Reputation
24,377
Next tag badge:
106/100 score
19/20 answers
Badges
2 32 102
Newest
 Nice Answer
Impact
~355k people reached

Apr
18
revised What are the constraints for an IV using AES in CBC mode?
Remove "secure" proposition that was not, or least not recommandable
Apr
17
comment Is chaotic encryption secure?
Count me as fully open to the idea that a chaos-based cryptosystem can be made secure, but highly skeptical that it has any advantage over established cryptosystems.
Apr
17
comment What are application of Cryptography in Algebraic Topology
It is usually mathematic fields that find application in cryptography, rather than the other way around (as asked). Cryptography in turn finds application in even more applied fields, like payment.
Apr
17
awarded  Nice Answer
Apr
17
comment Key space vs Cardinality of 1024-bit RSA
To avoid duplicate moduli we want $p<q$, that about halves the cardinality. And then, what about $e$ ? Setting a fixed $e=3$ reduces the cardinality by a factor of about $4/9$. If $e$ is allowed to vary, and we defined an RSA key as $(p\cdot q,e)$, our cardinality increases (and we should account for equivalent $e$ if very large $e$ are allowed). And then, many practical RSA key generation algorithms only generate primes of a certain form (like, such that $p-1$ and $p+1$ each have a known prime factor of a fixed bit size) and that reduces the cardinality of what they could generate.
Apr
16
comment Why is the call to RSA_generate_key_ex() failing sometimes?
Also, if BN_NUM_OF_RANDOM_BITS is decreased, it becomes possible that bne is 1, which works, but is terminally unsafe. Bottom line: random public exponents are an unneeded complication. $2^{16}+1$ is to public exponents what mainframes are to IBM (nobody gets fired for choosing them). $3$ compares to the Raspberry Pi and an intelligently written program instead of a Business Solutions on top of a random database.
Apr
16
revised Is there a way to use bcrypt with passwords longer than 72 bytes securely?
polish
Apr
16
revised Is there a way to use bcrypt with passwords longer than 72 bytes securely?
Formalize the hash requirements
Apr
15
answered Is there a way to use bcrypt with passwords longer than 72 bytes securely?
Apr
15
comment Is there any method to avoid the differential cryptanalysis?
Duplicate of crypto.stackexchange.com/q/9225/555 , and overly terse.
Apr
15
revised Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?
fix a notation
Apr
15
asked Factoring two RSA moduli $N_i=p_i\cdot q_i$ knowing that $p_2=p_1+2$?
Apr
15
comment Difference between IPSEC SA and CHILD SA
This is off-topic, because that's very specific to a particular security product, rather than cryptosystem. I suggest migration to security.stackexchange.com
Apr
15
comment Asymmetric encryption that is secure for (almost) any foreseeable future
It is not stated to what certainty degree it is required that the scheme remains secure after 1000 years, and that's an important parameter. It is much easier to predict very long term things with 30% chances to be wrong, rather than with 0.03% chances (a residual risk level often accepted in security, about that of having one's Smart Card pin guessed). One reason many key length estimates in the distant future are so conservative is that they are made with the intend to only err on the safe side.
Apr
15
comment Factoring two RSA modulus with known $|p_1 - p_2| < \ell $
I fail to see how the examination of the bits of the ratio$N_1\over N_2$ reveals information on $a$ (as stated in the but-last paragraph of the current answer). As a minor aside, $|p_1-p_2|\le2^s$ is not quite a sufficient condition to insure that $\lfloor p_1/2^s\rfloor=\lfloor p_2/2^s\rfloor$, thus existence of $a$. That part is easily fixable: with $s=\lceil\log_2\ell\rceil+4$, it is quite likely $a$ exists.
Apr
15
comment Factoring two RSA modulus with known $|p_1 - p_2| < \ell $
@mikeazo: in the present question $0<|p_1-p_2|<\ell$, in the other question that you linked (transposing the notation to match that in the present question), we have $|p_1-q_1|<\ell$. $\;$ I have not understood the proposed attack, and fail to see one. $\;$ I second Lisbeth's approach to first try to solve the problem with $p_1-p_2=2$.
Apr
14
revised The effect of truncated hash on entropy
fix my totally bogus usage of small-o notation
Apr
14
comment Meaning of Signature hash algorithm field in certificate
@Dandan: only $Pub_B$ is in the certificate that we are talking about in the question and answer. $Pub_A$ is the public key of the certification authority, is typically designated (not contained) in the certificate's data, and is known and trusted either because it is built in the software that verifies certificates, or because it is introduced by another certificate including a signature verified by yet another known and trusted public key. Sometime $Pub_A=Pub_B$, this is a self-signed certificate, and we can trust these only if they are known to come from a trusted source.
Apr
14
comment RFID Protocol Cryptanalysis
Think about it again: with the protocol as described, some message loss can turn the step "they both add $r_1$ to the key set" into something where one of TAG or READER did this, and the other did not.
Apr
14
comment RFID Protocol Cryptanalysis
In RFID, the TAG goes from a READER to another; as far as I understand the scheme outlined, the various readers need to know the current sate of a given TAG, by communicating between each others in some way, which is not something to lightly consider for granted in the physical world. $\;$ Independently, it is frequent that a message is lost between TAG and READER (in either direction), and the protocol outlined does not seem to account for that inescapable fact. $\;$ So before asking if it's secure (and defining the meaning of that): does it even work in the absence of adversary?