Reputation
38,580
Next tag badge:
385/400 score
81/80 answers
Badges
1 37 84
Newest
 Excavator
Impact
~576k people reached

Jul
10
revised Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
added 317 characters in body
Jul
10
answered Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
Jul
10
awarded  discrete-logarithm
Jul
9
comment Diffie Hellman Exponentiation Implementation Problem
BTW: this isn't actually related to your question, but Diffie-Hellman modulo a 256 bit prime is quite insecure. To be secure, you really need at least 1024 bit Diffie-Hellman as an absolute minimum (with 2048 bit groups strongly encouraged). Alternatively, you might want to consider Elliptic Curve groups; there, a 256 bit EC group is actually secure (but the equivalent of the multiplication (called addition there) is rather more compled)
Jul
9
comment Degenerate discrete logarithm in binary field
@YehudaLindell: actually, if the mechanism succeeds with probability $\epsilon$, then a randomized procedure can solve an arbitrary DL for generator $g$ with an expected $1/\epsilon$ random tries. Then, using that, you can then solve an arbitrary DL for generator $h$ with an expected $2/\epsilon$ random tries (by first applying the base random procedure to $h$ and then applying it to $h^x$)
Jul
9
answered Degenerate discrete logarithm in binary field
Jul
9
comment Diffe-Helman Exchange result is always 1
If the order of $g$ has a factor $q$, then the attacker can, given $g^x$, derive $x \bmod q$ in $O(\sqrt{q})$ work. If the order of $g$ is a large prime, then observation doesn't leak anything.
Jul
8
comment Diffe-Helman Exchange result is always 1
Actually, one can argue that $g$ should generate a large prime order subgroup, as using a generator for the entire group leaks information.
Jul
8
comment RSA algorithm assignment
Hint: if they signify the RSA encryption operation of $M$ as $RSA(M)$, then we have $RSA(A) \times RSA(B) = RSA(A \times B)$ (where $\times$ is modulo $n$). How could you take advantage of that?
Jul
8
comment How bad it is using the same IV twice with AES/GCM?
Actually, if you just reuse an IV once (for distinct plaintexts/AADs), the attacker can limit the possible values for $H$ to a handful of values.
Jul
7
answered RSA: Range of public modulus
Jul
7
comment Calculating Multiplicative Inverse for Rijndael S-box using EEA
Actually, you're almost there. You don't use modulo; instead you use xor if the result is out of range. 465 ^ 283 = 202. Remember, you're not working in the ring of integers; you're working in the ring of polynomials modulo $GF(2)$; you need to use operations that make sense in that realm
Jul
7
comment Can there be a need for 1024-bit (symmetric) encryption?
@SEJPM: there is no known quantum attack that finds collisions in 1024 bit hash functions in $O(2^{256})$ work. There is a claim that (effectively) says that it could be done in $O(2^{341})$ time $(341 \approx 1024/3)$, however others say that the implementation complexity involved with that makes it actually more effort than a classical collision attack at $O(2^{512})$ effort
Jul
7
comment Calculating Multiplicative Inverse for Rijndael S-box using EEA
@FilipFranik: try swapping r with new_r, s with new_s and t with new_t. In essence, you're doing the same logic, but with the assumption that r << quotient (and the other shifts by quotient) is 0
Jul
7
answered Reversing Rotation + XOR
Jul
7
comment Calculating Multiplicative Inverse for Rijndael S-box using EEA
@FilipFranik: actually, you can't shift right. Instead, what you need to do in that case is skip that iteration of EEA, reswap r, s, t, and do that again.
Jul
7
comment Coefficients in Shamir's Secret Sharing Scheme
@bitanic: well, in the case of $N=3$, the middle coefficient is leaked if the two distinct shares x-coordinates $x_1, x_2$ have $x_1 + x_2 = 0$ (which, if you notice in my example, is exactly the case; $1+4 = 0$ in the field). However, in $GF(2^n)$, this relationship holds only if $x_1 = x_2$, and so the two shares are actually the same (and so the attacker doesn't actually obtain enough information).
Jul
7
awarded  Enlightened
Jul
7
awarded  Nice Answer
Jul
7
answered What is the difference between a PRF and a PRF+?