32,041 reputation
12567
bio website
location
age
visits member for 3 years, 3 months
seen 2 days ago

Nov
25
comment Can someone please explain to me what this means?
Might I suggest you ask your professor what he meant by that?
Nov
25
comment Cracking RSA with Small exponent 5
To expand what mikeazo said, if they did things properly, then you are unlikely to find a solution. Did you get this as homework (or from someone who indicated that things weren't done properly)? The two obvious things that they might have done wrong is selecting $p$ and $q$ extremely close (so Fermat factorization works), or selected a plaintext message $P < \sqrt[5]{N}$ (in which case computing the fifth-root of the ciphertext gives you P); have you checked both of those?
Nov
25
comment Elliptical curve cryptography key generation time
@ddddavidee: in this case, the naive algorithm (perform $d-1$ point additions) is so expensive that it can't even be done one.
Nov
24
comment Where to store the file extension to retrieve it correctly after decryption
If you don't need to keep the extension secret, the obvious alternative would be to keep that as a part of the filename. For example, you might encrypt the file 'test.pdf' as 'test.pdf.encrypt'.
Nov
24
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
@Vrundapatel: what form of ECC encryption has homomorphic properties. For example, with EC ElGamal, what operation can you do on two encrypted values which results in an encryption of some nontrivial function of the two plaintexts?
Nov
23
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
@Vrundapatel: if you do need the homomorphic properties of Paillier, then why does it matter how much faster ECC is? After all, ECC doesn't meet your requirements; it doesn't matter how much faster it is.
Nov
21
comment Designing hash function in space-efficient identity based encryption
@hanu: I had assumed that you would generate a random looking value; one way would be to feed the id into a random number generator, generate $\log N + 64$ bits, and then take the result modulo $N$. However, as long as you generate values significantly larger than $\sqrt{N}$, it probably doesn't matter a great deal how you do it (as the squaring process is one-way if you don't know the factorization)
Nov
21
comment Designing hash function in space-efficient identity based encryption
@RickyDemer: well, given that the QR decisional problem is hard if you don't know the factorization, I suspect it might not matter if my method would generate only QR values (because someone else would not be able to distinguish anyways). Of course, that would depend a great deal on why you want values with Jacobi 1 in the first place.
Nov
21
comment Python. RSA common modulus attack problem
There are a couple of problems here (and I don't know Python well enough to give you the answers, hence this comment): a) to compute a 'negative power', you need to compute the modular inverse (and then apply the positive power); Python might provide such a utility, or as fgrieu said, you could do it on your own. b) you are using pow to compute the exponents; that is highly unlikely to work, as ME1^a is going to be huge (perhaps one trillion digits long); instead, you need to compute it modulo N (and again, Python might have a built-it to do that)
Nov
21
comment Designing hash function in space-efficient identity based encryption
The obvious (and more efficient) way to come up with a value with a Jacobi of 1 would be to use a hash function to create a value between 1 and $n-1$ (relatively prime to $n$), and then square it (modulo $n$).
Nov
21
comment Hash collision using the leading 40-bits of SHA-1
@user1813580: why should you expect this logic to find a leading-bit collision within $2^{20}$ iterations; until it falls into a loop, it is effectively doing a random walk through bit patterns; and if you test $2^{20}$ random pairs for 40 bit collisions, you have probability about $2^{-20}$ of finding one. Once you run into a loop, then the bit patterns stop acting randomly (actually, independently), however (as above) you are quite unlikely to run into a loop that early.
Nov
20
comment What is the difference between order of base point and curve order in EC?
@Mhsz: close; it turns out that finite Elliptic Curves need not be cyclic; for example, they can have $Z_2 \times Z_2$ as a subgroup; however that turns out to be cryptographically unimportant, and everything else you said is correct.
Nov
20
comment What is the difference between order of base point and curve order in EC?
possible duplicate of Why would anyone use an elliptic curve with a cofactor > 1?
Nov
20
comment Availability of a simple limited PRNG algorithm
A PRNG is always repeatable given the same seed, whether or not it is cryptographic. What cryptographic means that if you don't know the seed, the output is indistinguishable from random (even if you are given the rest of the details of how the PRNG works)
Nov
19
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
Do you need the homomorphic properties? If you do, then using a system that gives you those properties would be indicated. If not, then you probably are better off with a crypto system that isn't malleable.
Nov
18
comment Elliptic curve trapdoor function without modular arithmetic?
The other potential issue would be how real-based elliptic curves behave. If (say) the x-coordinate of $dG$ was approximately $c a^d$ for some values $c, d$, this would imply an efficient way to do logs (I almost wrote 'discrete logs'...)
Nov
18
comment Elliptic curve trapdoor function without modular arithmetic?
Real numbers don't work real well in crypto, because we typically hope to be able to express the values we use, and almost all real numbers cannot be expressed, even with an unbounded number of bits.
Nov
18
comment proving the security of 1 out of 2 oblivious transfer using AND function
Is the question on how to do OT using an AND function, or is it how to construct an AND function using OT? Your second paragraph says the latter; your first paragraph (and the title) says the former (and, BTW: both are possible; constructing AND out of OT is a lot more straight-forward).
Nov
18
comment Malicious DH groups
I can give one partial negative answer: we can show that the values of $g$ of the same order are equivalent, as far as the DLOG and cDH problems; if you can solve either the DLOG or the cDH problems with respect to one $g$, you can solve it for any other $g$ of the same order (with at most a polynomial number of queries). Hence, if there is a way to find a malicious group, the magic is in selecting $p$ and $q$.
Nov
16
comment Checking both Quadratic residuosity and Jacobi symbol simultaneously and efficiently
Yes, our answers are pretty close; we both provide ways to do it, given a little bit of help from the key generator. With you, the help is an example value of $s$; with mine, it's asking him to ensure $p \equiv q \equiv 3 \bmod 4$ (and with that, we can find a value of $s$ ourselves)