Reputation
44,809
Next tag badge:
391/400 score
82/80 answers
Badges
1 51 107
Newest
 Nice Answer
Impact
~744k people reached

8h
comment Why is AES-128 considered secure while RSA needs a 1024-bit size to be considered secure
Actually, to answer the question: while factoring the modulus may be difficult, it is significantly easier than trying to brute force the private exponent, or even trying possible primes $p$ to look for a factor...
10h
comment Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?
Yes, that is correct. As you yourself stated, "all EC curves are isomorphic to a curve in Weierstrass form", however not all EC curves are isomorphic to a curve in Montgomery/Edwards form.
10h
comment Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?
The curves used most often in TLS 1.2 are the "NIST curves", which cannot be expressed in Montgomery or Edwards form.
10h
comment I have a challenge for anyone willing
You're right; this isn't a "let us solve your cryptogram" site. In addition, it is expected that answers are posted here (after all, this is a Q/A site). Perhaps sci.crypt on usenet might be more suitable?
16h
comment Caculated time One Point Multiplication with double and method
How certain are you on the timings of the double and add routines? If they are moderately faster than you think, that'd explain the performance difference.
1d
comment How to design a deliberately weak PRNG for experimentation?
@pg1989: actually, the weaknesses in MT would be far too subtle for an ML to pick up on. It would appear that someone would need to select the biases, and then create a PRNG that deliberately achieves those biases.
1d
comment RSA private key finding method
Maybe she tries the various possibilities of $d$ until she hits one where $(M^e)^d = M$. With these toy parameters, that is eminently doable...
1d
comment Security of a parallelizable block cipher mode
@Melab: so, you're doing 2 Encrypt operations per plaintext block???
2d
comment What are possible caveats when generating a group for use as parameters for Diffie-Hellman key exchange?
Do you really need to convince someone that you haven't deliberately introduced a backdoor? After all, if I am exchanging keys with you, I could easily post our shared keys on facebook, should I choose to. You can't check for that, hence you need to trust that I wouldn't. What I might need to prove is that I haven't accidentally introduced a backdoor, by selecting bad parameters...
2d
comment Permuted Hash Table
Is the transform from $H(a)$ to the index $i'$ deterministic? If so, then someone who sees two values $a, b$ hashing to the same entry in the table can immediately deduce that $H(a) = H(b)$. This implies that if they know what $a$ is, they reduce the number of possible values of $b$ significantly.
2d
comment How to find roots of equation $f(x)=0 \pmod p $, where $p$ is prime number?
@DilipSarwate: I'm not understanding the point you're trying to make; the original equation was over the field $GF(p)$; if it were to have a solution if we modified the equation to be over $GF(p^2)$, I don't see how a solution to that modified equation would be relevant to the original question...
2d
comment block cipher secure as ind - cpa
We don't care for questions that depend on links to other sites - if the link breaks, the question becomes useless. Instead, you should paste the block cipher into your question.
Feb
7
comment How to find roots of equation $f(x)=0 \pmod p $, where $p$ is prime number?
@DilipSarwate: if the squareroot does not exist (in the prime field), then I believe that the quadratic equation does not have a solution.
Feb
7
comment How to find roots of equation $f(x)=0 \pmod p $, where $p$ is prime number?
@DilipSarwate: actually (assuming $p>2$), the standard quadratic equation, with the squareroot and the division evaluated modulo $p$ should work; no need to bring an extension field into play...
Feb
6
comment Encryption of Real Time UDP packet
How about DTLS (or SRTP, if the traffic you're protecting is RTP)?
Feb
6
comment How to encrypt incomplete block with RSA as a block cipher?
You'd pad it somehow; that is, you fill in some data to extend the 'd' to a full block size. There's no standard way to do this, as we never use RSA this way...
Feb
5
comment How to generate a random number so server cannot cheat?
The chief way was someone can cheat here is if they're the last person to reveal their commitment. They can't change the value they're committed to; however they might be able to withdraw if they don't like the answer ("oops, my PC decided to update itself and reload, sorry, can we all try again from scratch???")
Feb
5
comment Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?
@SkyPassaro: this imples that you can't prove IND-CCA for all modes of operation (that's actually known not to be true; for example, you don't have to encrypt). Instead, you need to make assumptions about which IPsec transforms are being used (and in which order).
Feb
5
comment Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?
@SkyPassaro: technically speaking, GCM is neither EtA nor AtE nor E&A, but instead is a combined mode (which does both encryption and authentication; all the details are hidden within the mode). As for CBC and CTR mode, the modes themselves don't do authentication; however the standard ways of doing the transform is, in fact, EtA. However, there's nothing in the RFCs that say that you have to do it that way (or, in fact, that you have to do authentication at all); if you somehow configure things to do AH and then an outer ESP (without authentication), you're in AtE-land.
Feb
4
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@SamuelNeves: with $p-1 = 2^i3^jk^k$, $i, j, k$ would have to be fairly modest, and so I suspect that a standard P.H. attack would break it easier than you'd hope. As for $(2^{32}-c)^{16}$, I suspect that has a better chance, but mostly because a standard attack wouldn't bother trying that. In any case, what I'm trying to take advantage of is, if $p-1$ has a largest factor $q$, then using the backdoor would take $O(\sqrt{q})$ time, but finding the backdoor would take $O(q)$ time. I'm trying to arrange $q$ so that $\sqrt{q}$ effort is feasible, but $q$ is not