33,544 reputation
12872
bio website
location
age
visits member for 3 years, 5 months
seen 6 hours ago

1d
comment In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?
The question was based on behavior seen within OpenSSL; the OpenSSL bignum library handles negative numbers properly, and hence this answer is irrelevant in the context of the original question.
1d
comment Point decompression on an elliptic curve
Shanks-Tonelli is the general answer for prime curves; however most elliptic curves have $p \equiv 3 mod 4$, and in this case, the problem can be simplified: to compute the square root of $n$, you just compute $n^{(p+1)/4}$ (and check that that value squared gives you $n$; this last bit catches values of $n$ that don't have a square root)
2d
comment Can anyone explain about Correlation and Auto correlation attacks with easy examples?
You might want to mention the context of the question, for example, the cipher involved.
2d
comment Proving that an encryption scheme is susceptible to certain attacks
@user21547: if $e_1 - e_2 = a(m_1 - m_2) + (k_1-k_2)p$ and $e_2 - e_3 = a(m_2 - m_3) + (k_2-k_3)p$, what is $(e_1-e_2)(m_2-m_3) - (e_2-e_3)(m_1-m_2)$?
2d
comment Proving that an encryption scheme is susceptible to certain attacks
@user21547: oops, I meant them as arbitrary parameters -- I forgot that the cipher used them as key variables. I changed the answer to use the values $x, y, z, w$
2d
comment Is signing a message just encrypting it with private key?
Also, if you're not talking about RSA, but instead talking about, say, DSS or ECDSA, 'signing by encrypting' is not at all accurate, even as an oversimplification.
2d
comment Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?
@Jeff: the security proof for GCM states that if you have a valid $N$ block encrypted message, any change to the message (made by someone who doesn't know the AES key) would authenticate with probability at most $(N+2) 2^{-128}$. By allowing large values of $N$ (by allowing long messages), this significantly reduces the integrity guarantees of GCM
Jan
26
comment Need some help to break a cypher text using unknown cypher
We typically don't answer "could you please decrypt this for me" questions, however if you want advice on how you might decrypt it yourself, well, one place you might start is looking at Vigenere ciphers -- might this be encrypted with something like that? Those typically have flatter (but not perfectly flat) distributions like you're seeing.
Jan
23
comment Security aspects of using a global values as nonce and additional data for AES?
Is this question about cryptography, or is it about the design of an API to a function (which happens to perform a cryptographical task)?
Jan
21
comment BEAST attack confusion
@JOe: that is correct -- you don't need to wait for the browser to send a message; we have the Java applet send messages when we want.
Jan
20
comment Scrambling sensor data
Is the timeseries signal analog or digital? Encoding digital data so that it looks random is well understood (that's what we generally mean by encryption); making an analog signal so that it looks random, but still can be decrypted, is considerably trickier.
Jan
17
comment RSA signing security
@RickyDemer: my bad; you are correct...
Jan
17
comment Performing HMAC with random key before MAC comparison
I can't think of anything else it would add to the security properties. Of course, there ought to be easier ways to do a constant time equality comparison; perhaps they are extremely paranoid about how "helpful" optimizing compilers can be.
Jan
17
comment RSA signing security
@user2330143: yes, if the architecture forbids any client to server communications. Typically in a network architecture, that sort of this is allowed; I don't know about this specific case.
Jan
17
comment RSA signing security
@RickyDemer: in this instance, a predictable (or even an attacker-chosen nonce, as long as he can't choose a previously seen nonce) is a problem; to get a command to be accepted, he would need to create a signature that includes a nonce that wasn't seen before; making the nonce predictable doesn't make generating such a signature any easier.
Jan
16
comment Nonces being used in SSL and MAC to prevent replay attacks
@dave_thompson_085: you're right; SSL prepends a record count. My bad; my memory assured me that it was a byte count. As for 1.2, my difference I was alluding to was in inserting it into the MAC vs. putting it as a part of the AAD.
Jan
15
comment Nonces being used in SSL and MAC to prevent replay attacks
What do you mean by MAC? Is that a Message Authentication Code (which is used in SSL)?
Jan
14
comment Factors of RSA modulus
@fgrieu: actually, the real figure is 1/2, not 3/4 (I've corrected my answer). As for a simple proof, well, one won't fit on this response, however here's how it works: if we look at the behavior of $(m^\lambda)^{2^i}) \pmod p$, we see that it has a probability 0.5 of turning into 1 at step $j$ (where $j$ is such that $(p-1)/j$ is odd), and a probability 0.5 of turning into 1 at some earlier step; and similarly with $q$. Now, $m$ will reveal a factorization if $p$ and $q$ turn into 1 on different steps.
Jan
13
comment Comparison among algorithm based on key length
Minor correction about RSA: actually, values of $e$ (and $d$) which do not work need not be rare; for one, even values never work (because $\phi(n)$ is always even). In addition, if $\phi(n)$ is a multiple of 3 (which will happen with probability 3/4 if $p$ and $q$ were not chosen with mod 3 in mind), then any $e$ which is a multiple of 3 will also not work. If $p$ and $q$ are chosen such that $p-1$ and $q-1$ has no small odd factors, then most odd values of $e$ and $d$ will work; however we generally don't use such criteria when selecting $p$, $q$
Jan
13
comment Can you help me with this Random Number Generator function?
@tylo: actually, it does make sense. One of the possible ways of doing the output is provide a function that, given $i$, gives you the $i$th member of the permutation. However, Rahul has never said how we wants the output represented, so we're just guessing...