Reputation
48,201
Next tag badge:
94/100 score
20/20 answers
Badges
1 57 113
Impact
~833k people reached

Apr
8
comment Is it possible to utilize an AES-128 encryption hardware unit for AES-256?
@SEJPM: I've seen other AES hardware implementations that use a pre-expanded key schedule, so the answer is "maybe"
Apr
8
answered Is it possible to utilize an AES-128 encryption hardware unit for AES-256?
Apr
8
awarded  one-time-pad
Apr
7
answered One-time pad using RSA and Diffie-Hellman functions
Apr
7
comment Key size limitations due to software compatibility?
I wouldn't recommend RSA at any key size for security >2030/2040. It's quite plausible that someone will be able to build a Quantum Computer within that timeframe; a decent size Quantum Computer would be able to break any plausible RSA key size.
Apr
6
answered Trusted Third Party Cryptanalysis Labs?
Apr
6
comment Filling in MD5 input variables
Other than brute force (that is, trying possibilities until you hit upon something that hashes the right value), no, not really...
Apr
6
comment Product of Vigenère ciphers is not a Vigenère cipher with length of LCM
@Jean-FrançoisGagnon: and, if you examine it even closer, you'll see that $|\mathcal{V}_2 \times \mathcal{V}_3| = 26^4$; that's because for two keys $v_2, v_3$, you can add an integer ($\bmod 26$) to each character in $v_2$, subtract that same integer to each character in $v_3$, and you haven't changed the operation. Hence, for every possible transform in $\mathcal{V}_2 \times \mathcal{V}_3$, there are 26 possible pairs of keys that generate it.
Apr
6
comment Is the Discrete logarithm problem suitable for this pairing scheme?
@astyst: a solution is a pair $(x, y)$ (or $(r, Ans)$ in your terminology) that solves the equation. As for a definite y value is defined, how is the attacker supposed to recognize the correct solution (as opposed to the huge number of possible incorrect solutions)? Within your scheme, there probably is more information that an attacker can use (if he needs a specific solution); however you haven't given us that.
Apr
5
comment Product of Vigenère ciphers is not a Vigenère cipher with length of LCM
@Biv: actually, your example is equivalent to the key "aaaa"...
Apr
5
revised Product of Vigenère ciphers is not a Vigenère cipher with length of LCM
added 7 characters in body
Apr
5
answered Product of Vigenère ciphers is not a Vigenère cipher with length of LCM
Apr
5
comment Is (AES-)GCM parallelizable?
@Demetri: a bitslice's implementation of GCM can certainly use the above trick to compute the MAC tag (while processing multiple blocks at once)
Apr
5
answered Is the Discrete logarithm problem suitable for this pairing scheme?
Apr
4
comment Trusted Third Party Cryptanalysis Labs?
Alternatively, you could select a public cryptanalyst (someone with published attacks on cryptosystems similar to yours), and pay them to analyze your cipher. Now, if they don't find anything, it wouldn't serve as proof to the rest of the community (your cryptanalyst might have missed something); it would serve as evidence that there's no trivial weaknesses...
Apr
3
comment How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?
BTW: IKE groups 1 (768 bits) and 2 (1024 bits) are considered to be too small for use today, as it is likely that those could be broken by large real world adversaries. If you are considering using either of those two groups, you would be well advised to instead use group 14 (2048 bits). If, on the other hand, you were using those two groups as an example (to illustrate your question), well, to quote a wise woman: "never mind..."
Apr
3
comment How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?
What they really mean is that $g$ is the generator for the subgroup they'll be using during the exchange (which, in this case, happens to be the subgroup of quadratic residues)
Apr
3
answered Is multiplicative blinding less secure than additive?
Apr
2
answered For what does “Rcon” stand for in Rijndael/AES?
Apr
2
answered CCA on PKCS#5 using error feedback