Reputation
Next tag badge:
411/400 score
78/80 answers
Badges
2 36 109
Newest
 Revival
Impact
~395k people reached

Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
By "in group $\mathbb Z_r$" are you meaning $a$ and $b$ are in $\mathbb N$ and less than $r$, or that $a\cdot b$ is computed in that group?
Jul
17
comment Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?
@curious: I can't parse what "it's" refers to in your previous comment. Rather, my bets are on the inverse $\pmod{p-1}$
Jul
17
comment How long does it take to crack PBKDF2?
@Henrick Hellström: very true. That's a possible usage of PBKDF2, not the one I had in mind with my "used to manage passwords".
Jul
17
comment Attack on DSA modification with bad hash function
Write down the main equation used by the verifier for testing that $(m,r,s)$ is an acceptable signature in the weak system. The valid signature gives known values satisfying that equation. Your goal is finding $(m',r',s')$ with $m'\not\equiv m\pmod q$ which keeps the equation satisfied. What's $g^q\bmod p$? $y^q\bmod p$? What kind of changes does that allow while maintaining the equation satisfied? Perhaps replacing $s$ with $w=s^{-1}\bmod q$ in the equation (and $s'$ with $w'=s'^{-1}\bmod q$) will help you finding the appropriate changes.
Jul
17
comment Attack on DSA modification with bad hash function
Again, if for any $t$ you could forge the signature for $m′=t+m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m′)-H(m)\bmod q$ and using the same attack]. So no this does not cut it, and you need a narrower choice of $m$, of the form $m'=f(m,r,s,p,q,g,y,t)$ for some $f$; and it won't be possible to find $t$ to obtain a chosen $m'$. The mistake in the argument given is that it is assumed $s$ does not change, rather than proven that with $s$ unchanged the verification procedure will pass with the $r'$ that you propose; indeed the verification will fail.
Jul
16
comment Attack on DSA modification with bad hash function
@CGFoX: If for any $t$ you could forge the signature for $m'=t\cdot m\bmod q$ in the weakened system, that would also break the real DSA [by choosing $t=H(m')\cdot H(m)^{-1}\bmod q$ and using the same attack]. You want to exhibit a narrower class of transformations $m'=f_t(m,r,s,p,q,g,y)$ for which an acceptable signature $(r',s')$ can be forged.
Jul
16
comment Does having a known plaintext prefix weaken AES256?
As rightly answered, the answer to the question as in title and second paragraph is NO. $\;$ But suitability of counter mode can't be ascertained, for we do not know: $\;$ A) If the data ever legitimately changes, and how the counter is setup in that case; $\;$ B) If we should consider an attack model where the adversary changes the enciphered data, observes how the system then behaves when manipulating the (modified) deciphered data [e.g. error indication, or lack thereof], and deduce something about the actual clear data.
Jul
15
comment Attack on DSA modification with bad hash function
Does the statement allow the attacker to choose $m$ or/and $m'$? With what constraints?
Jul
9
comment How can I calculate the Rijndael SBox?
Some links: A new combinational logic minimization technique with applications to cryptology by Joan Boyar and René Peralta; this code-challenge; this code-golf; and this implementation.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
@CodesInChaos: Very right! I fixed the answer according to your observation.
Jul
9
comment RSA-based authentication and key-agreement protocol
In the tiny subset of Java available in Java Card Classic, any portable code doing a computation on big numbers that is not natively implemented by the API incurs a performance hit by a factor of 50 or more compared to a native implementation; even addition over more than 16 bits is nontrivial (support of the 32-bit int type at runtime is an option not available on most cards!); further, the risk of side-channel attack exists.
Jul
9
comment Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
As rightly pointed by CodesInChaos, Merkle-Damgård hashes are not second-preimage-resistant to $2^n$ effort (see John Kelsey and Bruce Schneier's Second Preimages on $n$-bit Hash Functions for Much Less than $2^n$ Work), so it would seem that the proposed construction does NOT weaken SHA-256 after all.
Jul
9
comment Client authentication on limited hardware
RSA is very fast for the purpose of authenticating something (rather than: authenticate w.r.t. something). For 2048-bit public modulus, public exponent $e=3$, and a CPU with 32x32 bit multiplication, in the order of 17000 multiply-and-accumulate are enough, with textbook algorithms and straightforward loops. This can be about halved with Rabin, while still having standard-conformance, e.g to ISO/IEC 9796-2, and then there's DjB's work.
Jul
9
comment RSA-based authentication and key-agreement protocol
Ah, right, I did not read up to the KGC-free certificate-based variant (page 24), sorry about that; I do see it now, thanks for your patience! $\;$ Still, the public-key certificates need more parameters than in RSA, and it seems non-trivial to implement the protocol on top of RSA primitives: I think we need modular squaring and/or inverse, and either is a nightmare to implement in the subset of Java available in a Java Card Classic Smart Card.
Jul
8
comment How is this affine function a pair wise independent permutation?
Are you reading the actual paper, or what appears to be the Nov 1997 preprint, which does contain (nearly) the sentence now in the second paragraph of the question?
Jul
8
comment An unpredictable PRG is secure (Theorem Yao'82)
I think a proof sketch using contraposition might go: Assume $G$ is not a secure PRG. There is thus an algorithm that breaks $G$. Define $G_i$ which substitutes true random to bits at position $j\ge i$. The same algorithm breaks $G_n$ (since that's $G$) but not $G_0$ (since that's random). So there must be a $i$ such that it breaks $G_{i+1}$ but not $G_i$. Now you can build a predictor for position $i$.
Jul
7
comment Generate Finite Field power of g
Explaining the $(0010)$ notation could come earlier in the response. Kudos for the rest.
Jul
7
comment Adi Shamir's secret database of all primes
That database is to cryptography venues what the Dahu is to French summer camps. Also see the answers to this. $\;$ The three other 'future work' items in the presentation are in the same vein.
Jul
4
comment Getting 88bytes cipher output from 48bytes input in AES
The paper considers that a block cipher's output is wider than its input, likely because the authors confused with some mode of operation of a block cipher complete with IV and padding; that's both for DES and AES.
Jul
4
comment In symmetric searchable encryption are the algorithms public?
In an academic cryptographic context, any algorithm is assumed public (except in specific domains like code obfuscation); that's the second of Kerckhoffs's principles.