Reputation
26,584
Next tag badge:
419/400 score
79/80 answers
Badges
2 37 112
Newest
 Benefactor
Impact
~411k people reached

Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
Discuss what enables the attacks.
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
Better credit
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
Incorporate the technique in Poncho's comment
Jun
23
comment Attack for RSA 1024 bit with Low Public Exponent
@poncho: Great, that's what I was attempting in 5, done the right way, that I missed entirely! You nailed it!! I'll update the answer.
Jun
23
comment Attack for RSA 1024 bit with Low Public Exponent
@poncho: Had the same idea but you beat me on publishing first!
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
Add another method; number these
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
Fix page number in a link
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
The goof that I mention might not be exaclty the one that occured in practice
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
All paddings are recognizable
Jun
23
revised Attack for RSA 1024 bit with Low Public Exponent
polish
Jun
23
answered Attack for RSA 1024 bit with Low Public Exponent
Jun
23
comment What is the danger if a non-prime is chosen for RSA?
The question is very similar to this one. To summarize my answer: if it accidentally happened that we use a composite, most likely the RSA key pair would fail on first use (in a PKI: when the certification request is checked, thus thus wrong key would not get certified). Another option, so unlikely that the combination of bad luck and a hardware defect is not enough to cause it, is that it was picked a Charmichael number instead of a prime, in which case RSA will work.
Jun
22
awarded  Caucus
Jun
22
awarded  Constituent
Jun
22
comment What are the differences between collision attack and birthday attack?
@HeatfanJohn: Yes. In crypto we often use the approximation that a birthday attack on a fair hash of $n$ bits succeeds with odds near $1/2$ after $2^{n/2}$ hashes (if we are able to detect any collision that might occur). $2^{64}$ is 19% lower that the more precise estimate that you quote.
Jun
22
revised Collision or second preimage for the ChaCha core?
their->its
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
Could not immediately locate how I got my formula, but I dug here nice public code that I know works, with aes_mixColumns_invusing 21 XORs and 9 table lookups of a single table (or 7 table lookups of two tables). That seems to beat the Lightweight MixColumns paper on all counts. I did not use exactly that in my own code because lookups are slower than XOR, extra tables waste space, and it uses a temporary that I manage to avoid.
Jun
22
comment Implementing AES MixColumns with fewest XOR gates
If I correctly read the formula quoted for InvMixColumns, it has (for each of four j) 23 byte XORs and 13 table lookups of two different tables (or 9 table lookups of three different tables). Some code that I have around has 25 byte XORs and 7 table lookups of a single table, the doubling table used in MixColumns. That seems preferable both in hardware and software for 8-bit gear. I'll try to dig where I got the equations, which seem better than those proposed in that Lightweight MixColumns paper.
Jun
22
revised Which one is fastest? Karatsuba or Montgomery multiplication?
polish
Jun
22
revised Collision or second preimage for the ChaCha core?
polish