Reputation
24,422
Next tag badge:
106/100 score
19/20 answers
Badges
2 32 102
Newest
 Nice Answer
Impact
~355k people reached

May
9
comment Understanding how SHA-512 achieves its design goals
A critic: that's a bit like explaining a CPU by discussing CMOS transistors only. This answer is currently only about the principle used in the lower layers of SHA-512. It does not consider A) the overall Merkle–Damgård structure; B) the Davies-Meyer construction of the compression function from a block-cipher; C) that cipher's overall construction (in particular: why 80 rounds, which I can't quantitatively explain).
May
7
comment Cryptodefense ransom use RSA-2048. Any chance with known plaintext attack?
According to sources including this the malware is poorly implemented and leaves the key allowing decryption somewhere on the HD, enabling decryption, for infection before April 2014. CAUTION: attempt repair on a complete exact full backup of the HD, leave the original untouched!
May
6
comment Is knowing the private key of RSA equivalent to the factorization of $N$?
Knowing $(N,e,d)$, including with big $e$, allows finding the factorization of $N$, by heuristic or deterministic methods pointed in Samuel Neves's nice answer. If $e$ is unknown but small, we can enumerate small values to find $e$, using $(x^d)^e\equiv x\pmod N$ for arbitrary $x$ such as 2 as a test of having reached the right $e$; and then are back to the same problem [reposted with fix].
May
6
comment RSA Proof - Is Z(n) closed under multiplication
$\mathbb{Z}_n$ is closed under multiplication by definition of the multiplication in $\mathbb{Z}_n$; which is about: $a\cdot b$ is $b+\dots+b$ repeated $a$ times, where $+$ is addition in $\mathbb{Z}_n$ (that is, modulo $n$), which result is in $\mathbb{Z}_n$. Perhaps you are really asking something else?
May
5
comment How do I produce a stream of secure random numbers from AES-Counter mode?
@owlstead: I was thinking that if as plaintext we choosed $E(K,IV)||E(K,IV+1)||\dots$ then the overall RNG would output zero. Also, $(E(K,IV)\oplus K)||E(K,IV+1)||\dots$ would reveal the key. Note: I assume the IV is known; a lot of it is zero in standard AES-CTR anyway.
May
4
comment How do I produce a stream of secure random numbers from AES-Counter mode?
Any plaintext independent of the AES key will do.
May
2
comment HMAC-SHA1 vs HMAC-SHA256 for data storage
MD5 is badly broken, but HMAC-MD5 is standing relatively strong. SHA1 is broken, but not so badly, draw your own conclusions about HMAC-SHA1. I would worry more of a key leak by machine compromise or side-channel than by theoretical weakness of HMAC-SHA1.
May
2
comment Understanding how SHA-512 achieves its design goals
The big picture should include at its top that SHA-2 is built using the Merkle–Damgård structure, from a One-way compression function itself build using the Davies-Meyer structure from a specialized block cipher. The arbitrary initial hash data is instrumental in the derivation of the security of the Merkle–Damgård construction (making SHA-2 a random instance of a hash familly), while the round constants are part of the block cipher design.
Apr
30
comment Performance for Subbytes in AES
Thanks for the pointer! It took me by surprise that a bitsliced implementation could be so effective.
Apr
30
comment How to argue to a paranoid that RSA is safe?
Anyone lucid should wonder: how can I decide which implementations of RSA (or other crypto) I trust when even certified ones fail significantly? See factorable.net and these enjoyable slides hyperelliptic.org/tanja/vortraege/20131205.pdf
Apr
30
comment Pseudocode for constant time modular exponentiation
@rath: The question would only be off-topic because its ask for "descriptions" in pseudocode, rather than "methods preferably with a description" in pseudocode, but that's semantic. I think that it got no satisfactory direct answer yet primarily because what's asked is hard to do in general without too much a sacrifice in performance; and secondarily because usual practice about the issue (do it in hardware to get constant time, or change goal to: find ways of dealing with potentially dangerous non-constant time in a safe way) do not match the statement.
Apr
29
comment Pseudocode for constant time modular exponentiation
@CodesInChaos: what you describe in GnuPG is a timing dependency, and might be a side-channel vulnerability (e.g. by acoustic noise, cross-VM cache flushing..) absent countermeasures, but is NOT a significant timing vulnerability in an RSA context. The adversary gets nothing exploitable with the hamming weight of $d$.
Apr
29
comment Pseudocode for constant time modular exponentiation
From the standpoint of timing dependency in RSA, using Montgomery ladder aims at solving the wrong timing dependency. It is no big deal to disclose, by timing, the hamming weight of the secret exponent $d$: that's too small an information leak to be a danger; also, there are several working $d$ since they are defined $\pmod{\operatorname{LCM}(p-1,q-1)}$. The real danger is timing dependency on what's exponentiated. Montgomery multiplication helps towards that (but is no silver bullet). Montgomery ladder may help for other forms of signal leakage, but the devil is in the details. [fixed]
Apr
29
comment Pseudocode for constant time modular exponentiation
@CodesInChaos: can you expand on that?
Apr
27
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
I tried to make an answer, but hardly got past exposition of the facts and references. I quote another one leading to $k=3$.
Apr
27
comment DES with actual 7 byte key
@owlstead: I see, nice. But I can't upvote twice!
Apr
26
comment CBC MAC and DES combined question?
Welcome and general comments as per your other question. Hints for this one: for any reasonable MAC scheme, to an adversary not knowing the key, the MAC values for different messages appear random, with matching odds of collision, which can be computed/approximated. Assuming that two (message, MAC) pairs have the same MAC, consider what similarities are bound to exist in the quantities involved when computing their respective MACs.
Apr
26
comment How secure would HMAC-SHA3 be?
However I'm still uncertain about: •A) the computational bound; is that also $2^{\ell-\xi}$ operations? •B) if we have better bound for that with HMAC than with the generic sponge MAC? •C) the importance in bound derivations that the blocksize $b$ is a multiple of the bitrate $r$ (1152, 1088, 832, 576 for $\ell$ of 224,256,384,512), both for HMAC and the generic sponge MAC.
Apr
26
comment How secure would HMAC-SHA3 be?
Reading the quote again, it is a fine claim if we read "shall resist a" as "resists any". I now see how it states a bound on the number of queries of: $2^{c/2-\xi}$ for some moderate $\xi$ with a derivation and $\xi\lll c/2$. Your answer and above comment helped understanding how that comes, thanks a lot! I now see that for HMAC-SHA3-$\ell$ that bound becomes $2^{\ell-\xi}$ queries, which is much better than the $2^{\ell/2}$ queries of the generic attack that you quote and applies to HMAC-SHA-256 and HMAC-SHA-512.
Apr
25
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Independently: In Lenstra's table 3, 1024-bit column, the 5 and 4 on the right side (denoting use of a computationally equivalent model) are unreasonable. In 2013, GMP-ECM pulled a 274-bit factor from a 787-bit number product of two unknown primes. Pulling that from a 1024-bit number would not be too much harder, when 1024-bit GNFS factorization is way out of reach using comparable resources. [Note: it was found $1655981992510727996318057388597586107176298189823861672438442579893251468834902‌​0287$ from $(7^{337}+1)/8/101020140256422276570987002251440602782290400709$ ].