Reputation
36,560
Next tag badge:
399/400 score
85/80 answers
Badges
1 32 77
Newest
 Enlightened
Impact
~527k people reached

May
25
comment Name of this attack?
If there were such an attack, it would be called a forgery. The part of the reasoning behind Merkle is that there is no computationally feasible way for doing that. BTW: there's no particular need for a Merkle signature to explicitly include the OTS public key; the verifier can compute the required public key (from the hash and $\sigma_{OTS}$, and then validate that computed public key using the authentication path.
May
24
answered Compacting a substitution cipher key
May
24
awarded  Enlightened
May
24
awarded  Nice Answer
May
24
comment RSA with probable primes
Two comments: 1) in my experience, the deterministic prime generation method in FIPS 140 (based on Shawe-Taylor) is about as fast as verifying primality using a number of Miller-Rabin iterations, and 2) if you use a composite p (or q) which happens to be a Carmichael numer, RSA actually works (!). That's because the correctness of RSA depends on $x^p \equiv x \pmod{p}$, and that's true for Carmichael numbers.
May
23
reviewed No Action Needed Attacking CBC with predictable but encrypted IV
May
23
reviewed No Action Needed Alternative to NSA encryption algorithm
May
23
reviewed Approve logjam tag wiki excerpt
May
23
comment Hash length extension attack - SHA256 to 512 - impossible, correct?
@MaartenBodewes: yes; different initial values would. In fact, that's precisely the reason why (for example) SHA-256 and SHA-224 use different initial values.
May
22
answered Break El-Gamal Algorithm by knowing the value of the random k
May
22
reviewed No Action Needed What is an active S-Box?
May
22
reviewed Reviewed Break El-Gamal Algorithm by knowing the value of the random k
May
22
revised Break El-Gamal Algorithm by knowing the value of the random k
edited body
May
22
answered Hash length extension attack - SHA256 to 512 - impossible, correct?
May
21
reviewed No Action Needed Finding Patterns in Encrypted Data
May
21
reviewed No Action Needed The difference in size between ECDSA output and hash size
May
21
reviewed Close how does an initialization vector work?
May
21
reviewed Close Algorithms for Extracting Linear Equations in Algebraic Cryptanalysis
May
20
awarded  Popular Question
May
20
comment Would this method deliver a perfectly non-malleable encryption for at least two blocks?
@StevePeltz: how would you decrypt? In any case, I suspect Anon2000 is looking for a mode that doesn't do any ciphertext expansion