Reputation
33,847
Next tag badge:
95/100 score
20/20 answers
Badges
2 50 137
Impact
~563k people reached

13m
comment 128 Bit AES Issue
If indeed "the memory saves each byte in a word block" with "word block" anything else than an octet, then you have a pointer type problem (which the compiler should bark about if properly set up, and you neither cast pointers nor use an unsafe union): the interface to aes_enc_dec is passed the block as an unsigned char *, which most often is the same as a pointer to uint8_t from <stdint.h>, which always is an octet; only you can know what uint8 is, and can sort out the different types.
4h
comment 128 Bit AES Issue
I'm inclined to believe the error is not in aes_enc_decas posted, but in some other code calling it and making the conclusion stated in the question. Also, 00112233445566778899aabbccddeeff (assuming that is an AES block) does not match the condition "two bytes within a word are identical", but rather two nibbles within a byte are identical, so perhaps the problem is in the conversion from hex to bytes or/and back, perhaps in endianness or character parity in that conversion.
18h
comment Fast hash for 64-bit inputs
@Demetri: in order to protect against hash collision DoS, you need at least a (fast) MAC, not hash. That is, a function with as input the 64-bit key to the hash table, and a key unknown to the adversary, e.g. randomly seeded at launch of the application. Otherwise, given the small input space, the adversary will be able to cause collision by brute force.
1d
comment How is a message digest decrypted?
Does the book actualy contain "encrypts the digest with device A's private key to create a signature" ? If yes, complain to the authors for the poor wording choice, and another serious mistake: one never encipher with a private key in any public-key context; plus, there is a well-known chosen-message attack against the scheme as described.
2d
comment What are the pre-requisites I need to be able to code Salsa20 in C#?
It's not rocket science. I find Bernstein's Salsa20 specification (direct link to pdf) clear enough, once endianness (an essential Computer Science concept) is understood. If the particular C# is interpreted, that will I guess have a sizable impact on performance, and limit the usefulness to "code Salsa20 in C#". The main interest of the academic exercise would be to compare the performance between the best that particular C# chain can do, and compiled code.
2d
comment RSA PKCS#1, v1.5 padding output
Fine! And enjoy the show!
2d
comment Is multiplicative blinding less secure than additive?
@Guut Boy: Yes. I'm willing to trade rep against ability to fix my past comments, but that's not an option, apparently.
Feb
8
comment Compression in key generation of DES algorithm
@Abir: generic pseudocode: for j from 1 to 48 output[j] := input[pc2[j]]. Actual code will very much depend on language, array base index, representation of variables.
Feb
8
comment Is multiplicative blinding less secure than additive?
Define multiplicative blinding; in particular how the blinding factor $b$ is chosen (its probability distribution); and how it is applied ($x\to x\cdot b$ is not the same as $x\to x\cdot b\bmod p$, the later form is just as secure as additive blinding when $x\ne0$ and $b$ is uniform over $[1\dots n-1]$).
Feb
7
comment Compression in key generation of DES algorithm
Anything wrong with the explanation and drawing in Wikipedia? Notice that in DES, the convention is that the bits are numbered from 1 onwards, with 1 being the first or left bit, or the most significant bit of in the big-endian translation to integer of a bitstring, or the most significant bit in the first or left octet in an octet string. Also, the output of PC2 is subdivided into 8 bitstrings of 6 bits (hence the presentation of the table as 8 lines of 6 entries), corresponding to S1 thru S8.
Feb
6
comment Common Modulus Attack not reproducible
@Ricky Dememer: yes; you reduced the problem to finding an efficient way to compute the meadow inverse of a given $c$ modulo $n$ of unknown factorization when $c$ has no regular inverse, and is not $0$.
Feb
5
comment Security of RSA for paranoids with padding?
@Maarten Bodewes: no, I did not make any progress, or have had time to seriously explore potentially interesting alternatives to the dominant asymmetric crypto for Smart Cards (2-primes RSA, ECDSA per FIPS 186-4).
Feb
4
comment Secure blinding factor switching at malicious server-side (Switching in One Time pad)
@user153465: the second paragraph in the answer tries to address that. The adversary is free to compute any function of $v_1$ and $v_2$, like $v_4(v_1,v_2)=(v_1+v_2)^{v_1-v_2}$, or $v_3(v_1,v_2)=v_1\cdot v_2$, anything goes, that has no influence on the demonstration given. This is just extra added to the question's statement, obscuring it, that we want to get rid of to focus on the expressions involving $a$, or $z_1$, $z_2$ or other things not known to the adversary.
Feb
4
comment How does RIPEMD160 pad the message?
@seeker: I see no issue with the reference implementation; it works fine for me, with the (documented) issue is that it uses a non-portable definition of the 32-bit type dword. If the compiler barks, that should be changed from unsigned long to uin32_t from <stdint.h>, or just unsigned on many modern machines. Try to use that reference code from the simple main program that I posted.
Feb
3
comment How does RIPEMD160 pad the message?
@seeker: the page I link to links to a reference C implementation. It is easy to instrument to show intermediary results. I'm not aware of other source of intermediary results.
Feb
1
comment total effective key length of the AESX-192
@poncho: indeed, my mistake. That makes the question more interesting.
Jan
31
comment How to calculate plaintext from modpower cipher
If $a$ is among a small known set (e.g. is the name of a classmate on the call roll per some encoding), and $n$, $e$, $b$ are known, then we much likely can find $a$ by trial and error.
Jan
31
comment Proving property of Modified Rabin Signature
Hint: prove that $p=3\pmod4$, $p$ prime, $q=3\pmod4$, $q$ prime, $n=pq$, $\gcd(x,n)=1$ implies $x^{\frac{(p−1)(q−1)}{2}}-1\equiv0\pmod p$ and $x^{\frac{(p−1)(q−1)}{2}}-1\equiv0\pmod q$; then use $p\ne q$ and conclude.
Jan
31
comment Why does image size increase after steganography?
With no info on the steganography technique used, we can only state a generality: compression set aside, in a steganography technique sending an image within an image, the output of the encoder is the hidden image, and the apparent image, so by an entropy argument some natural value of the output size is the sum of the input sizes. That said, it is entirely conceivable to make a steganography encoder that compresses to the point that the output of the encoder is smaller than either of its inputs.
Jan
29
comment Is H'(M)=5*M + 9*H(M) mod 2^n a secure hash?
@Meysam Ghahramani: the question is interesting, but please fix the erroneous statement about NP-hardness.