Reputation
25,560
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~373k people reached

15m
comment What is the difference between H(M) and H3(M, s, IDA)?
@Nubila: I gave three examples of suitable functions $E$ (sorry I changed notation from $e$ to $E$). If this is for an actual implementation: If any two of $M$, $S$, $I$ are of fixed size, then $H3(M,S,I)=H(\;M\;\|\;S\;\|\;I\;)$ is just fine. Or perhaps $M$ and $S$ are restricted to bytestrings (not bitstrings) and of known maximum length; in which case $E(M)$ can simply be $M$ prefixed with the length of $M$ over a fixed number of bytes suitable for expressing the maximum length.
8h
comment RSA public key exponent generation confusion
@Robert NACIRI: All hard-coded values of $e$ that I have ever met in practice are prime, I guess for the reasons exposed by Poncho.
8h
revised What does a stream cipher provide that cannot be obtained with AES CTR mode operation?
mention parallelization in addition to random access, and that ChaCha20 does these
9h
answered What does a stream cipher provide that cannot be obtained with AES CTR mode operation?
10h
comment Sharing a secret key between many users
For 4096-bit RSA, the overhead for each extra user is about 600 bytes (512 bytes for the cryptogram with the symmetric key, the rest for the user ID and some formatting), not including overhead for conversion to base64 if that's used.
16h
comment RSA public key exponent generation confusion
1024-bit is also used for certification authorities, and root CA keys, which is becoming obsolete; on the other hand compromise of any Member State key or Tachograph (VU) key would allow breaching the integrity of data recorded in all cards, without possibility of revocation or time limit, longer keys would not have changed this.
16h
comment RSA public key exponent generation confusion
@Robert NACIRI: I've never met $e=2^{32}+1$ (and that's not a prime, which triggers annoying corner cases in the generation of $p$). Did you mean $e=2^{8}+1$, which indeed is common?
16h
comment RSA public key exponent generation confusion
An exception to " usually 16 bit value at most " occurs in the European Digital Tachograph, CSM_014, where that is optionally up to 64-bit. Smart Cards that have a certificate (or/and a certification authority certificate) with these extra-long $e$ are annoyingly slower to use than others using $e=2^{16}+1$.
16h
revised Is HMAC-MD5 still secure for commitment or other common uses?
rolled back to a previous revision
16h
revised Is HMAC-MD5 still secure for commitment or other common uses?
Mention a trivial attack that uh, previously was left to be found by the reader
18h
revised Sharing a secret key between many users
Distinguish between key compromize, and compromize of the ability to decipher.
18h
revised Sharing a secret key between many users
Latest example is an extreme of a fault attack
18h
revised Sharing a secret key between many users
polish
18h
revised Sharing a secret key between many users
Explain better; add another
18h
revised Sharing a secret key between many users
Add one more
18h
answered Sharing a secret key between many users
19h
revised What is the difference between H(M) and H3(M, s, IDA)?
Capitalyze all bitstrings and bitstring functions
19h
revised What is the difference between H(M) and H3(M, s, IDA)?
Improve typography in main formula
19h
comment What is the difference between H(M) and H3(M, s, IDA)?
@Nubila: No, " the concatenation of M,S and I " is not a secure hash. $\;$ $H3(M,S,I)$ could be the hash of the concatenation of $M$, $S$, and $I$, with the security issue discussed in the question; and should rather be the hash of the concatenation of $e(M)$, $e(S)$, and $I$.
19h
revised What is the difference between H(M) and H3(M, s, IDA)?
deleted 9 characters in body