Reputation
35,585
Next tag badge:
98/100 score
29/20 answers
Badges
1 30 74
Newest
 Taxonomist
Impact
~496k people reached

3h
comment DHKE choice of private keys
@CodesInChaos: oops, you're right -- I typo'ed that - I meant to say $[1,2^{256}]$.
6h
comment DHKE choice of private keys
@CodesInChaos: probably. Now, when I do DH, I pick a secret randomly from a range such as $[1, 2^{128}]$; that keeps the DLOG problem just as hard, makes the computation cheaper (and incidentally avoids hard cases such as $(p-1)/2$
8h
comment Is it ever unsafe to compress an EC point?
@CodesInChaos: actually, there's a deterministic solution in that case as well; it's a tad more complex than the 3 mod 4 solution, but still works. What's tougher is the 1 mod 8 case...
1d
comment Length of prime number used in Pedersen Commitment
One requirement would be that $g$ and $h$ be a part of the same subgroup (otherwise, the commitee can deduce some information on $x$). Given that it's also important that no one know the discrete log $\log_g h$, it would appear wise to select $(p-1)/2$ prime (and select $g$ and $h$ to be random quadratic residues); alternatively, work in an elliptic curve with a prime order.
1d
comment Plaintext block chaining, bad idea why?
Hint: what happens if you encrypt extremely redundant plaintext, say, 3 blocks of all the same character?
2d
comment Is it ever unsafe to compress an EC point?
Huh? To decompress a point, you need to compute a modular square-root. If $p \equiv 3 \pmod 4$, that's easy to do. If one were to work in a prime field with $p \equiv 1 \pmod 4$, then, yes, it's a bit more difficult, and you will need to find a quadratic nonresidue (which isn't that complicated -- pick random points until you find one works); however we generally work in fields with characteristic 3 mod 4.
2d
comment Is chaotic encryption secure?
The proof of the pudding is in the eating, and the proof of the cryptosystem is in the cryptanalysis. Until I see a chaos-based system undergo cryptanalysis by someone who knows what they're doing, I don't see any reason to trust it.
Apr
16
comment Key space vs Cardinality of 1024-bit RSA
Actually, the keyspace would be the set of prime pairs between $2^{511}$ and $2^{512}$. Actually, it's somewhat less, because we insist that the product be between $2^{1023}$ and $2^{1024}$. The set of prime pairs between $2^{511.5}$ and $2^{512}$ is one way to evaluate it.
Apr
16
comment Key space vs Cardinality of 1024-bit RSA
Actually, for 1024-bit RSA, the primes generated will typically be 512 bits each...
Apr
16
comment Are keys generated by the user or block cipher algorithms themselves?
How key generation is done is a very broad topic; there are lots of ways it can be done, and as far as the block cipher algorithm is concerned, it's done by someone else.
Apr
16
comment Why is the call to RSA_generate_key_ex() failing sometimes?
Why isn't "even exponents don't work" an adequate explination? Also, why is using a fixed exponent of 65537 considered a "workaround"? It's what a lot of real RSA implementations actually use.
Apr
16
comment Why is the call to RSA_generate_key_ex() failing sometimes?
Might you be picking an even public exponent about half the time? It's possible that RSA_generate_key_ex isn't designed to handle that.
Apr
16
comment Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks
Actually, I would have to disagree that, as long as you pick your DH values randomly, you're probably safe. If your value $g$ has an order $n$ with a small factor $q$, then the attacker can compute the secret exponents modulo $q$. If you pick $g$ and $p$ totally at random, there's a nonnegliable probability that $n$ will have a number of small factors; and hence you'll leak a nontrivial part of the secret. Yes, if you make the secret exponents larger to compensate -- you have to know to do so.
Apr
16
comment Choosing finite field size in Shamir's Secret Sharing Scheme
@VadymFedyukovych: it's not at all clear how good you could make it. Apart from the issues for leaking lsbits (e.g. if you have shares for 3 and 26, I believe that might leak the secret modulo 26-3=23, as 23 is uninvertible in the integers, you also have the problem of probability distributions. You must pick coefficents according to some nonuniform distribution; with $t-1$ shares, the attacker can compute, for any possible secret value, the coefficients that would have been. If any of the coefficents have probabilities that are too small, the attacker can eliminate that possibility.
Apr
16
comment Why perfect secrecy can be ensured when a plain message and a cipher-text based on one-time pad are correlated?
@zhu: if you think there might be a correlation, you might find it fruitful to select a probability distribution for $M$, and compute the resulting distribution of $M \oplus K$ (assuming an independent $K$)
Apr
14
comment Choosing finite field size in Shamir's Secret Sharing Scheme
Actually, if $p=251$, then you can't fit an 8 bit value there; there are only 251 possible secret values, and hence there are 5 possible values of $S_i$ that cannot be shared.
Apr
13
comment What’s the output of two round Feistel network
I'm voting to close this question as off-topic because it's a duplicate (I just can't mark it as a duplicate as the other question doesn't have an answer)
Apr
13
comment Is the key schedule of Serpent a circle?
What's your definition of 'a circle'? Do you mean that the octtuple $w_i$ through $w_{i-7}$ doesn't repeat until after $2^{256} - 1$ values?
Apr
13
comment Prove there is PRG that is not necessarily one-to-one
@ebad: no, that idea doesn't work: why would you expect that $G_2(x) = G_2(y)$ for some $x \ne y$?
Apr
10
comment Is $f\colon x\mapsto g(x+1)$ necessarily a pseudorandom function?
If we were to have a distinguisher for $f$, what would that imply about $g$? If we know that $g$ doesn't have a distinguisher, what does that imply about $f$?