're using?
1d
comment Name of this attack?
You take the OTS signature and the hash of the message; you compute the forward hash of the OTS signature (according to the bits of the message hash); that gives you an (unauthenticated) value of $Y_s$. You then validate that value of $Y_s$ by computing up the authentication path; if you get the top level hash value, the signature verifies.
1d
comment Name of this attack?
If there were such an attack, it would be called a forgery. The part of the reasoning behind Merkle is that there is no computationally feasible way for doing that. BTW: there's no particular need for a Merkle signature to explicitly include the OTS public key; the verifier can compute the required public key (from the hash and $\sigma_{OTS}$, and then validate that computed public key using the authentication path.
1d
answered Compacting a substitution cipher key