Reputation
33,833
Next tag badge:
95/100 score
20/20 answers
Badges
2 50 137
Impact
~560k people reached

4h
comment Is multiplicative blinding less secure than additive?
Define multiplicative blinding; in particular how the blinding factor $b$ is chosen (its probability distribution); and how it is applied ($x\to x\cdot b$ is not the same as $x\to x\cdot b\bmod p$, the later form is just as secure as additive blinding when $x\ne0$ and $b$ is uniform over $[1\dots n-1]$).
12h
revised Common Modulus Attack not reproducible
Polish
18h
revised Common Modulus Attack not reproducible
Yet another link to introduce the reader to meadows
18h
revised Common Modulus Attack not reproducible
Link to public and relatively simple exposition on meadow arithmetic
19h
revised Common Modulus Attack not reproducible
Add link
19h
revised Common Modulus Attack not reproducible
Polish
19h
revised Common Modulus Attack not reproducible
Full problem statement
19h
revised Common Modulus Attack not reproducible
Contrast with other answers
19h
answered Common Modulus Attack not reproducible
19h
revised Compression in key generation of DES algorithm
Give alternate explanation
19h
answered Compression in key generation of DES algorithm
21h
comment Compression in key generation of DES algorithm
Anything wrong with the explanation and drawing in Wikipedia? Notice that in DES, the convention is that the bits are numbered from 1 onwards, with 1 being the first or left bit, or the most significant bit of in the big-endian translation to integer of a bitstring, or the most significant bit in the first or left octet in an octet string. Also, the output of PC2 is subdivided into 8 bitstrings of 6 bits (hence the presentation of the table as 8 lines of 6 entries), corresponding to S1 thru S8.
1d
comment Common Modulus Attack not reproducible
@Ricky Dememer: yes; you reduced the problem to finding an efficient way to compute the meadow inverse of a given $c$ modulo $n$ of unknown factorization when $c$ has no regular inverse, and is not $0$.
2d
comment Security of RSA for paranoids with padding?
@Maarten Bodewes: no, I did not make any progress, or have had time to seriously explore potentially interesting alternatives to the dominant asymmetric crypto for Smart Cards (2-primes RSA, ECDSA per FIPS 186-4).
Feb
4
comment Secure blinding factor switching at malicious server-side (Switching in One Time pad)
@user153465: the second paragraph in the answer tries to address that. The adversary is free to compute any function of $v_1$ and $v_2$, like $v_4(v_1,v_2)=(v_1+v_2)^{v_1-v_2}$, or $v_3(v_1,v_2)=v_1\cdot v_2$, anything goes, that has no influence on the demonstration given. This is just extra added to the question's statement, obscuring it, that we want to get rid of to focus on the expressions involving $a$, or $z_1$, $z_2$ or other things not known to the adversary.
Feb
4
revised How does RIPEMD160 pad the message?
polish code comments
Feb
4
comment How does RIPEMD160 pad the message?
@seeker: I see no issue with the reference implementation; it works fine for me, with the (documented) issue is that it uses a non-portable definition of the 32-bit type dword. If the compiler barks, that should be changed from unsigned long to uin32_t from <stdint.h>, or just unsigned on many modern machines. Try to use that reference code from the simple main program that I posted.
Feb
4
revised How does RIPEMD160 pad the message?
add comments
Feb
4
revised How does RIPEMD160 pad the message?
Add a comment
Feb
4
revised How does RIPEMD160 pad the message?
Add reference code