poncho
Reputation
44,904
392/400 score
 Jun 11 awarded Guru Jun 10 reviewed Looks OK Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other? Jun 10 comment Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other? @phan: It would be possible if we're doing the computation modulo a composite with unknown factorization Jun 10 comment What is the proper usage of GCM nonce in TLS1.2? Actually, with the TLS PSK ciphersuite, the preshared key that they share isn't the actual GCM key; instead, it's used to derive the 'premaster secret', which is stirred in with dynamic data from the handshake to form both the key for data in the client->server direction, and the key for data in the server->client direction Jun 10 answered What is the proper usage of GCM nonce in TLS1.2? Jun 10 comment How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$? What is the data you're starting out with? It's unlikely that the system that you're attacking will actually provide $h(p^*)$, where $p^*$ is the value you're guessing. Jun 9 comment Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group? I suspect the library you were using used this logic during addition: "if the x-coordinates are the same, then check the y-coordinates. If they're the same, then he's doing a doubling, if not, he's adding the inverses, and so return the PoI (aka the identity group member aka 0)". So, your code returned 0, not because the math worked out, but that's just what the logic happened to do when fed invalid input Jun 9 comment Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group? Or (to follow up Mike's comment) if you do insist on writing it multiplicatively, be consistent about it. When written multiplicatively, the group identity is written as 1, not 0. The equation $a \cdot a^{-1} = 0$ looks weird... Jun 9 comment Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group? You got it wrong: the inverse of a point $(x,y)$ is the point $(x, -y)$, not $(x, y^{-1})$ Jun 9 reviewed No Action Needed What's wrong with an iterative (with counter) hashed salted KDF? Jun 9 reviewed No Action Needed Vigenère cipher frequency analysis not working Jun 9 reviewed No Action Needed How to find an impossible differential? Jun 9 reviewed No Action Needed zero knowledge framework for c programs - how to prove correct C program execution with private inputs Jun 9 reviewed Close Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. Jun 8 comment RSA public key recovery from signatures Note that, while Samuel's answer is correct, and shows that an attacker can rederive the public key (at least for small $e$), that might not what you want to do routinely. For $e=65537$, this implies computing the $gcd$ of two bignums each 4 million bytes long -- that might take a while... Jun 8 comment RSA public key recovery from signatures That's an odd problem; are you really trying to verify that the signatures are from the same source, even if you don't know what that source is? Jun 8 comment Estimating bits of entropy @Blaze: no, the standards are not messed up. Instead, they take a problem which (as Neil mentioned) is insolvable as defined, and try to come up with a good as an answer as they can practically come up with. What the tools do is come up with a ceiling on the entropy (we're pretty sure that there's no more than N bits of entropy there); that leaves open the question of a lower bound, but we don't know how to solve that problem. Anyone using the tool should realize its limitations. Jun 8 answered Is there a cryptographic algorithm which is immune to side channel attacks? Jun 7 comment Is it possible to choose which point will have the public key of a given Elliptic Curve? Yes, if you can pick the generator, then it's easy; you just select your public key $X$, pick a random number $r$ and compute $r^{-1} \mod q$ (where $q$ is the order of the curve), and then set the generator to be $G = r^{-1}X$; the public key is now $r$ (as $rG = X$) Jun 6 reviewed No Action Needed Is randomsound for increasing entropy pool not doing what it is supposed to do?