28,852 reputation
12156
bio website
location
age
visits member for 2 years, 11 months
seen 7 hours ago

Dec
3
comment Keyed digest function with odds of collision below the birthday bound?
Question: can we choose how $R_S$ is derived in a way to help our $F$ function? (assuming, of course, that the adversary in (3) does not know it; if he does, iot looks infeasible)
Dec
3
answered Why can an RSA signature be authenticated ONLY with the signer's public key?
Dec
3
answered RSA performance
Dec
3
answered Is the composition of collision resistant hash with non collision resistant hash a collision resistant hash?
Nov
26
comment How can Shamir's method for secret sharing work in the GF(256)?
@PaŭloEbermann: Shamir's secret sharing requires that the secret polynomial be selected from a uniform distribution; it turns out that's impossible for the rationals (or any other set of size $\aleph_0$). As for the reals, well, that can be defined, but the fact that you cannot express (almost all) elements in a finite number of bits is a bit of a drawback. Hence, in both cases, you could say that Shamir's secret sharing "doesn't work"
Nov
26
comment Speed up modular exponentation with fixed base and modulus
@SmitJohnth: if you call a factor of 3 speed up "not a big gain", you are correct. However, if you use (say) base 16 (as the paper you sited mentioned), that's $1/4 \log_2(x)$ time; that's a factor of 6 speed up. Are we getting close to what you would call "a big gain"?
Nov
26
comment Speed up modular exponentation with fixed base and modulus
@SmitJohnth: yes, it is $pop(x)$; that's why I said "average" (because the average of $pop(x)$ is $1/2\log_2(x)$
Nov
26
answered Speed up modular exponentation with fixed base and modulus
Nov
26
reviewed Approve suggested edit on Speed up modular exponentation with fixed base and modulus
Nov
26
comment Is it possible to attack RSA with a WalkSat derivative?
Technically, you haven't quite implemented the algorithm he listed. He included the step "For m taking values from 1 to n, perform the following three steps (actually, for each m, perform many cycles, as described below)."; you use a fixed m=32. I suspect that varying m improves the algorithm to a small degree (in the example you sited, the m=12 iteration has a good chance at stumbling upon a factor relatively quickly), however it is still quite pointless against an RSA number.
Nov
26
reviewed Approve suggested edit on Adding and multiplication in jacobian coordinates
Nov
26
awarded  diffie-hellman
Nov
23
reviewed Approve suggested edit on Finding ECDSA public key from signature samples
Nov
22
comment Is $q(n)=1/n$ a negligible function?
Why wouldn't it be?
Nov
22
comment Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it?
Why would you be looking for such a technique? One obvious problem with this is that it unavoidably leaks some information to the attacker. For example, if you have a list of numbers (which do not include the value 7), and you encrypt it, and the garbage you insert also do not contain a 7, then the attacker can deduce that the value 7 did not appear in the plaintext. Given that commonly accepted encryption methods do not have this drawback, why are you specifically looking for a method that does?
Nov
22
comment Can cryptocurrency mining devices be used for cryptanalysis?
Actually, the crypto we use isn't scaled to 'suppose we used every atom in the universe as a computer'; at those levels, AES-256 (for example) is fairly quickly broken; instead, we attempt to scale our primitives to a more realistic work effort (that we still have good reason to believe is beyond any plausible attacker). This doesn't change your main point; that bitcoin mining hardware doesn't have anywhere close enough horsepower to make a dent against a modern crypto primitive.
Nov
22
reviewed Approve suggested edit on Can cryptocurrency mining devices be used for cryptanalysis?
Nov
22
reviewed Approve suggested edit on Is encrypting a public key with a symmetric key safe?
Nov
21
comment Recovering the random number r
@hheluilop: There's no need to fully factor $p-1$; all you really need is $u = gcd(p-1,s)$ and $v = (p-1)/s$
Nov
21
comment How to break AES/CBC/PKCS5 when key and IV are reused?
@Heathkit7: well, no block cipher would be considered secure if it were vulnerable to a known plaintext attack; hence it's not specific to AES. Now, if you used 3DES, say, or Blowfish, then my last observation (that you can guess individual blocks) would be useful (because in that case, you could verify a guess which had the first 8 bytes correct, rather than having to get all 16 bytes correct at once)