Reputation
Next tag badge:
384/400 score
80/80 answers
Badges
1 36 82
Impact
~572k people reached

Jul
10
reviewed Reviewed Does AES(x || x) provide secure message authentication when message fits in a single block?
Jul
10
reviewed No Action Needed RSA-PSS salt size in certificate
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM: it is formally named for its inventors, which I am totally blanking on right now - it dates back to the 70s. As for why $y$'s there, well, that's because I changed my explination midway through - I was originally going to talk about Alice's and Bob's secret keys together.
Jul
10
revised Are there transitive ciphers (either symmetric and asymmetric)
deleted 4 characters in body
Jul
10
answered Are there transitive ciphers (either symmetric and asymmetric)
Jul
10
revised Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
added 317 characters in body
Jul
10
answered Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
Jul
10
awarded  discrete-logarithm
Jul
9
comment Diffie Hellman Exponentiation Implementation Problem
BTW: this isn't actually related to your question, but Diffie-Hellman modulo a 256 bit prime is quite insecure. To be secure, you really need at least 1024 bit Diffie-Hellman as an absolute minimum (with 2048 bit groups strongly encouraged). Alternatively, you might want to consider Elliptic Curve groups; there, a 256 bit EC group is actually secure (but the equivalent of the multiplication (called addition there) is rather more compled)
Jul
9
comment Degenerate discrete logarithm in binary field
@YehudaLindell: actually, if the mechanism succeeds with probability $\epsilon$, then a randomized procedure can solve an arbitrary DL for generator $g$ with an expected $1/\epsilon$ random tries. Then, using that, you can then solve an arbitrary DL for generator $h$ with an expected $2/\epsilon$ random tries (by first applying the base random procedure to $h$ and then applying it to $h^x$)
Jul
9
answered Degenerate discrete logarithm in binary field
Jul
9
comment Diffe-Helman Exchange result is always 1
If the order of $g$ has a factor $q$, then the attacker can, given $g^x$, derive $x \bmod q$ in $O(\sqrt{q})$ work. If the order of $g$ is a large prime, then observation doesn't leak anything.
Jul
8
comment Diffe-Helman Exchange result is always 1
Actually, one can argue that $g$ should generate a large prime order subgroup, as using a generator for the entire group leaks information.
Jul
8
comment RSA algorithm assignment
Hint: if they signify the RSA encryption operation of $M$ as $RSA(M)$, then we have $RSA(A) \times RSA(B) = RSA(A \times B)$ (where $\times$ is modulo $n$). How could you take advantage of that?
Jul
8
comment How bad it is using the same IV twice with AES/GCM?
Actually, if you just reuse an IV once (for distinct plaintexts/AADs), the attacker can limit the possible values for $H$ to a handful of values.
Jul
7
answered RSA: Range of public modulus
Jul
7
comment Calculating Multiplicative Inverse for Rijndael S-box using EEA
Actually, you're almost there. You don't use modulo; instead you use xor if the result is out of range. 465 ^ 283 = 202. Remember, you're not working in the ring of integers; you're working in the ring of polynomials modulo $GF(2)$; you need to use operations that make sense in that realm
Jul
7
comment Can there be a need for 1024-bit (symmetric) encryption?
@SEJPM: there is no known quantum attack that finds collisions in 1024 bit hash functions in $O(2^{256})$ work. There is a claim that (effectively) says that it could be done in $O(2^{341})$ time $(341 \approx 1024/3)$, however others say that the implementation complexity involved with that makes it actually more effort than a classical collision attack at $O(2^{512})$ effort
Jul
7
comment Calculating Multiplicative Inverse for Rijndael S-box using EEA
@FilipFranik: try swapping r with new_r, s with new_s and t with new_t. In essence, you're doing the same logic, but with the assumption that r << quotient (and the other shifts by quotient) is 0
Jul
7
answered Reversing Rotation + XOR