26,223 reputation
11947
bio website
location
age
visits member for 2 years, 8 months
seen 12 hours ago

Sep
17
answered PKCS1 and blind RSA signatures
Sep
16
comment Explanation of the Decision Diffie Hellman (DDH) problem.
@Alex: when we state "problem X can be reduced to problem Y", we mean that if we are given a solution to problem Y, we can then solve problem X (hence, X is either easier, or as difficult, as Y). In this case, if you are given a magic black box that, given $g$, $g^a$, $g^b$, gives you $F(g^{ab})$, the CDH problem remains hard; we can recover the value of $F(g^{ab})$, however there doesn't appear a way to get the full $g^{ab}$ value demanded by CDH
Sep
12
revised Proof of correct construction of a private key in distributed cryptography
Minor correction
Sep
12
answered Proof of correct construction of a private key in distributed cryptography
Sep
11
revised Recasting randomly generated numbers to other widths
English fixups
Sep
11
answered Recasting randomly generated numbers to other widths
Sep
11
comment Hide a weakness in ECC by choosing the prime or one of the curve coefficients
One note: you can take (5) off the list; it is known that, on a curve of prime order, no member (other than the PoI, of course) is particularly weak; if we can solve the DLOG or cDH problem with one generator, we can solve them with any generator. If there is a weakness, it must reside in the combination of $p$ and $b$.
Sep
10
comment Is there a theoretical maximum useful keysize given the block-size?
This is wrong; the submitter is well aware that if keys are greater than $N$ bits, then there must be plaintext $P$ and keys $k_1$ and $k_2$ with $E_{k_1}(P) = E_{k_2}(P)$. The submitter went on to specify that $E_{k_1}(P) = E_{k_2}(P)$ for all values of $P$; in general, this may not be possible for two distinct keys of size only $2^{2N}$.
Sep
8
reviewed Approve suggested edit on s-mime tag wiki
Sep
8
reviewed Approve suggested edit on s-mime tag wiki excerpt
Sep
6
reviewed Approve suggested edit on Is the “secure-as-worst-case” version of NTRU patented?
Sep
6
comment Can stream ciphers (usually) be “run backwards”?
@HenrickHellström: it is precisely correct as I wrote it; if you have an iterated invertible next state function, so your states are $X_0, F(X_0), F(F(X_0)), ..., F^n(X_0)$, and all the states you've visited so far are distinct, then the only way you have fall into a loop on the next state is if $X_0 = F^{n+1}(X_0)$; that is, you revisit the initial state. If we drop the assumption on invertibility, the $F^{n+1}(X_0)$ can be any of the previous states.
Sep
6
comment Can stream ciphers (usually) be “run backwards”?
@HenrickHellström: "it is not sufficient that the next-state function is a permutation, but it must also be a single cycle permutation"; how do you come to that conclusion? OFB with a specific key is (likely) not a single cycle permutation; are you attempting to argue that it must be insecure?
Sep
6
answered Can stream ciphers (usually) be “run backwards”?
Sep
6
reviewed Edit suggested edit on What is it meant by a “hybrid argument”?
Sep
6
revised What is it meant by a “hybrid argument”?
Added "distinguisher" tag.
Sep
5
awarded  Reviewer
Sep
5
reviewed Approve suggested edit on backdoors tag wiki
Sep
5
reviewed Approve suggested edit on backdoors tag wiki excerpt
Sep
5
comment Can GCM be used in incremental mode?
@Shark: again, the issue is giving the authentication tag for two different encrypted messages (it doesn't matter if one is a prepend of the other); the fact that this is easy to compute isn't relevant.