28,912 reputation
12156
bio website
location
age
visits member for 2 years, 11 months
seen 1 hour ago

Dec
20
comment Can $r$ and $s$ from an ECDSA signature be negative numbers?
Yes, you can convert it into any format you want; however, what is the format that the bitcoin implementation uses when it does the above checks?
Dec
20
comment Can $r$ and $s$ from an ECDSA signature be negative numbers?
Actually, whether the most significant bit is 0x80 depends on the number of bytes Mathematica uses when it represents an integer. If it uses 32 bytes to represent a 256 bit integer, you are correct. If it uses 33 or more, then no, the leading byte will be 0. Since I don't know how Mathematica works internally, I'm not making this an answer; I'm just suggesting this as a possibility.
Dec
20
revised Pollard’s Rho Method
added 24 characters in body
Dec
20
revised Pollard’s Rho Method
Minor correction
Dec
20
answered Pollard’s Rho Method
Dec
19
comment Is a Mersenne-twister cryptographically secure if I truncate the output?
@fgrieu: you might want to rethink that statement, it sounds much stronger than what I think you really meant. You appear to be worried about repeated output blocks (or the lack of them with CTR mode); With 16 million blocks, a truly random source has a probability circa $2^{-80}$ of having a collision somewhere; AES-CTR has 0 probability. While a distinguisher with advantage $2^{-80}$ may violate semantic security, I can't think of a practical security issue with it.
Dec
19
awarded  Enlightened
Dec
19
awarded  Nice Answer
Dec
18
comment What is the best (thoroughly covering) textbook for application of LFSRs in cryptography?
@fgrieu: perhaps it's better put this way: "transistors are currently real cheap, and so current designs tend to be tuned for things other than minimal transistor count".
Dec
18
answered Logical OR operation in a homomorphic additive cryptosystem
Dec
17
comment How does OAEP improve the security of RSA?
@curious: the $OAEP$ function is designed to be invertable; however it does assume that the length of $r$ is publicly known.
Dec
17
comment Attacks against El Gamal private key
The separate limits you give on $b$ and $p$ don't make a great deal of sense. For one, $b < p$, and so if you never have a $p$ more than 50 digits, you'll also never have a $b$ more than 50 digits either. In addition, $b$ acts as a random value between 2 and $p-2$; hence if $p$ is 50 digits, then at least 90% of the time, $b$ will be 49 or 50 digits.
Dec
16
comment Attack against modular inversion operation using side-channels?
@SDL: true; I haven't presented an attack that recovers the modulus given values being inverted and the time taken (although it might not be too hard to outline; if $x \bmod p$ happens to be a small value, then EE goes faster; a first step might be to look for fast inversions and see if they have a $kx + \epsilon$ in common; that'll give you partial information about $p$). However blinding the value being inverted is so cheap, it makes sense to do it even if we have a hint that there might be a problem.
Dec
16
revised Diffie-Hellman for Encryption
Spelling correction
Dec
16
answered Diffie-Hellman for Encryption
Dec
15
revised Attack against modular inversion operation using side-channels?
Improved second blinding method
Dec
15
answered Attack against modular inversion operation using side-channels?
Dec
15
comment Attack against modular inversion operation using side-channels?
The obvious question is "what can the attacker observe"? If he can observe inputs and outputs, he doesn't need a side-channel attack; he can recover the secret modulus algebraically. If he can't observe anything, it's not likely that a side channel attack can tell him anything.
Dec
15
revised Sample RSA-style signature confusion
More explicit derivation
Dec
15
answered Sample RSA-style signature confusion