30,220 reputation
12359
bio website
location
age
visits member for 3 years, 1 month
seen 2 days ago

Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
You have the first 1024 bits of plaintext-ciphertext; how can you deduce $F(r)$ from that? If you have $F(r)$, how do you deduce $F(2\cdot r)$?
Feb
17
answered ElGamal in private set intersection: how to handle negative numbers?
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
@CodesInChaos: hmmm, good point. GCM, as specified, matches the block size with the field size. If we break that assumption, and: use the first 128 bits of the encryption of 0 as your H; and do some reasonable splitting of the keystream to encrypt the payload and the tag (I can think of two reasonable alternatives), well, one gets something that is distinctly GCM-ish, and I still believe the security proofs still apply.
Feb
16
comment Simplified Fiat-Shamir example generates wrong output
No, he means checking whether $y^2 \equiv x \cdot v^e\ (\bmod\ n)$. One way of writing that is checking whether $(y^2 \bmod n) = ((x v^e) \bmod n)$. Remember, the squaring of $y$ occurs within the group, and hence is implicitly done modulo $n$.
Feb
15
answered GCM encryption for 256-bit and 512-bit block ciphers
Feb
15
comment Hash functions with or without secret key
"Usually MACs are not called hash functions (with key)"; this is certainly true, because often a MAC is not a secure hash function against someone who knows the MAC key. Nothing in the definition of a MAC requires it to be, and a lot of real MACs in practice (e.g. CMAC) don't even have preimage resistance if you know the key.
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki
Feb
15
reviewed Approve suggested edit on threshold-cryptography tag wiki excerpt
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki excerpt
Feb
15
reviewed Approve suggested edit on threshold-cryptography tag wiki
Feb
14
revised Encrypting firmware with AES and no IV
Man, there's been a lot of typo's here
Feb
14
revised Encrypting firmware with AES and no IV
More Latex corrections...
Feb
14
answered Encrypting firmware with AES and no IV
Feb
14
revised Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
Corrected from BER to DER
Feb
14
comment Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
@HenrickHellström: I was unaware that X.509 used DER, not BER. Thank you for informing me that; I'll fix up my answer accordingly.
Feb
13
answered Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
Feb
12
comment Prime factorization of RSA modulus
@Moses: look at remark 3.5 in your textbook; that gives an alternate formula that (often) gives a smaller value for the decryption exponent $d$. That's your 'second key'.
Feb
12
comment RFC 3526 - What does pi mean?
@SimonJohnson: Yes; it's there not because we expect it to have some special property, but instead because we don't.
Feb
12
answered RFC 3526 - What does pi mean?
Feb
12
comment Prime factorization of RSA modulus
If your textbook says $e_1d_1 = 1 \bmod \phi(N)$, you might want to consider getting another textbook. Such an $e_1, d_1$ will work as RSA public/private exponents, however not all valid exponents will satisfy the equation; for example, consider the $e_1=337, d_1=1471$ example I gave previously; we have $(x^{337})^{1471} = x \bmod 3953$ for all $x$, but $337 \times 1471 \not\equiv 1 \bmod \phi(3953)$