poncho
Reputation
44,904
392/400 score
 Jan 20 comment Are there any successful preimage attacks? I believe that generating preimages for MurmurHash is actually pretty trivial... Jan 20 comment Zero-knowledge proof for the product of additive Paillier ciphers If each entity sends $E(x_i)$ to Bob, why do they need to send anything else? Isn't that sufficient for Bob to verify that Alice's $E(\sum x_i)$ is correct? Jan 20 comment collision resistant hash function These sorts of questions can typically solved in one of two ways: 1) constructing an $H$ that means the requirements (collision resistant), but leads to an $\hat{H}$ which does not, or 2) if someone finds a collision in $\hat{H}$, show how this necessarily gives you a collision for $H$. Which of these two approaches work in this case? Jan 20 comment Complexity using RSA First step: how about "How about computing the complexity of each mulmod (as a function of the size of n)"? Jan 20 comment Complexity using RSA How about computing the complexity of each mulmod (as a function of the size of n), the number of mulmod's you need (again, as a function of the size of n), and hence the total complexity; how big of an n would still fit within your budget? Jan 20 reviewed Approve Example of Projective Coordinates Jan 19 comment If you use an AES key just once, do you need to use IV, and/or pad the message? Also, the answers to any questions about IV or padding will generally depend on the block cipher mode you're using (as it's the mode, rather than AES, which actually uses the IV/padding). What mode would you be using? Jan 19 comment Could we share a secret key using the Birthday problem? Actually, this code looks like it implements Merkle's original idea (which he later refined into the puzzle format) Jan 18 answered XOR or add in one time pads? Jan 18 comment Encryption scheme like RSA where encryption is the inverse of decryption @SEJPM: actually, that's true for RSA only at an abstract level; in practice, encryption and decryption differ in padding processing, the fact that the encryption exponent is generally chosen to be small, and that during the decryption exponent, we can speed things up by taking advantage of knowledge of the factorization. Jan 17 comment Uniformly distributed sub-sequences of a main PRG sequence Actually, in my experience, the most annoying cost of a Lamport signature is the size of the signature (and we generally go with Winternitz, which allows us to reduce that size somewhat with an not excessive computational cost) Jan 16 comment Is this a secure keyed hashing construction? Alternatively, just use CMAC Jan 16 answered Computing the cardinality of the co-domain of specific modular exponentiations Jan 16 comment Limitations of Elliptic Curve Cryptography? Minor correction to limitation 1: we know how to generate ECDSA signatures securely without a random number generator, for example, see RFC 6979 for one such way Jan 16 comment Using Montgomery ladder to calculate the coordintes Jan 16 comment Using Montgomery ladder to calculate the coordintes Do you know what the Montgomery ladder algorithm is? Jan 14 comment Encryption technology for DARPA As the author, you have a great deal of flexibility; you could make it quite easy (for example, an admin used the same password as his Ashley Madison login), you could make it quite difficult (as requiring a Quantum Computer, if you need a technical term, try "Elliptic Curve"), or completely impossible. Setting things up so that, without a QC, it'd be completely infeasible would be plausible. Jan 13 comment Public key exponent coprime with totient proof You're getting grief because your first sentence is not correct: "the private key exponent $d$ is the (unique) multiplicative inverse modulo $\phi(n)$". Actually, a necessary and sufficient condition on $d$ is that $ed \equiv 1 \pmod{lcm(p-1,q-1)}$ (assuming $p, q$ are the prime factors of $n$). Because there exist valid $d$ values with $ed \not\equiv 1 \pmod{(p-1)(q-1)}$ (and there always will, assuming $p, q > 2$), your reasoning doesn't follow (even though the statement you're proving is true). Jan 13 comment Are low security curves for ECDSA not supported? Alternatively, you might want to consider whether a Message Authentication Code fits within your security requirements. With a MAC, the "signer" and the "verifier" share the same key (and so the "verifier" could "sign" if he wants); if that is not a problem for you (and I don't know enough about your situation to say), MACs use much less bandwidth than signatures. Jan 13 comment For which RSA moduli, precisely, is $e=d$ for all $e$? @CédricVanRompay: for $n=45$, there are ciphertexts that cannot be uniquely decrypted (e.g. $c=36$), for any $e>1$, hence I would claim that is not a valid RSA modulus.