fgrieu
Reputation
31,310
87/100 score
 15h comment RSA: must $d$ be an integer? It turns out that the approach of finding $k$ by trial an error works including for realistic parameters: $k$ is never above $e$, which is typically small. Thus the cost grows no faster than $\mathcal O(e\cdot\log(N))$. 15h comment RSA: must $d$ be an integer? @Old Geezer: yes, there can be several possible $k$, if you don't require that $d<\varphi(N)$ (something that is mathematically not a requirement, but customary). On second though, as long as $e$ is small, finding $k$ by enumeration will allways work, since one $k\le e$ will be suitable (when $e$ is valid w.r.t. $p$ and $q$). 19h comment RSA: must $d$ be an integer? For such small numbers, you can choose $d$ by testing $k=1,2,3\dots$ until finding $k$ such that $e$ divides $k\cdot\varphi(N)+1$; then taking your $d$ as $(k\cdot\varphi(N)+1)/e$. That construction insures that $e\cdot d-1$ is a multiple of $\varphi(N)$, otherwise said $e\cdot d\equiv1\pmod{\varphi(N)}$, which is sufficient for $d$ to be a valid private exponent. That method to find $d$ will be inefficient for realistic $\varphi(N)$, and sometime will not work within a reasonable time. $\;$ Caution: your parameters $p=11$, $q=7$ and $e=3$ can not work, because $\gcd(e,q-1)\ne1$. 21h revised (Lightweight) Multicast one-way Authentication typo 21h revised (Lightweight) Multicast one-way Authentication I think I now have a coherent answer 23h comment RSA: Most significant key bit always 1? If we compute $d$ as $e^{-1}\bmod(\operatorname{lcm}(p-1,q-1))$, which is PKCS#1 conformant; and, as in the answer, consider $d$ as a bitstring of the same length as the shortest bitstring coding $N$; then the most significant bit of $d$ is always 0. 1d comment Problem reproducing AES results Indeed, the question's vector is AES-128 within transposition of input, output and key, considered a matrix of 4x4 bytes. Good catch! 1d revised (Lightweight) Multicast one-way Authentication Some review, TESLA reference 2d revised (Lightweight) Multicast one-way Authentication Detail solution 3 2d comment Deletion in RSA Accumulator The notion of RSA-based Dynamic Accumulator, and deletion for such, is not so common that you can dispense including in the question (preferably) a definition, or at least a reference. Is what you study: Michael T. Goodrich, Roberto Tamassia, Jasminka Hasic An Efficient Dynamic and Distributed RSA Accumulator (arXiv:0905.1307, 2009)? Or?? 2d comment Backdoorable hash function in password database With a 2048-bit key, and SHA-256 hash, RSAES-OEAP can encipher a message up to 190 bytes (and that message's length) as a 256 bytes cryptogram, without leaking the message length. Only over that 190-byte limit would we need some form of hybrid encryption, with risk to leak the length of the password. 2d comment need help to decrypt js encrypted using some aes That's, literally at least, an admitted sting operation ;-) 2d awarded Good Answer 2d comment Should I authenticate memory data which was loaded from authenticated disk file? @user29154: " Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful " is straight contradictory with " The file is first loaded into memory, then HMAC is verified and if verification passes then file data is parsed " (which is better). I suggest you update the question (although it will remain borderline on topic). Nov 27 comment Reversible hash function If this is a practical problem: state what issue there is with the current construction, and the objectives there are for the other one thought. If this is an exercise, hint: what properties of the set used, operators $+$ and $*$, and the constant $c$, does the method require to have the property " that we can force the result to be zero " by the very method that works in the example? Having identified these, find other sets/operators/constants with the same properties, and you have another suitable function. Nov 27 comment Should I authenticate memory data which was loaded from authenticated disk file? In such cases, the answer comes from an analysis of your threat model (unstated) and security objectives (only vaguely stated). Among the reasons to worry: if a file's HMAC is checked, then the file loaded in memory, is it really the same file, or could an adversary (or malfunction) have changed it in-between? Better practice would be loading the file in memory, then check its HMAC; as a bonus, that halves the amount of data read from file. Nov 27 comment Reversible hash function Among the properties of the construction making it not a cryptographic hash: the low-order bit of the output $h(d)$ is the XOR of the low-order bits of the $d_i$. Is there some security objective for the " other functions/hashing methods " thought? Nov 27 revised How to force non-negative int64_t output for blowfish encryption with int32_t input? Polish Nov 27 awarded Nice Answer Nov 26 revised How to force non-negative int64_t output for blowfish encryption with int32_t input? There are meto