Reputation
39,805
Next tag badge:
397/400 score
83/80 answers
Badges
1 40 88
Newest
 Nice Answer
Impact
~593k people reached

Mar
30
reviewed Leave Open Elliptic curve cryptography related key attacks
Mar
29
reviewed Close computing inverses in truncated polynomial rings manually for NTRU encryption
Mar
29
reviewed No Action Needed Stacked LFSR - why not used?
Mar
29
reviewed No Action Needed Prove that if we redefine the key space, we can assume Gen chooses a key uniformly
Mar
27
comment Zero knowledge of two factor
Actually, there is no need for a ZKP that $n$ is not prime; anyone can verify that directly in polynomial time.
Mar
27
comment Key sizes supported by 3DES
@MaartenBodewes: that is the reason for EDE mode (actually, it's a bit more complicated); however personally I don't consider the $k_1 = k_2 = k_3$ case as 3DES; instead, that's DES (which just happens to be implemented by circuitry that can implement 3DES as well)
Mar
27
revised Key sizes supported by 3DES
added 140 characters in body
Mar
27
answered Key sizes supported by 3DES
Mar
27
comment Collision attacks on digital signatures
A collision 'jumbled mess' could occur entirely within where the RSA public key would appear in the certificate; given that an RSA public key looks like seemingly random bytes, how do you propose that the client-side code determine that someone didn't use those random bytes to create a collision?
Mar
27
comment Collision attacks on digital signatures
How do you distinguish a 'weird string' from a RSA public key?
Mar
26
comment common ways / methods to try to break a SP network
Are there any unknown key bits stirred into the SP network? Or, can you compute forwards correctly (and just want to know how to compute backwards)?
Mar
25
reviewed No Action Needed zendo data size restrictions
Mar
25
reviewed No Action Needed Are modes of operation algorithms practical?
Mar
25
answered Blum primes [x=3(mod 4)] zero knowledge proof?
Mar
25
answered Does perfect secrecy imply uniform ciphertext distribution?
Mar
25
comment Bit commitment, two blobs with same bit, without revealing it?
@tylo: Actually, this is subtly different from Goldwasser-Micali; in GM, the holder of the private key knew the factorization of $n$; here, the committer need not know that -- they can reveal the secret by revealing $x$. And, they can generate a ZKP that $y_1y_2$ is a QR (if $b_1=b_2$) because they know the squareroot (either $x_1x_2$ or $x_1x_2t$)
Mar
25
comment Authentication using a one-time pad
@thirtythreeforty: Davies-Meyer is intended to turn the cipher into a hash. Thinking about it more, perhaps CBC-MAC (you don't need to worry about the attacker extending the message, do you?) would work out better. If you need to worry about replays, putting in a counter (which would be included in the integrity check) is the obvious solution.
Mar
24
answered Authentication using a one-time pad
Mar
24
comment Authentication using a one-time pad
What level of integrity protection are you looking for? That is, if someone modified a packet, what is an acceptable level of probability that the modification be undetected? $2^{-16}$? $2^{-64}$?
Mar
24
comment Bit commitment, two blobs with same bit, without revealing it?
@RobertNACIRI: actually, that is not true; the Jacobi symbol will be 1 regardless of whether $b$ is 0 or 1. Remember, $t$ is chosen with a Jacobi symbol 1, $x^2$ also has Jacobi symbol 1, and so both $x^2t^0$ and $x^2t^1$ will have Jacobi symbol one. You might be thinking of a prime modulus (where the Jacobi symbol does indicate whether the number is a QR); this is done over a composite modulus, where there are nonQRs with Jacobi symbol 1.