meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 10 months |
| seen | 20 mins ago | |
| stats | profile views | 106 |
|
16m |
comment |
How hard is it to generate a partial RSA fingerprint collision? @RickyDemer: Monte-Carlo (aka Pollard Rho); it's a method that finds factors $< n$ with about $O(\sqrt{n})$ time; that's rather faster than doing trial division. |
|
1h |
comment |
How hard is it to generate a partial RSA fingerprint collision? @RickyDemer: yes, an SSH implementation could do that (actually, something like attempting a Monte Carlo factorization would be cheaper); in practice, they don't. |
|
6h |
comment |
How hard is it to generate a partial RSA fingerprint collision? @BCS: See response to clarification |
|
11h |
comment |
Is triple des similiar to RSA in that they message size is limited to the key size? No, RSA is NOT a block cipher (unless you're using a nonstandard definition of the term "block cipher") |
|
1d |
comment |
Hash function with values in a multiplicative group of prime order The other obvious question is "do you care if you can deduce the relationship between the hashes of various strings? For example, if $A = hash("foo")$, and $B = hash("bar")$, do you care if someone can compute $n$ with $nA = B$? If you don't care (and whether you do or not will depend on what you're doing with this hash function), then there's an easy solution for any finite group. |
|
1d |
comment |
Hash function with values in a multiplicative group of prime order There are (at least) two different meanings to 'G is a multiplicative group'? Do you mean that it's a prime-ordered subgroup of $Z^*_p$, for some prime $p$? Or, is it some group which happens to be expressed in multiplicative notation (that is, the group operation is written $A \times B = C$)? |
|
Jun 15 |
comment |
Can cryptography be used to hide routing information from the router? @fgrieu: you are, of course, correct... |
|
Jun 14 |
comment |
Can cryptography be used to hide routing information from the router? @RickyDemer: if it's not a real word, well, it's what I would have meant anyways... :-) |
|
Jun 12 |
comment |
What's efficient MPC protocol for determining if sum's bigger than y? @mikeazo: I would personally expect that there are more efficient ways to solve the millionaire problem than to set up and simulate a circuit; however I don't know; that's why I added this as a comment, rather than an answer. |
|
Jun 11 |
comment |
length extension attack on an MD5 hash of a text file of about 10K Bytes? @PaŭloEbermann: actually, it'll always contain at least one zero byte unless A is at least 8 Petabytes long. So, yes, if you can't live with zero bytes in your byte strings, this observation isn't likely to be greatly useful to you. |
|
Jun 11 |
comment |
What's efficient MPC protocol for determining if sum's bigger than y? I would like to point out that this problem is equivalent to a joint computation of $x_0 > y - x_1$, hence it is the millionaire problem; the most efficient solution for that problem will be the most efficient solution for this. |
|
Jun 11 |
comment |
Can you identify the public key used to encrypt something? @Xeoncross: Yes, there are public-key encryption systems whose ciphertexts need not reveal the target: El Gamal, IES. |
|
Jun 7 |
comment |
Block cipher fixed points @Truthserum: no, instead it's "just because you managed to find one of several keys that correctly decrypt one block of the message, there is (likely) only one key that will decrypt the entire message". This statement is likely to hold if the message is strictly longer than the key (and the cipher acts approximately like an ideal cipher). |
|
Jun 6 |
comment |
Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature? @fgrieu: I believe that I mentioned in the first paragraph that this was a "guess"; that is, I have no direct knowledge, but instead reconstructed the likely reasoning based on the differences in the DSA variants. As for the people that proposed the DSA variants, I don't have a direct reference, I do have a reference "Horster, P. et al; Meta-ElGamal signature schemes; University of Technology Chemnitz-Zwickau, 1994" which talks about the relationships of both standard DSA and this variant (and others). |
|
Jun 6 |
comment |
Is triple des similiar to RSA in that they message size is limited to the key size? Correction: the block size for AES is fixed at 128 bits. Now, Rijndael (the AES submission that became AES) does allow other block sizes; AES is that subset of Rijndael that is limited to the NIST's original conditions (128 bit blocks, 128, 192 or 256 bit keys) |
|
Jun 4 |
comment |
ECC Point Multiplication of Product @PeterButler: Well, $q<n$ for this specific elliptic curve; there are other curves with $q>n$. Also, it is not at all true that all $a<n$ have a square root modulo n (that is, are quadratic residues mod n). In fact, exactly half the integers between 1 and n-1 are quadratic residues and half are not (because n is prime). Finally, q is prime (there are lots of curves that have a composite q; we pick one with a prime q because they have better cryptographic properties); hence $aG=bG$ implies either $a\equiv b (\bmod q)$ or $G$ is the point at infinity. |
|
May 24 |
comment |
How random are commercial TRNGS @user1028028: actually, it's not true that a determanistic PRNG must be periodic; it's easy to make a nonperiodic PRNG by expanding the state over time (and besides, we don't care about repeats after (say) 2^256 outputs; we never come even close to that; and we usually reseed the PRNG periodically anyways). In any case, fgrieu answered why postprocessing the TRNG output through a PRNG is useful, in his experience (and mine, however my experience is more modest), "the unconditioned output of a TRNG source is never free from some detectable bias". Is that contrary to your experience? |
|
May 23 |
comment |
What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large? The standard way to generate random points is to select a random value for X, check to see if there's a solution for the elliptic curve equation with that value, and if these is, pick one of the two possible values for Y. Or, do you need random values with known relationships, or for which you can compute output number N+1 given output number N? |
|
May 22 |
comment |
Is the likelihood of a birthday collision linear (evenly distributed) for all ciphers? When are they not? Well, if you apply the birthday principal to an nonuniform distribution, collisions become more likely than over a uniform distribution over the same number of elements (assuming, of course, that all tries use the same distribution). So, it might make some attack more difficult on average, however it's not at all clear what those attacks are actually under discussion. If the attack relies finding collisions, a nonuniform distribution would appear to make things worse, that is, easier to perform, and hence less secure. |
|
May 16 |
comment |
Generating IV in TLS 1.2 @D.W.: why, yes, I do have a proof of security: see eprint.iacr.org/2008/121.pdf ; see the part where they show an encrypted counter for a CBC mode IV is secure |
