Reputation
27,133
Next tag badge:
429/400 score
74/80 answers
Badges
2 41 115
Impact
~430k people reached

10h
comment Generate RSA-2048 private key for a VERY fast decryption (don't care if it will be unsecure)
I confirm the calculations. $\lambda(n)+1=e$
1d
comment Can iterated hashing be used to mitigate collision and preimage weaknesses?
@boot4life: your justification is quite different from mine, and just as based on reasonable argument rather than proof. Indeed hashing twice makes twice as many rounds, which can increase security in some contexts; on top of that there is a major irregularity in the middle of the rounds, as we finalize the first hash, pad it, and reenter it as message for the other rounds, which arguably could help preimage security too - at least we have proof that it does not doom it!
1d
comment Can iterated hashing be used to mitigate collision and preimage weaknesses?
@boot4life: see added Handwaving argument
2d
comment Can RSA be securely used for “blind decryption”?
I would say that the protocol works, in the sense that if Sally is able to store $\mathcal E(k)$ and keep it secret, she can get back to $k$, thus $H(k)$, without revealing these, with the help of Charlie; further, verifying what Charlie returns, which is easy, prevents an active adversary from messing with the recovered $k$. $\;$ However I fail to see why the server does not keep $k$ or $H(k)$ rather than $\mathcal E(k)$; if we assume Charlie does its task without any check or limit in time, that seems to achieve the same result, in a much simpler way.
2d
comment Can RSA be securely used for “blind decryption”?
The part about Charlie not revealing "anything equivalent to Ki" does not seem so much of a problem to me: although we do not have a proof of that, it is widely accepted that in textbook RSA, temporary access to a decryption oracle can not allows extraction of a private key, or otherwise help the decryption of random messages drawn after access to the decryption oracle has stopped.
2d
comment Can RSA be securely used for “blind decryption”?
Some notes: It seems the server must store the client's public key in integrity-trusted storage, and $\mathcal E(k)$ in integrity+confidentiality-trusted storage, despite the last sentence in second bullet. $\;$ The client seems to need to know $H(k)$, and it is not told how; that part of the exchange might interfere with the rest.
2d
comment How feasible would it be to generate 300 million public key pairs in 8 hours?
@SEJPM: all the benchmarks quoted are purely single core (and single thread); bench.cr.yp.to/supercop.html states: benchmarks on multiple-core CPUs use just one core.
Aug
26
comment Can RSA be securely used for “blind decryption”?
Two observations: a) the scheme relies on $\mathcal E$ being homomorphic, but standard non-textbook RSA is not; thus the scheme does not allow decryption with standard non-textbook RSA, thus its security is moot; first define the variant of RSA you consider for the security analysis. b) define your security goals and threat model, in particular if an adversary impersonating the server to the client (which seems trivial since the server has no credential), or actively eavesdropping connection between actual client and server, are considered a break.
Aug
25
comment Random Function size
@dave_thompson_085: right; thanks; I hereby replaces my previous comment (now gone) with: Also, the enumeration of the question lists only 4 out of 4!=24 one-one functions onto the set of 2-bit strings to itself.
Aug
25
comment Why is RSA encryption significantly faster than decryption?
Given that $e=2^{16}+1$ is parse, and the mostly random nearly 1024-bit $d$ is not, with common exponent scanning techniques, the ratio of modular multiplication is more like ${3\over2}1020/(16+1)\approx90$ (rather than $60$); further, at the 1024-bit level CRT does not quite save a factor of $4$, so in my experience RSA-1024 decryption/signature is more like $25$ (rather than $15$) times slower than RSA encryption/signature verification with $e=2^{16}+1$ (unless multiple cores, Montgomery pre-computations, sliding windows exponentiation, multi-primes, or side-channel hardening is considered).
Aug
24
comment How feasible would it be to generate 300 million public key pairs in 8 hours?
The "reasonable strength" requirement in the question had dissuaded me of even thinking of sharing primes. Your "generating the RSA keys to search for some criteria" is a nice justification for this unusual way of doing things. Do you have some (semi-)real use case for this, perhaps some attack ?
Aug
23
comment Modular reduction for NIST prime P256— understanding the data
Given your general state of confusion, you might benefit from A (relatively easy to understand) primer on elliptic curve cryptography, skipping directly to Elliptic curves: Building blocks of a better trapdoor (I dislike the intro on toy RSA).
Aug
23
comment Does it make sense to have a compression function that uses 64-bit of the message to create an output of 64-bit?
@B-Con: I understand what you describe in your comment and the following one; but not how that would allows to find a collision or preimage more efficiently than a generic birthday attack.
Aug
23
comment Does it make sense to have a compression function that uses 64-bit of the message to create an output of 64-bit?
@Thomas: I nailed that cryptanalytic attack!
Aug
23
comment Why the $IV$ used in Merkle-Damgard has to be fixed to a specific value?
One reason is convenience: a variable IV would need to be transmitted, perhaps authenticated.. Another reason is explained here following with the IV replaced by a constant of unknown origin
Aug
19
comment Cryptography and FPGA
In my experience, Smart meters or other "internet of things" devices are power and cost critical, and thus typically do NOT use FPGAs, which are often power-hungry and more expensive than CPUs.
Aug
19
comment Is calculating HMAC from hashed input a good idea?
@HenrickHellström: a "yes" answer is the same as (or at least compatible with) "no, assuming [something not in premise, and acknowledged as such]".
Aug
10
comment Attacking RSA signature verification that ignores padding
In the answer, $e=65537$ is meant where there is $e=65536$. With this $e$ and 2048-bit $N$, I concur that we know no attack (and doubt that there is one). For very large $N$ (of $e\cdot64\cdot8\approx 2^{25}$ bits), there's a trivial attack, and I wonder how much this can be lowered.
Jul
30
comment Why calculate pi to estimate randomness?
@Paul Uszak: Generating random numbers, and testing them, is fascinating; that's the state of mind at fourmilab's hotbits. Their generator seems to be a high-quality, physically-seeded TRNG, with multiple statistical tests at the lightly-conditioned output, which is fine. However their use of the π-by-Monte-Carlo test is more an extra, simple demo that the thing works, for added confidence that there's no horrible goof, than a test designed for real use in fielded cryptographic devices.
Jul
28
comment Library to find an addition chain for a large number?
A reference to some of the best solutions known to the problem of addition chains (without subtraction) is Daniel Bernstein's Pippenger's exponentiation algorithm