poncho

14,612 reputation

1628

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	9 mins ago
stats	profile views	105

	14,612 reputation	bio	website		visits	member for	1 year, 9 months
1628 badges		location			seen	9 mins ago

summary answers questions tags badges favorites bounties reputation activity

853 Actions

suggestions reviews revisions comments badges posts accepts all

May 11	comment	Initialization vector length insufficient in AES @RubiSharmax: well, it's a bit more subtle than that. Your statement would imply that using unique IVs are sufficient; however having IVs for two different messages with the same bitwise difference as the initial block, well, that'd result with the two messages having the same initial ciphertext block, and that'd be bad. And, if an attacker can inject messages of his choosing, then the IV needs to be actively unpredictable, not only unique and well-distributed.
May 11	revised	Initialization vector length insufficient in AES edited tags
May 11	answered	Initialization vector length insufficient in AES
May 9	comment	Chinese Remainder Theorem and RSA @MihaiTodor: set $r=2$, $n_0 = p$, $n_1 = q$. Now, CRT says that, given $B \bmod p$ and $B \bmod q$ (with $0 \le B < pq$), there is a unique $0 \le A < pq$ such that $A \equiv B \bmod p \mod p$ and $A \equiv B \bmod q \mod q$. Now, $A \equiv B$ is such a solution. Since the solution is unique, it must be the only solution (and hence we can conclude that $A \equiv B$)
May 9	comment	Chinese Remainder Theorem and RSA @MihaiTodor: as for your second question, well, the Chinese Remainder theorem states that if $p$ and $q$ are relatively prime, and if $A \equiv B \mod p$ and $A \equiv B \mod q$, then $A \equiv B \mod pq$.
May 9	comment	Chinese Remainder Theorem and RSA @MihaiTodor: well, for the first question, the CRT optimization splits $M$ into two parts, $M \bmod p$ and $M \bmod q$. Then, it computes the RSA private operation on both halves, that is, for the p side, we compute $((M \bmod p)^d) \bmod p$. We also note that $M^d \equiv (M \bmod p)^d \mod p$, that is, each of the two sides is effectively independent. We further note that Fermat's Little Theorem implies that $a^b \equiv a^{b \mod p-1} \mod p$ if $p$ is prime, and so it is sufficient to compute $((M \bmod p)^{d \mod p-1}) \bmod p$.
May 9	answered	Chinese Remainder Theorem and RSA
May 9	comment	Encryption with “constant” initialization vector considered harmful One further refinement: for CFB mode, they leak not only the common prefix (as you've stated), but also the exclusive-or of the first two plaintext blocks that are different.
May 9	comment	How can we find Public key have only 8 or 16bits? How many messages does Eve need to know the Public key in RSA? To be technical, one probably isn't enough. After all, the public key consists of a modulus and a public exponent; even if you're given both P and C, for a candidate modulus M, there is a significant probability that there will be a value e such that $P^e \equiv C \mod M$, and this value $e$ has a good chance to be relatively prime to $\phi(M)$. Hence, there are likely to be multiple $(M, e)$ pairs, and so you'll need a second encrypted message to have a chance to figure out which one it might be.
May 8	answered	How does one implement the Inverse of AES' MixColumns
May 6	comment	Order of hashing concatenation Actually, yes, it is. That is, given A = Hash(X + "blue"), it is possible to compute B = Hash(X + "blue pink") for specific values of " pink". Now, this observation is valid for only very specific suffixes, the fact that it occurs for any suffix makes us question that particular construction (especially since there are other constructions that don't share that weakness)
May 6	answered	Public Key Encryption with forward secrecy
May 6	answered	Recovering the key in an ElGamal Signature Scheme variant
May 4	answered	Do public/private pairs work both ways?
May 4	reviewed	Approve suggested edit on How was the complexity of the Biclique Attack calculated?
May 3	comment	Which attacks can be avoided by the use of OFB instead of ECB? When you are considering using a particular mode, it is generally useful to ponder what security properties you need from the mode, and whether that mode provides those properties. What security properties are you looking for?
May 3	comment	Complexity of ECB and OFB Big-O notation is the standard way of expressing asymptotic behavior (such as time and memory complexity). What $O(N)$ effectively means is that there is the time taken is a linear function of the message size; encrypting a message twice as long will take twice as long. What $O(1)$ means is that the algorithms use a constant amount of space; no matter how long the message is, ECB and OFB will take no more than $c$ bytes of memory (for some value of $c$).
May 3	answered	Complexity of ECB and OFB
May 1	answered	Has there been any cryptanalysis of RC4-52?
Apr 29	comment	Cipher Feedback Mode @JohnPaulParreño: actually, no, you don't process the IV just like you would process plaintext. Instead, the IV is processed exactly as if it were ciphertext that you generated immediately before you started generating the ciphertext. This is because how you process some plaintext depends on ciphertext you have processed earlier; if you haven't generated ciphertext earlier, the IV is used instead.