Reputation
26,434
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~395k people reached

Jun
23
comment What is the danger if a non-prime is chosen for RSA?
The question is very similar to this one. To summarize my answer: if it accidentally happened that we use a composite, most likely the RSA key pair would fail on first use (in a PKI: when the certification request is checked, thus thus wrong key would not get certified). Another option, so unlikely that the combination of bad luck and a hardware defect is not enough to cause it, is that it was picked a Charmichael number instead of a prime, in which case RSA will work.
Jun
22
awarded  Caucus
Jun
22
awarded  Constituent
Jun
22
comment What are the differences between collision attack and birthday attack?
@HeatfanJohn: Yes. In crypto we often use the approximation that a birthday attack on a fair hash of $n$ bits succeeds with odds near $1/2$ after $2^{n/2}$ hashes (if we are able to detect any collision that might occur). $2^{64}$ is 19% lower that the more precise estimate that you quote.
Jun
22
revised Collision or second preimage for the Chacha core?
their->its
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
Could not immediately locate how I got my formula, but I dug here nice public code that I know works, with aes_mixColumns_invusing 21 XORs and 9 table lookups of a single table (or 7 table lookups of two tables). That seems to beat the Lightweight MixColumns paper on all counts. I did not use exactly that in my own code because lookups are slower than XOR, extra tables waste space, and it uses a temporary that I manage to avoid.
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
If I correctly read the formula quoted for InvMixColumns, it has (for each of four j) 23 byte XORs and 13 table lookups of two different tables (or 9 table lookups of three different tables). Some code that I have around has 25 byte XORs and 7 table lookups of a single table, the doubling table used in MixColumns. That seems preferable both in hardware and software for 8-bit gear. I'll try to dig where I got the equations, which seem better than those proposed in that Lightweight MixColumns paper.
Jun
22
revised Which one is fastest? Karatsuba or Montgomery multiplication?
polish
Jun
22
revised Collision or second preimage for the Chacha core?
polish
Jun
22
comment Collision or second preimage for the Chacha core?
Sorry, my question is not about ChaCha (the cipher). I have now stated that explicitly. $\;$ I agree a lot about your praise of ChaCha (the cipher), as should be apparent in the info for the ChaCha tag.
Jun
22
awarded  Enlightened
Jun
22
awarded  Nice Answer
Jun
22
revised Collision or second preimage for the Chacha core?
Try to analyse my deep reason for asking the question
Jun
21
revised Is the HMAC construction really neccessary for a fixed length message?
Mention a preimage attack against the SHA-256 variant used as argument, and assume the consequence
Jun
21
comment Determine safety of exercise hash functions
@CodeInChaos: ah your reading makes sense and I rescind my former $h_{666}$. Your's is fine, and I immediately see no trivial attack against it in isolation. It's thus better than my idea of leaking $m$, going like: the right $218$ bits of $h_{666}$ are the left $218$ bits of ($m$ right padded with zeroes), the left of $h_{666}$ is some proper hash; which is not safe against first-preimage for messages up to $218$ bits, and $h_C$ inherits that weakness.
Jun
21
comment Collision or second preimage for the Chacha core?
@user3201068: indeed. I have now emphasized the (pre-existing) observation that a collision or second preimage for the Chacha core would not be a defect.
Jun
21
revised Collision or second preimage for the Chacha core?
Emphasize a yes, and other observations, would not be an attack.
Jun
21
revised chacha wiki description
added 592 characters in body
Jun
21
revised chacha wiki excerpt
added 32 characters in body
Jun
21
revised Collision or second preimage for the Chacha core?
Expand on other known properties of the cores