32,616 reputation
12669
bio website
location
age
visits member for 3 years, 4 months
seen 2 days ago

2d
comment Calculate number of chips to solve bit commitment using hash function
What 89 bit string would you be brute-forcing? You know R1...
2d
comment Calculate number of chips to solve bit commitment using hash function
How far have you gotten so far?
Dec
15
comment How do we find the subkey out of a differential cryptanalysis?
The exact details of how differential cryptanalysis is used (and how we use a differential to obtain information about the key) depends on the internals of the cipher being attacked; what cipher were you looking at?
Dec
13
comment How do I find a random BigInteger smaller than another random BigInteger?
@GuutBoy: indeed, selecting a large random value is quite normal. However, he specifically mentioned $Z^*_p$, and not all values in that group are the same. Depending on why he is generating that value, that may be an indication that selecting an arbitrary value may select a value that is weak
Dec
13
comment N way collision of hashes
Is this a Merkle-Daamgard hash, or a generic hash? For MD hashes (at least, the ones without output truncation), there are known ways to compute multiway collisions faster than expected.
Dec
12
comment How do I find a random BigInteger smaller than another random BigInteger?
Why are you selecting a random element within $Z^*_p$? In crypto, the order of the element is usually critical (depending on the intended use); by selecting a random element, you won't know if the order is prime (or, for that matter, nonsmooth).
Dec
12
comment Why do we have fixed output length in the algorithm SHA1
@Ching: no, this is not that question. That question asked "do the SHA functions generate a fixed length output". This question is "why?"
Dec
12
comment What are the potential (major) flaws in this security scheme?
@GuutBoy: this is quite true; however depending on the security model, Alice might not care. One real world example of this situation is Amazon; they don't care who is placing an order (the person placing the order does care that they're giving their credit card to Amazon; TLS does have the checks to make sure authentication happens in that direction).
Dec
11
comment S-Boxes and SP-Network
Hints: they are using the bit patterns as some representation of $GF(2^n)$, and doing the computations there; and yyyyyy is correct, they actually mean $2^k$. So, how nonlinear is the function $x^{2^k}$ computed within $GF(2^n)$? Is a linear function a suitable sbox?
Dec
11
comment Is xgcd faster than Fermat for calculating $d$ in RSA?
Typically, when creating an RSA private/public key pair, almost all the time is taken searching for primes; the tiny amount of time taken computing $d$ (or $dp$ and $dq$) is negligible; either method you cite would work.
Dec
9
comment Is a strong block cipher usable as a strong sponge function?
@Joshua: well, I haven't gone through the sponge proofs in detail; however as generally stated, they want a permutation, and encrypting a constant based with the current state as the key wouldn't be invertible. In addition, the same objection would remain: standard block ciphers assume that the key is unknown; allowing the key to be known (and partially influencable by the adversary) doesn't fall under this model.
Dec
9
comment what is the benefit of lcm in cryptography?
Note that it has fewer advantages than you'd hope: if you use the CRT optimization (which most people do), then both $e^{-1} \pmod {(p-1)(q-1)}$ and $e^{-1} \pmod {\mathrm{lcm}(p-1,q-1)}$ lead to the same value of $dp$ and $dq$, and so they operate exactly the same.
Dec
7
comment Block size vs key size confusion
@shin: you're looking at the concept of Unicity Distance; how much ciphertext (and in this case exact plaintext) you need before the key becomes unique; again, it is typically $k+\epsilon$ bits (where $k$ is the number of unknown bits; that would include key bits, and any implicit IV bits). On the other hand, this analysis rather assumes that the attacker can step through all $2^k$ possibilities (or has another short cut); for ciphers that we use in practice, this is believed to be infeasible.
Dec
4
comment Generating an RSA public key certificate (.pem) from only a modulus
An RSA public key needs to specify the public exponent; what would you use? Would you just assume a common value (say, 65537), and just be willing to have the certificate not work if the value that the key generated selected was anything else?
Dec
2
comment Using the same symmetric key in both directions?
"They are sharing an IV" -- what do you mean by that?
Nov
25
comment Cracking RSA with Small exponent 5
To expand what mikeazo said, if they did things properly, then you are unlikely to find a solution. Did you get this as homework (or from someone who indicated that things weren't done properly)? The two obvious things that they might have done wrong is selecting $p$ and $q$ extremely close (so Fermat factorization works), or selected a plaintext message $P < \sqrt[5]{N}$ (in which case computing the fifth-root of the ciphertext gives you P); have you checked both of those?
Nov
25
comment Elliptical curve cryptography key generation time
@ddddavidee: in this case, the naive algorithm (perform $d-1$ point additions) is so expensive that it can't even be done one.
Nov
24
comment Where to store the file extension to retrieve it correctly after decryption
If you don't need to keep the extension secret, the obvious alternative would be to keep that as a part of the filename. For example, you might encrypt the file 'test.pdf' as 'test.pdf.encrypt'.
Nov
21
comment Designing hash function in space-efficient identity based encryption
@hanu: I had assumed that you would generate a random looking value; one way would be to feed the id into a random number generator, generate $\log N + 64$ bits, and then take the result modulo $N$. However, as long as you generate values significantly larger than $\sqrt{N}$, it probably doesn't matter a great deal how you do it (as the squaring process is one-way if you don't know the factorization)
Nov
21
comment Designing hash function in space-efficient identity based encryption
@RickyDemer: well, given that the QR decisional problem is hard if you don't know the factorization, I suspect it might not matter if my method would generate only QR values (because someone else would not be able to distinguish anyways). Of course, that would depend a great deal on why you want values with Jacobi 1 in the first place.