Reputation
Next tag badge:
94/100 score
20/20 answers
Badges
1 57 113
Impact
~832k people reached

1d
comment Is double AES-CBC encryption with the same key and IV unsafe?
Also, are you asking about $E_k(E_k(M))$ or are you asking about two separate encryptions of the same message (and presumably different IVs)?
2d
comment Can I get successful signature verification with just altering message and signature?
@dave_thompson_085: that what happens when you change your mind about how to express something, and forget to update the first part of the sentence...
2d
revised Can I get successful signature verification with just altering message and signature?
added 2 characters in body
2d
answered Can I get successful signature verification with just altering message and signature?
Apr
30
answered Is this simple PRNG secure?
Apr
29
answered How do attacks on WEP work?
Apr
29
comment Elgamal with secret key equal to zero possible?
@SEJPM: actually, DJB sets the MSB of the secret key to be 1 so that implementations wouldn't be tempted to "optimize" things by skipping higher order 0 bits in an attempt to make things go faster (and add a timing side channel); he wasn't seriously concerned about someone using the all-0 key...
Apr
25
comment Why only one secret value with Shamir's secret sharing?
@mikeazo: I came to the same conclusion after I read it a bit more (although my answer there bears some insight into this question)
Apr
25
comment Why only one secret value with Shamir's secret sharing?
Note that, depending on the $d-1$ shares being known, this 'linear relationship' can be "$S_2$ is this specific value". This sort of thing doesn't happen with Shamir's original method.
Apr
24
answered What are the time considerations with regard to security against birthday attack?
Apr
24
comment Trying to udnerstand textbook sample solution
@Node.JS: how is that $D'$ related to the "real" one? How can Alice reconstruct a working $D$ from $D'$? Hint: $x^{-1} \bmod N$ can be computed, even if you don't know the factorization of $N$.
Apr
23
comment is accessing elements of an array in secret order vulnerable to timing attack?
One possible concern (which doesn't have anything to do with your question) is that a random permutation iterated twice is not a random permutation; for one, any point has double the expected probability of being a fixed point. It's easiest to see when considering the cycle structure; any odd-length cycle remains an odd-length cycle; any even-length cycle divides into 2 (so a length-8 cycle in the original becomes 2 length-4 cycles). Whether this is a concern depends on what you're using the permutation for...
Apr
23
wiki created isogeny description
Apr
23
wiki created isogeny excerpt
Apr
23
revised Finding the subgroup in isogeny-based cryptography
edited tags
Apr
23
comment Trying to udnerstand textbook sample solution
@Node.JS: well, yes; I don't feel like shouting in my equations...
Apr
23
answered Trying to udnerstand textbook sample solution
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
Actually, with the submitter's system, if all three parties verify that the prime they were given was indeed prime, a factor of the modulus, of the expected size, and have the lsbits are the expected pattern (so all they must get different factors), and they verify with each other that they received the same modulus, then all three must jointly hold the complete factorization of that modulus.
Apr
22
reviewed Approve Why hash function are used in digital signatures?
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
The problem with using Shamir's secret sharing is that it may be nontrivial to prove to the three entities that the shares you've given them is actually the shares to the real private key, and not a random value. Yes, you could design a ZKP for that, but that's a fall-out with wjv3's suggestion; all you need to do is have (say) supreme's court factor have lsbits (001), the executive's factor have lsbits (011) and congresses factor have lsbits (101). They can then validate that they have correct and distinct factors by exchanging public information.