fgrieu
Reputation
33,783
95/100 score
 Jan 8 answered What is the advantage of digital signatures over message authentication codes? Jan 8 comment What is an impure NIST true random number generator? @Paul Uszak: I have met many sources with allegedly 1-bit entropy rate, and found all to be either distinguishable from random with a lot of high-resolution samples and a careful test; documented as conditioned; or poorly documented. I conclude there are 3 kinds of TRNG sources: (1) unconditioned with less that 1-bit entropy rate; (2) conditioned with 1-bit entropy rate; (3) snake oil. Jan 8 comment How to calculate d in RSA for my number with this This and the description of the Extended Euclidian algorithm might also help. Surprisingly, I fail to find a complete step by step answer performing $d=e^{-1}\bmod\operatorname{lcm}(p-1,q-1)$ on our site! Jan 8 comment What is an impure NIST true random number generator? How do you get that a noisy diode source is natively generating approximately 50% pure entropy? For a start, it does not output bits; the conditioning circuit does, and it is very hard to tell the entropy rate of that output. Jan 8 revised Find private exponent in RSA Aply Ricky Demer's suggestion Jan 8 comment How to calculate d in RSA for my number with this A more rigorous notations is writing $ed\equiv1\pmod{\phi(n)}$ or $ed\bmod\phi(n)=1$. Problem with $ed=1\bmod\phi(n)$ is that it can (and arguably should) be read $ed=(1\bmod\phi(n))$, that is $ed=1$. Also, $ed\equiv1\pmod{\phi(n)}$ is a sufficient condition, but is not necessary; the necessary and sufficient condition, used in PKCS#1, is $ed\equiv1\pmod{\lambda(n)}$. $d=413$ is a valid private exponent, but $17\times413\bmod3120\ne1$. Jan 7 comment Permutation of keys that guarantees different hashes @petermlm: please confirm (or infirm) that the question is as follows: given two fixed distinct $x$ and $y$, is there a (hash) function $H$ with $H(x)=H(y)$ and such that for any permutation $m$ distinct from identity, $H(m(x))\neq H(m(y))$ ? Jan 7 comment Simple RSA Key Generation example The other question is asked with $(e,N)$ given; when the present question is asked with $(p,q,e)$ given. So the present question is not quite a duplicate, and is computationally easier. Hint1: with $p$ and $q$ distinct odd primes, for $e$ to be valid you need $\gcd(e,p-1)=\gcd(e,q-1)=1$ ; or equivalently $\gcd(e,\varphi(p\cdot q))=1$ ; or yet equivalently $\gcd(e,\lambda(p\cdot q))=1$ (some require $e>2$, perhaps $e0$, then $\gcd(u,v)=1$ if and only if $u$ is not a divisor of $v$. Jan 7 revised Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? Acknowlege the virtue of the other arguments. Jan 7 comment Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? We do not have a precise definition of hash; SHA-512 restricted to 60-byte input could be said to be a hash @Guut Boy Jan 7 revised Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? State access to the hash is assumed Jan 7 comment Various RSA encryption times What's wrong with ronald benchmarks here? There is no such thing as "standard times for RSA encryption" without some context. 64-bit CPU running at 4GHz, 8-bit CPU drawing 0.1W, co-processor for a Smart Card, HSM, ASIC designed specifically for RSA acceleration? Is the message small (a PIN code) or large (a video, encrypted with hybrid encryption) ? Are we doing encryption, or decryption (and in the later case, with or without CRT, and with how many factors)? Are things optimized for speed? As a relatively minor aside, what is the modulus size? Jan 7 awarded Nice Answer Jan 6 revised Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? Polish Jan 6 revised Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? Addition Jan 6 comment Is there a simple hash function that one can compute without a computer? As pointed in comment above, Gaussian elimination allows to find a preimage (if there is one), and that implies this is not collision-resistant. Jan 6 comment Which crytographic standard were RC5, CAST5 and Blowfish based on? We don't do homework, or simple multiple choice questions, especially poorly worded ones (I do not see how Blowfish could be considered to be based on either of AES, RC2, 3DES or DES). Jan 6 answered Hash function that allows to decide if A > B if you only have hash(A) and hash(B)? Jan 6 revised Convert messages to elliptic curve points Polish Jan 5 comment Proof of RSA security dependent on public key exponent I do agree with " $e=65537$ reduce the consequences of certain implementation mistakes"; in particular: no padding at all; and PKCS#1 v1.5 encryption padding with a deciphering entity susceptible to padding oracle attack by leaking information thru an error code, or timing. But, because choice of $e$ is not independent of what implementation mistakes are made, I disagree with "A standard with exponent $3$ will - on average - have weaker implementations than a standard with larger exponent". @K.G.