28,732 reputation
12156
bio website
location
age
visits member for 2 years, 11 months
seen 3 hours ago

12h
comment RSA with modulus n=p²q
Like ECIES; decryption is a lot faster than RSA; for encryption, you can do precomputation so you can do most of the work before you see the message.
13h
comment RSA with modulus n=p²q
@CGFoX: however, wouldn't that slow down the operation? What would the advantage be over doing standard RSA, and picking larger primes?
13h
comment MAC using a modified CBC mode of operation
@fgrieu: why don't you convert your comment into an answer? That way, it can be upvoted and accepted.
16h
comment AES CTR rekeys rapidly, does this produce patterns?
The submitter really is asking us to review his pet cryptography project -- that's not what this site is about.
1d
comment Choice of multiplication polynomial in Rijndael s-box affine mapping
Do you have any evidence that these metrics have anything to do with the security of AES? Are there any theoretical (reduced round) attacks known against AES that would be foiled by an sbox that is better by these metrics?
2d
comment Security equivalent to Diffie–Hellman problem?
@RickyDemer: generally, we do Diffie-Hellman in groups of known order; if you are doing it in the RSA group, an alternative way to compute $g^{b^{-1}}$ is to do a DH with $g^b$ as the base $h$, and the two public values $h^x=h^y=g$; the Oracle will return the value $h^{xy} = g^{b^{-1}}$. As for the other direction where $b$ might not be invertable (and so $b^{-1}$ doesn't exist), we can replace $b$ with $b+i$ for known $i$; with nontrivial probability, we can find an $i$ where inverse exists; given $g^{a(b+i)}$, it's easy to recover $g^{ab}$
2d
comment Turning PRPs in PRGs with a counter
@Sklivvz: when was the last time you generated 1 TiB of output from a random number generator? In any case, if you need to generate more, all you need to do is periodically rekey the block cipher.
Jul
16
comment Using GMAC for Authentication without encrypting the message
The "additional associated data"; that's the part of the data which is used to compute the tag, but is not encrypted.
Jul
16
comment Using GMAC for Authentication without encrypting the message
GMAC is just GCM with a empty "message to be encrypted"
Jul
16
comment Is there a technique to confirm that a given large integer value is a product of two primes?
@ColeJohnson: the "precomputed primorial" for a prime of that size is approximately $2^{1400}$ bits long. Yes, in addition to computing the gcd, just storing it would be highly nontrivial -- that is part of why I was skeptical of this approach...
Jul
15
comment Attack on DSA modification with bad hash function
"Apparantly, I'll have to calculate the private key $x$" -- nope, recovering the private key is not required.
Jul
15
comment Ciphertext indistinguishability (IND-CPA) for symmetric cryptography
"This is true for any deterministic symmetric encryption" -- you have just shown that an IND-CPA encryption method must be nondeterministic,
Jul
15
comment How does one calculate the scalar multiplication on elliptic curves?
Ummm, "double and add" and "square and multiply" are two ways to say the same time. Also, what's a "mandelbrot sequence" or a "divide and add" (at least, in terms of working with a group operation?).
Jul
12
comment Effective security of block cipher – equal the key size, or half the key size?
I don't have the book, but might Viega and Messier have actually said "the effective strength ... is actually half the block size"; which might be one way of expressing that if you have a block cipher with a block size of $n$ bits, you generally don't want to use it for more than $2^{n/2}$ blocks ???
Jul
11
comment Determining if a stream of bits is statistically random
Actually, I would disagree with the dieharder suggestion; at least, depending on what the hardware RNG is to be used for. If it is to be used as an entropy source (that is, seed a good DRBG), then passing dieharder (or any other statistical test) is neither necessary nor sufficient.
Jul
10
comment Calculating IHVs from known message and hash output
@DmitryYanushkevich: no, there is not. In fact, the existence of a method that could solve it in, say, 2^150 steps, could be used to find preimages in 2^156 steps (for SHA-1).
Jul
9
comment Random Number Generator based on AES CTR
If you have anything that shows that CTR_DRBG is computationally distinguishable from a truly random source (given an unknown seed), I would strongly urge you to publish it. I am personally skeptical that you have any such evidence.
Jul
9
comment Random Number Generator based on AES CTR
Have you considered the CTR_DRBG from csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf ; that's mostly your idea, with the details worked out
Jul
6
comment Generate Finite Field power of g
Is the question "what is meant by the notation $g^x$"? Or, is the question "how do you do multiplication in the field $GF(16)$"?
Jul
5
comment Use ElGamal to solve Diffie-Hellman problem
@CGFoX: well, $z$ is from the ciphertext, and you get to pick that, so of course you can... (I almost mentioned that myself; I'm glad I didn't; it's better that you thought of it)