31,922 reputation
12566
bio website
location
age
visits member for 3 years, 3 months
seen 6 hours ago

Jun
3
comment Montgomery Ladder vs Double-and-Add
@CodesInChaos: the point of these algorithms is that they try to resist cache-based side channel attacks; that's hard to do with a look-up based algorithm. Yes, if you don't care about those side channel attacks (either you know no one else is sharing your cache, or you're doing ECDSA signature verify), there are considerably more efficient alternative available.
Jun
3
revised Montgomery Ladder vs Double-and-Add
added 112 characters in body
Jun
3
answered Montgomery Ladder vs Double-and-Add
Jun
3
reviewed Close Theory for pre-paid debit card: card-to-card transfer
Jun
2
comment Precomputation attacks on RSA
@RickyDemer: that part is true; however if the hash function is chosen properly, it is still harder than factoring the modulus (albeit not to such an extreme extent)
Jun
2
comment Precomputation attacks on RSA
@RickyDemer: how does this precomputation attack work against RSA used properly, that is, with a collision resistant hash function?
Jun
2
comment Measure ECC key size
Yes, it would be 160 bits. Note that a 160 bit elliptic curve can be broken with approximately $2^{80}$ operations.
Jun
2
answered Precomputation attacks on RSA
Jun
2
comment Is RSA key size the size of private key exponent in public key encryption?
@user2934766: since $n = p \times q$, then increasing $p$ and $q$ will, of course, increase $n$. To pick an $n$ of 15360 bits, you need to select primes $p$ and $q$ of 7680 bits. That said, if you think you need a public key system that difficult to solve, you probably should look at an Elliptic Curve system
Jun
1
answered Parallel hash construction
May
31
reviewed Close Why is plain-hash-then-encrypt not a secure MAC?
May
31
reviewed Leave Open Reductionist proofs of decisional problems to computational
May
30
comment Question about block erasure codes
A matrix being nonsingular does not imply that all its submatricies are nonsingular. Here is a simple counterexample: consider a $4\times 4$ identity matrix; it is nonsingular. However, if we consider the $2\times 2$ matrix in the upper right corner, that consists of all 0's, and so is obviously singular. I'm not certain how that pertains to block erasure codes (I do cryptography, not coding theory), however that at least is one statement you made which is not true.
May
30
reviewed Close How small are we talking about when defining the small public/private key exponent
May
30
revised Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$
added 4 characters in body
May
30
comment Secure Secret sharing
Might I ask what's the point of making it "harder to solve"? The entire point of Secret Sharing is that the problem is impossible to solve if you don't have enough shares, and that is it easy if you do have enough.
May
30
revised Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$
added 3 characters in body
May
30
revised Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$
added 335 characters in body
May
29
comment Encryption time in ECC
Actually, if you are going to use precomputed tables to speed point multiplications, there are far more intelligent ways (smaller tables and better speedup) than just caching $2^iB$
May
29
reviewed Leave Open Why is elliptic curve cryptography not widely used, compared to RSA?