Reputation
48,256
Next tag badge:
94/100 score
20/20 answers
Badges
1 57 113
Impact
~834k people reached

Apr
23
wiki created isogeny description
Apr
23
wiki created isogeny excerpt
Apr
23
revised Finding the subgroup in isogeny-based cryptography
edited tags
Apr
23
comment Trying to udnerstand textbook sample solution
@Node.JS: well, yes; I don't feel like shouting in my equations...
Apr
23
answered Trying to udnerstand textbook sample solution
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
Actually, with the submitter's system, if all three parties verify that the prime they were given was indeed prime, a factor of the modulus, of the expected size, and have the lsbits are the expected pattern (so all they must get different factors), and they verify with each other that they received the same modulus, then all three must jointly hold the complete factorization of that modulus.
Apr
22
reviewed Approve Why hash function are used in digital signatures?
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
The problem with using Shamir's secret sharing is that it may be nontrivial to prove to the three entities that the shares you've given them is actually the shares to the real private key, and not a random value. Yes, you could design a ZKP for that, but that's a fall-out with wjv3's suggestion; all you need to do is have (say) supreme's court factor have lsbits (001), the executive's factor have lsbits (011) and congresses factor have lsbits (101). They can then validate that they have correct and distinct factors by exchanging public information.
Apr
22
comment Integer factorization still hard with Hamming weight hypothesis?
@Tal-Botvinnik: actually, if you look at my algorithm, I don't take all the $k$-bit candidates, and extend each candidate; instead, I preferentially expand the candidates that look likely (that is, have both $p$ and $q$ with light hamming weights); so I might be expanding some promising looking candidates at a large $k$ value, while not so promising candidates are sitting there at tiny $k$ values. Yes, it is possible that (in the extreme case) the lower 79 bits of $p$ are all 1 - if 78 of the 80 set bits were chosen from a uniform distribution, that is extremely unlikely.
Apr
22
comment Integer factorization still hard with Hamming weight hypothesis?
@Tal-Botvinnik: because we're looking for solutions with mostly 0's on both $p$ and $q$. Sure, we could scan through the values of $p$ with hamming weight $p$, but most such $p$s will have $q$ with a large hamming weight (even if we ignore what happens with the higher order bits). That this does is search preferentially for lightweight $p$ and $q$ values
Apr
22
comment Integer factorization still hard with Hamming weight hypothesis?
@SamuelNeves: I was unaware of Nadia's work; however this sort of combinatorial approach is actually a fairly useful tool from the cryptanalyst's toolbox. It is more typically used to attack stream ciphers; however (as you can see) it can be used elsewhere...
Apr
20
awarded  Strunk & White
Apr
20
comment Calculating the discrete logarithm
Ignore the base of the logarithms. Instead, treat $\log 2$ as an unknown variable whose value you're trying to determine.
Apr
20
revised Calculating the discrete logarithm
edited body
Apr
20
comment Deriving AES key and HMAC key from shorter master key
So, did you read my suggestion for using alternative bytes for the two different keys?
Apr
20
comment Deriving AES key and HMAC key from shorter master key
If you are worried that an attacker might gain a factor of two advantage by only deriving the AES-256 half, then why don't you ask for 512 bits, and use the even bytes for the AES-256 key and the odd bytes for the HMAC key. That way, he'll need to derive both to test either the decryption or the HMAC.
Apr
20
comment Deriving AES key and HMAC key from shorter master key
The standard PBKDF2 interface allows you to specify the length of output you want (which need not be limited to the length of the hash function it uses internally). Doesn't .NET implement that parameter?
Apr
19
comment Exploiting XOR one-time-pads with dictionary length that isn't a power of 2
OTP can be defined with any finite group operation (actually, latin square). However, if you use exclusive-or as your group operation, then the "uniform distribution" clause is important; exclusive-or takes elements which are a power-of-2 in size (and hence your random numbers must be uniform within that power-of-2 size). If you replace exclusive-or with, say, modular addition, that power of 2 requirement does go away.
Apr
19
comment Integer factorization still hard with Hamming weight hypothesis?
@Tal-Botvinnik: if you're in the ring [x]/x^n-1 (the NTRU ring) or [x]/x^n+1 (the ring used for rLWE), I'm not sure how well this combinatorial attack would work. Over the integers, it exploits the fact that some of the output bits are a function of only a few input bits (e.g. bit 2 of the product depends on only 6 bits of input total). With these rings, that's not true (each input coefficient can potentially affect each output coefficient), and so there's no obvious place for the algorithm to get started.
Apr
19
comment Is there a theorem to determine the elliptic curve parameters based on the group order?
@SEJPM: actually, he isn't asking "given a curve, how many points on it"; instead, he's asking "given a target number of points (that's not impossible), how can I generate a curve with precisely that many points?"