Reputation
Next tag badge:
99/100 score
25/20 answers
Badges
1 35 80
Newest
 Nice Answer
Impact
~553k people reached

Jun
17
reviewed Leave Closed Securely start a client server connection without ssl/tls
Jun
17
reviewed Close Epsilon Differential privacy using Laplace distribution
Jun
17
reviewed Leave Open Compression in Symmetric-Encryption?
Jun
17
reviewed Leave Open Digital signature in a group chat scenario?
Jun
17
reviewed Leave Open pseudo random generator from length preserving one way function which is not permutation!
Jun
17
reviewed Leave Open An electronic voting system
Jun
17
reviewed Leave Open Can I use an ECDH Shared Secret from the same Private / Public Key Pair?
Jun
17
comment How to generate own secure elliptic curves?
@SOJPM: I suspect that the ideas within the paper predated Logjam; however the paper itself is obviously recent (it references a paper published on ePrint in April).
Jun
16
answered How to generate own secure elliptic curves?
Jun
16
comment Post-quantum authenticated encryption
@Paya: no, symmetric crypto such as MACs generally don't need to worry about Shor's algorithm (and Grover's just does key-halving). As for GCM, well, unless AES is broken, the security proof still holds, even if the attacker has a QC.
Jun
16
awarded  Caucus
Jun
16
answered Period of pseudo random sequence generated from (5, 2, 0) LFSR
Jun
15
comment AES process candidates implementations and usages
Isn't RC6 patented?
Jun
15
answered Compression in Symmetric-Encryption?
Jun
15
comment Digital signature in a group chat scenario?
Do you want to be able to say 'this message came from Bob', or are you content with 'this message came from someone in the group (but I have no idea which group member)'?
Jun
15
comment How to quickly detect incorrect password in encrypted file without compromising security?
Is there a specific reason why you can't force this check after decrypting the file? After all, no matter how expensive you make this check, the attacker can decrypt the file (based on a trial password), and see if that decryption is plausible. Hence, any check you force which is more expensive than that can be ignored by the attacker (while the legitimate user still has to pay for it).
Jun
14
comment Blinding value of particular form
It is easy to show that if $r$ is a uniformly distributed value in $Z^*_n$ (that is, relatively prime to $n$), then $r^2$ is a uniformly distributed value in the subgroup of Quadratic residues relatively prime to $n$.
Jun
14
comment Blinding value of particular form
Actually, if you take SOJPM's suggestion, you needn't check the Jacobi's explicitly at all, as they'd always be 1 (the squaring implies that they can't be -1, as $r$ would not be a Quadratic nonresidue modulo $p$ or $q$, and they can't be 0 because if they were, the multiplicative inverse wouldn't exist). As for efficiency, this would reduce the number of loops to 1 (except in the extremely unlikely case you picked an integer that isn't coprime to $n$).
Jun
14
revised Why does UMAC encrypt the output of universal hash function?
deleted 1 character in body
Jun
14
answered Why does UMAC encrypt the output of universal hash function?