Reputation
38,410
Next tag badge:
384/400 score
80/80 answers
Badges
1 36 82
Impact
~573k people reached

19h
comment Can non-assembly crypto libraries truly be secure against timing attacks?
You can't really control what's in the L1/L2 cache with assembly; that also depends on interrupts the CPU takes, and what the other cores are doing (neither of which are under the user's control). If you controlled the operating system as well, you would have hope; however I believe that's focusing in on the wrong question; the answer to timing attacks isn't having precisely consistent timing, but have any variation in the timing uncorrelated to any secret we have.
2d
comment Encryption algorithms larger than 256 Bit for “big data” encryption?
Are you asking "why do we generally restrict our (symmetric) keys to 256 bits"? If you aren't asking that, what are you asking?
2d
comment One time pad ciphers in emails
The "keyword"??? If you're doing OTP, you don't distribute a keyword; instead, you distribute a random string of bits at least as long as the message you'll be sending...
2d
comment ElGamal in $Z^*_{p^n}$
Another way (and, it turns out, an equivalent way) of looking at it is that if we know that if we have a solution for $a^x = b \bmod 3^n$, then we can easily find a solution for $a^x = b \bmod 3^{n+1}$; hence we can start with $n=1$, and work our way up.
Jul
29
comment I don't know whattype of cipher this is
My guess is that it's some sort of transposition cipher (the letters are rearranged)
Jul
27
comment Library to find an addition chain for a large number?
What do you mean by 'good'? The simple-minded binary method gives a decent one (within 50% of optimal for random inputs), and is completely trivial to compute. If that's not good enough, how close to optimal are you demanding?
Jul
27
comment Permuting Small Sized Set in Practice
I believe you need to rethink what security means in this context. It doesn't mean that the attacker can't take a guess at the permutation (and have a $1/|S|!$ chance of getting it correct). Instead, it's that the attacker doesn't get any additional information about the permutation. That is, even if $|S|=2$, the attacker knows that either the two elements remain where they are, or that they are swapped; but he doesn't know which it is.
Jul
27
comment Reduction to cdp,dl or cdh?
Where does the randomization come into play? $f(x) = g^{sk \cdot x} \bmod p$ (for fixed $g$, $sk$, $p$) looks determanstic.
Jul
27
comment Construction of ElGamal signature?
As for a hint to #1, if you know $s$ and $r$ with $s = k^{-1}(m + ar)$ (for some unknown $k$, $a$; what would you need to adjust to make an $s' = k'^{-1}(rm + ar')$ (for some $k'$, $r'$ that are related to the original $k$, $r$)? I'd suggest trying to figure out what $r'$ needs to be first; then going back to the $r = g^k$ relation to deduce what $k'$ needs to be.
Jul
23
comment parallel shifters
You might want to revise your question - I really can't make heads or tails of it. You might want to outline what problem space you're looking at (e.g. does 'register' mean a CPU register, or a set of flipflops on an FPGA?); you probably want to be a bit more explicit about the question as well.
Jul
20
comment How many bits to flip in an RSA public key to do signature forgery?
@dannycrane: that was discussing the $e=3$ case; if $n = pq$, where $p$ and $q$ are primes, then $p=2 \pmod{3}$ (because that's a requirement that RSA makes if $e=3$) and $q = 2 \pmod{3}$ (ditto), and hence $pq = 2\cdot 2 = 1 \pmod{3}$. As for what $n - n'$ is nonzero mod $e$, well, flipping bit $k$ of $n$ will either increase it's value by $2^k$ (if the bit was original 0), or decrease it by $2^k$ (if it was 1). Hence, $n - n'$ is either $2^k$ or $-2^k$. As $e$ is odd, then neither $2^k$ nor $-2^k$ will be a multiple of $e$, and that's what $(n - n') \bmod e \ne 0$ means
Jul
19
comment Is a book cipher provably secure?
How is this an answer to the question?
Jul
18
comment How many bits to flip in an RSA public key to do signature forgery?
@dannycrane: what I was thinking was that we knew that $n' \bmod e \ne 0$ (because we previously checked that $n'$ was prime), and hence there are $e-1$ possible values of $n' \bmod e$, one of which is 1. Actually, if we look deeper, it's rather more complex. Actually, if $e=3$, and $n$ is a standard RSA modulus (with two prime factors), the probability that $n' \bmod e \ne 1$ is 1; that's because $n \bmod e = 1$ (as it's the product of two $2 \bmod 3$ primes), and $n-n' \bmod e \ne 0$ (as that difference is $2^k$, for some integer $k$)
Jul
18
comment How many bits to flip in an RSA public key to do signature forgery?
@MaartenBodewes: actually, it wouldn't set $d$ to a low value; instead, it would be detectable because the proported $n$ would be prime (alternatively, easy to factor), should anyone happen to check.
Jul
11
comment RSA signatures without padding
@SEJPM: not off the top. However, this sort of 'factor a series of 256 bit integers, and look for a linear combination' is somewhat similar to what the Quadratic Field Sieve does when factoring a 512 bit number, and so there's a (very) rough starting point...
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@CodesInChaos: Bingo!
Jul
10
comment Are there transitive ciphers (either symmetric and asymmetric)
@SEJPM: it is formally named for its inventors, which I am totally blanking on right now - it dates back to the 70s. As for why $y$'s there, well, that's because I changed my explination midway through - I was originally going to talk about Alice's and Bob's secret keys together.
Jul
9
comment Diffie Hellman Exponentiation Implementation Problem
BTW: this isn't actually related to your question, but Diffie-Hellman modulo a 256 bit prime is quite insecure. To be secure, you really need at least 1024 bit Diffie-Hellman as an absolute minimum (with 2048 bit groups strongly encouraged). Alternatively, you might want to consider Elliptic Curve groups; there, a 256 bit EC group is actually secure (but the equivalent of the multiplication (called addition there) is rather more compled)
Jul
9
comment Degenerate discrete logarithm in binary field
@YehudaLindell: actually, if the mechanism succeeds with probability $\epsilon$, then a randomized procedure can solve an arbitrary DL for generator $g$ with an expected $1/\epsilon$ random tries. Then, using that, you can then solve an arbitrary DL for generator $h$ with an expected $2/\epsilon$ random tries (by first applying the base random procedure to $h$ and then applying it to $h^x$)
Jul
9
comment Diffe-Helman Exchange result is always 1
If the order of $g$ has a factor $q$, then the attacker can, given $g^x$, derive $x \bmod q$ in $O(\sqrt{q})$ work. If the order of $g$ is a large prime, then observation doesn't leak anything.