35,070 reputation
12974
bio website
location
age
visits member for 3 years, 7 months
seen 5 hours ago

5h
comment (bfxor) BruteForcer XOR v1.2 - Data Dictionary Attack on 64-bit Keys
I'm voting to close this question as off-topic because it's really someone advertising their project by asking questions about it
Mar
27
comment Zero knowledge of two factor
Actually, there is no need for a ZKP that $n$ is not prime; anyone can verify that directly in polynomial time.
Mar
27
comment Key sizes supported by 3DES
@MaartenBodewes: that is the reason for EDE mode (actually, it's a bit more complicated); however personally I don't consider the $k_1 = k_2 = k_3$ case as 3DES; instead, that's DES (which just happens to be implemented by circuitry that can implement 3DES as well)
Mar
27
comment Collision attacks on digital signatures
A collision 'jumbled mess' could occur entirely within where the RSA public key would appear in the certificate; given that an RSA public key looks like seemingly random bytes, how do you propose that the client-side code determine that someone didn't use those random bytes to create a collision?
Mar
27
comment Collision attacks on digital signatures
How do you distinguish a 'weird string' from a RSA public key?
Mar
26
comment common ways / methods to try to break a SP network
Are there any unknown key bits stirred into the SP network? Or, can you compute forwards correctly (and just want to know how to compute backwards)?
Mar
26
comment Encode-decode with different block sizes?
I'm voting to close this question as off-topic because it's really a question about how to use a specific crypto API
Mar
25
comment Bit commitment, two blobs with same bit, without revealing it?
@tylo: Actually, this is subtly different from Goldwasser-Micali; in GM, the holder of the private key knew the factorization of $n$; here, the committer need not know that -- they can reveal the secret by revealing $x$. And, they can generate a ZKP that $y_1y_2$ is a QR (if $b_1=b_2$) because they know the squareroot (either $x_1x_2$ or $x_1x_2t$)
Mar
25
comment Authentication using a one-time pad
@thirtythreeforty: Davies-Meyer is intended to turn the cipher into a hash. Thinking about it more, perhaps CBC-MAC (you don't need to worry about the attacker extending the message, do you?) would work out better. If you need to worry about replays, putting in a counter (which would be included in the integrity check) is the obvious solution.
Mar
24
comment Authentication using a one-time pad
What level of integrity protection are you looking for? That is, if someone modified a packet, what is an acceptable level of probability that the modification be undetected? $2^{-16}$? $2^{-64}$?
Mar
24
comment Bit commitment, two blobs with same bit, without revealing it?
@RobertNACIRI: actually, that is not true; the Jacobi symbol will be 1 regardless of whether $b$ is 0 or 1. Remember, $t$ is chosen with a Jacobi symbol 1, $x^2$ also has Jacobi symbol 1, and so both $x^2t^0$ and $x^2t^1$ will have Jacobi symbol one. You might be thinking of a prime modulus (where the Jacobi symbol does indicate whether the number is a QR); this is done over a composite modulus, where there are nonQRs with Jacobi symbol 1.
Mar
24
comment Twofish encryption in Python
I'm voting to close this question as off-topic because it is a question about a specific cryptographical library, and not cryptography in general.
Mar
24
comment feistel structure? why decryption is so easy with reverse order of subkey
As a suggestion, perform a simple Feistel network on paper (using an Oracle as the round function -- make a list of inputs and outputs to the round function, when you get an input you haven't seen before, pick the output randomly, and put them on the list); try both encrypting and then decryption, and see exactly what's happening.
Mar
23
comment Is Encryption without knowing the input directly possible at all?
Not unless the $n$ parties sit down and compare results afterwards -- that wasn't mentioned within the problem statement.
Mar
23
comment Is Encryption without knowing the input directly possible at all?
One of the things that both Alice and Bob need to prove is that what they generate is some permutation of the inputs; for example, Bob didn't discard $t_1$, and gave two encryptions of $t_2$.
Mar
21
comment AES product function
One way is $(01010111)\times(00000100) = (01010111)\times(00000010)\times(00000010)$ - you already know how to evaluate the right side. We know this is true because $(00000100)= (00000010)\times(00000010)$
Mar
20
comment Determining nonce between unsynced systems
@BrentonGraefe: Because you don't encrypt it -- you send the unencrypted nonce along with the encrypted packet.
Mar
16
comment CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone
@Aria: same thing -- they do not reveal the keys; they might reveal the text of an encrypted message.
Mar
15
comment Implementing modular reductions (n*n)
Are you attempting to implement Paillier? I assume that you need to implement (say) a 2048 bit $n$, and the chip is unable to perform modular reductions on 4096 bit numbers, correct?
Mar
15
comment Encryption with a known plaintext
You beat me to the punch; a Message Authentication Code (or MAC) is what you're looking for. An HMAC is a good choice (assuming you use a reasonable hash function) -- if you prefer to use a block cipher, CMAC is another fine choice.