Reputation
44,904
Next tag badge:
392/400 score
82/80 answers
Badges
1 51 107
Newest
 Nice Answer
Impact
~746k people reached

Jan
20
comment Are there any successful preimage attacks?
I believe that generating preimages for MurmurHash is actually pretty trivial...
Jan
20
comment Zero-knowledge proof for the product of additive Paillier ciphers
If each entity sends $E(x_i)$ to Bob, why do they need to send anything else? Isn't that sufficient for Bob to verify that Alice's $E(\sum x_i)$ is correct?
Jan
20
comment collision resistant hash function
These sorts of questions can typically solved in one of two ways: 1) constructing an $H$ that means the requirements (collision resistant), but leads to an $\hat{H}$ which does not, or 2) if someone finds a collision in $\hat{H}$, show how this necessarily gives you a collision for $H$. Which of these two approaches work in this case?
Jan
20
comment Complexity using RSA
First step: how about "How about computing the complexity of each mulmod (as a function of the size of n)"?
Jan
20
comment Complexity using RSA
How about computing the complexity of each mulmod (as a function of the size of n), the number of mulmod's you need (again, as a function of the size of n), and hence the total complexity; how big of an n would still fit within your budget?
Jan
20
reviewed Approve Example of Projective Coordinates
Jan
19
comment If you use an AES key just once, do you need to use IV, and/or pad the message?
Also, the answers to any questions about IV or padding will generally depend on the block cipher mode you're using (as it's the mode, rather than AES, which actually uses the IV/padding). What mode would you be using?
Jan
19
comment Could we share a secret key using the Birthday problem?
Actually, this code looks like it implements Merkle's original idea (which he later refined into the puzzle format)
Jan
18
answered XOR or add in one time pads?
Jan
18
comment Encryption scheme like RSA where encryption is the inverse of decryption
@SEJPM: actually, that's true for RSA only at an abstract level; in practice, encryption and decryption differ in padding processing, the fact that the encryption exponent is generally chosen to be small, and that during the decryption exponent, we can speed things up by taking advantage of knowledge of the factorization.
Jan
17
comment Uniformly distributed sub-sequences of a main PRG sequence
Actually, in my experience, the most annoying cost of a Lamport signature is the size of the signature (and we generally go with Winternitz, which allows us to reduce that size somewhat with an not excessive computational cost)
Jan
16
comment Is this a secure keyed hashing construction?
Alternatively, just use CMAC
Jan
16
answered Computing the cardinality of the co-domain of specific modular exponentiations
Jan
16
comment Limitations of Elliptic Curve Cryptography?
Minor correction to limitation 1: we know how to generate ECDSA signatures securely without a random number generator, for example, see RFC 6979 for one such way
Jan
16
comment Using Montgomery ladder to calculate the coordintes
See en.wikipedia.org/wiki/…
Jan
16
comment Using Montgomery ladder to calculate the coordintes
Do you know what the Montgomery ladder algorithm is?
Jan
14
comment Encryption technology for DARPA
As the author, you have a great deal of flexibility; you could make it quite easy (for example, an admin used the same password as his Ashley Madison login), you could make it quite difficult (as requiring a Quantum Computer, if you need a technical term, try "Elliptic Curve"), or completely impossible. Setting things up so that, without a QC, it'd be completely infeasible would be plausible.
Jan
13
comment Public key exponent coprime with totient proof
You're getting grief because your first sentence is not correct: "the private key exponent $d$ is the (unique) multiplicative inverse modulo $\phi(n)$". Actually, a necessary and sufficient condition on $d$ is that $ed \equiv 1 \pmod{lcm(p-1,q-1)}$ (assuming $p, q$ are the prime factors of $n$). Because there exist valid $d$ values with $ed \not\equiv 1 \pmod{(p-1)(q-1)}$ (and there always will, assuming $p, q > 2$), your reasoning doesn't follow (even though the statement you're proving is true).
Jan
13
comment Are low security curves for ECDSA not supported?
Alternatively, you might want to consider whether a Message Authentication Code fits within your security requirements. With a MAC, the "signer" and the "verifier" share the same key (and so the "verifier" could "sign" if he wants); if that is not a problem for you (and I don't know enough about your situation to say), MACs use much less bandwidth than signatures.
Jan
13
comment For which RSA moduli, precisely, is $e=d$ for all $e$?
@CédricVanRompay: for $n=45$, there are ciphertexts that cannot be uniquely decrypted (e.g. $c=36$), for any $e>1$, hence I would claim that is not a valid RSA modulus.