Reputation
25,305
Next tag badge:
391/400 score
76/80 answers
Badges
2 32 104
Impact
~371k people reached

Apr
29
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Document workaround to one of the issues
Apr
29
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
GNFS could in the future benefit from GPU
Apr
29
revised What is the MD5 collision with the smallest input values?
Discuss answering with an integer.
Apr
29
comment Pseudocode for constant time modular exponentiation
@CodesInChaos: can you expand on that?
Apr
29
answered What is the MD5 collision with the smallest input values?
Apr
29
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Reference and comments about other ECM records
Apr
29
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Improve 5, 6, and the report on record ECM factorization
Apr
27
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
I tried to make an answer, but hardly got past exposition of the facts and references. I quote another one leading to $k=3$.
Apr
27
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Basic proofreading
Apr
27
answered Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Apr
27
comment DES with actual 7 byte key
@owlstead: I see, nice. But I can't upvote twice!
Apr
26
comment CBC MAC and DES combined question?
Welcome and general comments as per your other question. Hints for this one: for any reasonable MAC scheme, to an adversary not knowing the key, the MAC values for different messages appear random, with matching odds of collision, which can be computed/approximated. Assuming that two (message, MAC) pairs have the same MAC, consider what similarities are bound to exist in the quantities involved when computing their respective MACs.
Apr
26
revised CBC MAC and DES combined question?
Remove artifact of cut and paste, tag as homework
Apr
26
awarded  Informed
Apr
26
revised Nonlinearity of the J-K Flip Flop
Give truth table
Apr
26
comment How secure would HMAC-SHA3 be?
However I'm still uncertain about: •A) the computational bound; is that also $2^{\ell-\xi}$ operations? •B) if we have better bound for that with HMAC than with the generic sponge MAC? •C) the importance in bound derivations that the blocksize $b$ is a multiple of the bitrate $r$ (1152, 1088, 832, 576 for $\ell$ of 224,256,384,512), both for HMAC and the generic sponge MAC.
Apr
26
comment How secure would HMAC-SHA3 be?
Reading the quote again, it is a fine claim if we read "shall resist a" as "resists any". I now see how it states a bound on the number of queries of: $2^{c/2-\xi}$ for some moderate $\xi$ with a derivation and $\xi\lll c/2$. Your answer and above comment helped understanding how that comes, thanks a lot! I now see that for HMAC-SHA3-$\ell$ that bound becomes $2^{\ell-\xi}$ queries, which is much better than the $2^{\ell/2}$ queries of the generic attack that you quote and applies to HMAC-SHA-256 and HMAC-SHA-512.
Apr
26
revised How secure would HMAC-SHA3 be?
reference on suggested block size
Apr
25
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Independently: In Lenstra's table 3, 1024-bit column, the 5 and 4 on the right side (denoting use of a computationally equivalent model) are unreasonable. In 2013, GMP-ECM pulled a 274-bit factor from a 787-bit number product of two unknown primes. Pulling that from a 1024-bit number would not be too much harder, when 1024-bit GNFS factorization is way out of reach using comparable resources. [Note: it was found $1655981992510727996318057388597586107176298189823861672438442579893251468834902‌​0287$ from $(7^{337}+1)/8/101020140256422276570987002251440602782290400709$ ].
Apr
25
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
This disregard an issue: with say 1% of the expected work to factor a given realistic modulus, ECM has odds 1% to factor it; but GNFS just can't conceivably succeed. If we want a very low residual risk that an adversary succeeds with a given effort, we MUST take this into account, and that shifts the result significantly, in the direction of allowing less factors.