Reputation
36,405
Next tag badge:
399/400 score
85/80 answers
Badges
1 32 77
Newest
 Enlightened
Impact
~523k people reached

8m
comment Name of this attack?
$X_s$? What is $X_s$ is the notation you're using?
8h
comment Name of this attack?
You take the OTS signature and the hash of the message; you compute the forward hash of the OTS signature (according to the bits of the message hash); that gives you an (unauthenticated) value of $Y_s$. You then validate that value of $Y_s$ by computing up the authentication path; if you get the top level hash value, the signature verifies.
10h
comment Name of this attack?
If there were such an attack, it would be called a forgery. The part of the reasoning behind Merkle is that there is no computationally feasible way for doing that. BTW: there's no particular need for a Merkle signature to explicitly include the OTS public key; the verifier can compute the required public key (from the hash and $\sigma_{OTS}$, and then validate that computed public key using the authentication path.
17h
answered Compacting a substitution cipher key
18h
awarded  Enlightened
19h
awarded  Nice Answer
20h
comment RSA with probable primes
Two comments: 1) in my experience, the deterministic prime generation method in FIPS 140 (based on Shawe-Taylor) is about as fast as verifying primality using a number of Miller-Rabin iterations, and 2) if you use a composite p (or q) which happens to be a Carmichael numer, RSA actually works (!). That's because the correctness of RSA depends on $x^p \equiv x \pmod{p}$, and that's true for Carmichael numbers.
2d
reviewed No Action Needed Attacking CBC with predictable but encrypted IV
2d
reviewed No Action Needed Alternative to NSA encryption algorithm
2d
reviewed Approve logjam tag wiki excerpt
2d
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
@MaartenBodewes: yes; different initial values would. In fact, that's precisely the reason why (for example) SHA-256 and SHA-224 use different initial values.
2d
answered Break El-Gamal Algorithm by knowing the value of the random k
2d
reviewed No Action Needed What is an active S-Box?
2d
reviewed Reviewed Break El-Gamal Algorithm by knowing the value of the random k
2d
revised Break El-Gamal Algorithm by knowing the value of the random k
edited body
May
22
answered Hash length extension attack - SHA256 to 512 - impossible, correct?
May
21
reviewed No Action Needed Finding Patterns in Encrypted Data
May
21
reviewed No Action Needed The difference in size between ECDSA output and hash size
May
21
reviewed Close how does an initialization vector work?
May
21
reviewed Close Algorithms for Extracting Linear Equations in Algebraic Cryptanalysis