Reputation
27,243
Next tag badge:
429/400 score
74/80 answers
Badges
2 41 115
Impact
~432k people reached

Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
@CodesInChaos: Very right! I fixed the answer according to your observation.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Revise per comment
Jul
9
comment RSA-based authentication and key-agreement protocol
In the tiny subset of Java available in Java Card Classic, any portable code doing a computation on big numbers that is not natively implemented by the API incurs a performance hit by a factor of 50 or more compared to a native implementation; even addition over more than 16 bits is nontrivial (support of the 32-bit int type at runtime is an option not available on most cards!); further, the risk of side-channel attack exists.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
As rightly pointed by CodesInChaos, Merkle-Damgård hashes are not second-preimage-resistant to $2^n$ effort (see John Kelsey and Bruce Schneier's Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work), so it would seem that the proposed construction does NOT weaken SHA-256 after all.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Generalize to any number of separately hashed blocks; use TeX
Jul
9
comment Client authentication on limited hardware
RSA is very fast for the purpose of authenticating something (rather than: authenticate w.r.t. something). For 2048-bit public modulus, public exponent $e=3$, and a CPU with 32x32 bit multiplication, in the order of 17000 multiply-and-accumulate are enough, with textbook algorithms and straightforward loops. This can be about halved with Rabin, while still having standard-conformance, e.g to ISO/IEC 9796-2, and then there's DjB's work.
Jul
9
revised Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
Fix typos
Jul
9
comment RSA-based authentication and key-agreement protocol
Ah, right, I did not read up to the KGC-free certificate-based variant (page 24), sorry about that; I do see it now, thanks for your patience! $\;$ Still, the public-key certificates need more parameters than in RSA, and it seems non-trivial to implement the protocol on top of RSA primitives: I think we need modular squaring and/or inverse, and either is a nightmare to implement in the subset of Java available in a Java Card Classic Smart Card.
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish
Jul
8
revised How is this affine function a pair wise independent permutation?
Add missing step
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish and simplify
Jul
8
revised How is this affine function a pair wise independent permutation?
Shorten
Jul
8
revised How is this affine function a pair wise independent permutation?
I'm more confortable with a finite field after all.
Jul
8
revised How is this affine function a pair wise independent permutation?
Polish
Jul
8
answered How is this affine function a pair wise independent permutation?
Jul
8
revised How is this affine function a pair wise independent permutation?
Added definition requested
Jul
8
revised How is this affine function a pair wise independent permutation?
Exact quote (based on the preprint)
Jul
8
comment How is this affine function a pair wise independent permutation?
Are you reading the actual paper, or what appears to be the Nov 1997 preprint, which does contain (nearly) the sentence now in the second paragraph of the question?
Jul
8
comment An unpredictable PRG is secure (Theorem Yao'82)
I think a proof sketch using contraposition might go: Assume $G$ is not a secure PRG. There is thus an algorithm that breaks $G$. Define $G_i$ which substitutes true random to bits at position $j\ge i$. The same algorithm breaks $G_n$ (since that's $G$) but not $G_0$ (since that's random). So there must be a $i$ such that it breaks $G_{i+1}$ but not $G_i$. Now you can build a predictor for position $i$.
Jul
7
answered Adi Shamir's secret database of all primes