Reputation
27,133
Next tag badge:
429/400 score
74/80 answers
Badges
2 41 115
Impact
~431k people reached

Jul
29
revised Why calculate pi to estimate randomness?
link to FIPS 140-1 and other polish
Jul
29
revised Why calculate pi to estimate randomness?
justify π/4
Jul
28
awarded  Necromancer
Jul
28
revised Why calculate pi to estimate randomness?
More links to jargon
Jul
28
awarded  Revival
Jul
28
revised Why calculate pi to estimate randomness?
Give example of purposely induced defect
Jul
28
revised Why calculate pi to estimate randomness?
Add links to jargon
Jul
28
revised Why calculate pi to estimate randomness?
polish
Jul
28
answered Why calculate pi to estimate randomness?
Jul
28
comment Library to find an addition chain for a large number?
A reference to some of the best solutions known to the problem of addition chains (without subtraction) is Daniel Bernstein's Pippenger's exponentiation algorithm
Jul
28
awarded  Nice Question
Jul
27
comment Permuting Small Sized Set in Practice
In this pseudocode, t = rand(0, i) must generate a random integer uniformly distributed among the i+1 integers in range [0,i] inclusive; otherwise the permutation is distinguishable from random, especially for small sets.
Jul
27
comment Permuting Small Sized Set in Practice
What's wrong with the Fisher–Yates shuffle, which is the archetypal way to randomly make a permutation of a set small enough that we can store the index of each element? Or/and (especially, for wider sets) enciphering the index using one of the many techniques of Format-Preserving Encryption and a fixed key?
Jul
24
comment Collision or second preimage for the ChaCha core?
If we could demonstrate that the ChaCha core is not a bijection (other than for 0 rounds, where that result is trivial), it would be something. I conjecture that's feasible for few rounds (like 2), but becomes infeasible for enough rounds to reach security (like 8 or more). The final addition destroys the argument of bijection, but lack of argument for a proposition does not prove that it does not hold (much less provide a counterexample).
Jul
24
comment Collision or second preimage for the ChaCha core?
Nitpick: the final addition in the core makes it not easily invertible. We know how to make public, easily computable functions over a 512-bit domain that are demonstrably bijective, but quite computationally hard to invert for arbitrary output (admittedly, building such function using only ARX operations requires a lot of these).
Jul
24
comment Collision or second preimage for the ChaCha core?
Summarizing the discussion: the theorem prover proved that 2 rounds of ChaCha can't collide; this is not directly related to the ChaCha core with 2 rounds colliding. $\;$ It did not answer on if the ChaCha core with 10x2 rounds collides. In fact, if an automated tool could prove or disprove that the ChaCha core with only 2 rounds has collisions, that would be even more an achievement than proving that for the Salsa20 core. $\;$ There are strong heuristic arguments that there are collisions for the ChaCha core using enough rounds for security, we just do not know any (for now).
Jul
24
revised Collision or second preimage for the ChaCha core?
Merge the two clarifications
Jul
24
revised Collision or second preimage for the ChaCha core?
clarification added
Jul
23
revised Collision or second preimage for the ChaCha core?
hopefully clarify the reference code
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
@dannycrane: Yes, in $2/{\log_e n}$ the letter $e$ is the base of natural logarithm, not the public exponent. $\;$ No, in $(1 - 2/{\log_e n}) ^ {\log_2 n - 1} \approx 0.044$, exponentiation is meant; think of $\log_2 n - 1$ as a number of trials, each flipping a bit with odds $1-2/{\log_e n}$ of not reaching a prime.