Reputation
37,610
Next tag badge:
99/100 score
25/20 answers
Badges
1 35 80
Newest
 Nice Answer
Impact
~552k people reached

13h
comment How often does RSA-OAEP have a leading zero?
If your vendor is unwilling to describe precisely what their crypto is doing, that is a strong indication to move to another vendor who is more transparent. The details on how to do strong crypto are not trade secrets; if they're hiding something, the likelihood is that they're hiding how bad their implementation actually is.
2d
comment Ideas for non duplicate cryptographically secure numbers
How large do the numbers need to be (in terms of bits)? They need to be at least 36 bits (so that there are at least 50 billion distinct possibilities)
2d
comment “AND” concatenation of two secure PRGs
It looks like you answered your own question...
2d
comment What happens if no final subtraction is done in Montgomery multiplication?
Stupid question: why are you using Montgomery Multiplication for $2^{255}-19$ in the first place? The reason we do Montgomery Multiplication is to make the modulo operation easier; however with $N=2^{255}-19$, it's already awfully easy, as $a \cdot 2^{255} + b \equiv a \cdot 19 + b \pmod{2^{255}-19}$
2d
comment “AND” concatenation of two secure PRGs
Hint: what's the definition of Advantage?
Jun
28
comment Security of MSS
@dylan7: yes, Grover's algorithm is the best known against today's hash function (say, SHA-256). What it does is, given a function with $m$ possible inputs, find the input where the function returns "yes" in $O(\sqrt{m})$ time (and when you use it to find a hash preimage, you make the function one that computes the hash, and then compare the result to the desired value). As for PRNGs, there is no known attack against most PRNGs better than what's implied by Grover's algorithm.
Jun
26
comment Simple protocol for 1-out-of-2 oblivious transfer
Important note on the RSA protocol; Alice needs to generate a fresh RSA key for every transfer; if not, that is, if Alice uses the same RSA key for two exchanges, then Bob can cheat and for his second transfer, learn the different between a secret from the first transfer (that he didn't pick) and a secret from the second. That is, from the first exchange with secrets $(m_0, m_1)$, he learns $m_0$, from the second exchange with secrets $(m'_0, m'_1)$, he can learn $m'_1 - m_1$
Jun
26
comment SQL-Like queries in CRYPTDB doesn't work
I'm voting to close this question as off-topic because it's about CryptDB and what it currently supports, and not about cryptography
Jun
25
comment Is algorithm with more than $2^{word size}$ words secure?
If you want a generic answer, then yes, it is believed to be possible to create a secure cipher (and assuming the block size is large does not invalidate that belief)
Jun
23
comment what are the most common stream ciphers algorithms?
@SEJPM: I deliberately left AES-CTR off the list, because it can be considered a block cipher (and also outputs 16 byte blocks, not 'bytes')
Jun
23
comment Attack for RSA 1024 bit with Low Public Exponent
Actually, if the verifier only checks the lowest 16 bytes, then it's easy; pick a message with $x = MD5(Message)$ odd; and then find a 128 bit number $y$ with $y^3 = x \pmod{2^{128}}$ (which will exist if $x$ is odd, and can be found in 128 steps); then $y$ (zero padded) will be accepted as a signature for Message.
Jun
23
comment Attack for RSA 1024 bit with Low Public Exponent
Another conceivable approach: if the padding scheme was type 00, then if we could find an MD5 hash that's a perfect cube, that is, $MD5(Message) = x^3$ for some integer $x$, then the signature for that message would be the integer $x$ (zero padded). However, I don't know of a practical way to find a hash that yields a cube.
Jun
23
comment What is the danger if a non-prime is chosen for RSA?
@RickyDemer: hmmmm, I suspect that Shawe-Taylor could be extended so that it could generate a nontrivial fraction of the primes within the range, and still retain its provability and its relative efficiency (circa $O(n^{\lambda+1} polylog(n))$, where $\lambda$ is the exponent on a modular multiply). I believe that, if correct, would answer your question (as if you could factor the product of two of those with nontrivial probability, you could factor a hard product of two primes with nontrivial probability)
Jun
22
comment What is the danger if a non-prime is chosen for RSA?
And, there are certainly implementations that use provable primality techniques, such as Shawe-Taylor
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
At first glance, your code looks correct. Have you gone through the detailed test vectors, and see that the input into the invmixcol is correct, and that the output is not?
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
I haven't gone through your question; however if you want to track down where in the algorithm you made mistakes, you may want to look at the detailed test vector in FIPS 197 (section A.1); that details the internal state after every single operations; it's invaluable in getting an AES implementation working.
Jun
21
comment Understanding Meet-in-the-Middle attack on block ciphers
Does your toy cipher consist of just the single round (precisely as you drew), or are there multiple rounds (each with a separete $K_i$)?
Jun
18
comment Are digital signatures using preprocessed paper pads possible?
While you cannot precisely trisect an angle with a ruler and compass, it practice it is not difficult to get arbitrarily close. I don't see that working apart from furious handwaving (of course, in a work of fiction, that handwaving is quite possible)
Jun
18
comment How to show the inner workings of ECC?
For mathematicians (who presumably know the basics of group theory), I'd avoid the pretty pictures. Instead, I'd approach it as "EC as an abstract group" angle; here's the group, here's how we do point multiplication, here's what the DLog problem is, see how it doesn't have any obvious solutions, here's the basic DH protocol...
Jun
17
comment Establish Trust By Signing Random Seed
If you use RSASSA-PKCS1_V1_5 signatures, you have to have padding; it's built into the protocol. As for how to protect against MITM, one obvious way would be to use the fact that the attacker cannot modify M; for example, do an (EC)DH exchange, and make M one of the public values; with that, the attacker can learn the value of M, but cannot learn the shared secret (and the key we use to encrypt/authenticate the rest of the exchange will be derived from the shared secret)