Reputation
36,305
Next tag badge:
99/100 score
20/20 answers
Badges
2 56 151
Newest
 Good Answer
Impact
~632k people reached

2h
comment Should RSA primes p and q differ in length by “a few digits”?
FIPS 186-4 appendix B.3 still mandates safe primes for 1024-bit moduli (not 2048-bit); arguably, that is justified if you consider an adversary content with factoring any public moduli among many (like, to impersonate any member of a group): trying Polard's p-1 on all keys is a reasonable strategy, compared to attacking a single key with GNFS (the number of target public keys to make that workable is in the billions, I believe)
3h
reviewed Approve pairings tag wiki
3h
reviewed Approve Proving knowledge of a preimage of a hash without disclosing it?
1d
reviewed Approve Is it possible to enumerate the possible RSA keys?
1d
comment Is it possible to enumerate the possible RSA keys?
In addition of otus' comment: for compression of an RSA public key, see this. Compression is not the same as enumeration.
1d
comment Is a PRF applied to a secure MAC also a secure MAC?
One needs some condition on the PRF's input and output size; otherwise, a PRF applied to a secure MAC could well be a much less secure MAC than the original MAC is. Even if the PRF's input and output are the MAC's output size, odds of forgery by reusing a former MAC value are slightly better for the resulting MAC than they are for the original MAC.
2d
awarded  Good Answer
Apr
27
revised Tackling encryption problems with “Zipf's law”?
Polish
Apr
26
revised Key size for HMAC-SHA256
Polish
Apr
26
revised Key size for HMAC-SHA256
mentionb performance for 64-byte key; remove duplicate definition of full-entropy
Apr
26
comment Key size for HMAC-SHA256
@Ralph P: That seems to make sense. The weakest links are likely to be the quality of the password combined with the entropy-stretching of PBKDF2 (which is far from being the best entropy-stretching function around), the ability of the user to recognize where s/he can safely type the password, and the integrity of the device used to process the password; any of these will be incomparably weaker than 256-bit.
Apr
26
revised Key size for HMAC-SHA256
typo
Apr
26
answered Key size for HMAC-SHA256
Apr
26
revised Tackling encryption problems with “Zipf's law”?
Mention ECB
Apr
26
answered Tackling encryption problems with “Zipf's law”?
Apr
25
comment RSA when n= 2360221 and encryption = 5 find decryption key d, when M =1234
If indeed "this was the question asked in exam" and there is no computer allowed in the exam, the right answer is: Finding private exponent $d$ is believed as hard as factorization of $n$, which is non-trivial by hand; C=1637411.
Apr
25
revised Trapdoor and RSA (Schneier)
polish
Apr
22
comment Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
@poncho: yes, using Shamir's secret sharing for the private key suffers form the problem you describe. I do not see that there's a similar issue with the last system that I propose. Sure, the shares could be meaningless, but there's a similar problem in the question's system: the RSA cryptogram could be gibberish, only trying (which requires rebuilding the private key) can tell.
Apr
22
answered Can multi-prime RSA be used to create an abuse-resistant lawful interception mechanism?
Apr
22
comment How secure is this logarithmic encryption algorithm?
@MrCyber: if R had enough decimals, that would markedly improve, but not fully fix, the total insecurity that we have now (the minimum and maximum for R will remain a weakness allowing sizable information about M to leak from x). That would also markedly increase the size of R, which is a serious problem since we need to move Rsecretly to the receiver side.