Reputation
33,837
Next tag badge:
95/100 score
20/20 answers
Badges
2 50 137
Impact
~563k people reached

Jan
11
comment Is finding collisions in a part-hash not often enough a bad problem?
I can't get how " ~7700 " comes into the question, unless the 32-bit output is not binary. Independently: beware that the average number of random 32-bit samples to get a collision is not $2^{16}$; see this
Jan
11
comment To understand a fact related to padding in MD5
If the message is $b$ bits, there are exactly $512-((b+64)\bmod512)$ bits of padding, the first of which being a 1, all the others 0; and then there's the 64-bit length (little-endian).
Jan
10
comment Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)
Hint: you want to consider the Pohlig-Hellman algorithm.
Jan
10
comment Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)
Hint: that's an (imprecise) statement of the Discrete Logarithm problem. Depending on parameters (including the domain for $x$, $p$, its size, the smoothness of $p-1$, the choice of $m$), that's hard, or feasible.
Jan
8
comment What is an impure NIST true random number generator?
@Paul Uszak: I have met many sources with allegedly 1-bit entropy rate, and found all to be either distinguishable from random with a lot of high-resolution samples and a careful test; documented as conditioned; or poorly documented. I conclude there are 3 kinds of TRNG sources: (1) unconditioned with less that 1-bit entropy rate; (2) conditioned with 1-bit entropy rate; (3) snake oil.
Jan
8
comment How to calculate d in RSA for my number with this
This and the description of the Extended Euclidian algorithm might also help. Surprisingly, I fail to find a complete step by step answer performing $d=e^{-1}\bmod\operatorname{lcm}(p-1,q-1)$ on our site!
Jan
8
comment What is an impure NIST true random number generator?
How do you get that a noisy diode source is natively generating approximately 50% pure entropy? For a start, it does not output bits; the conditioning circuit does, and it is very hard to tell the entropy rate of that output.
Jan
8
comment How to calculate d in RSA for my number with this
A more rigorous notations is writing $ed\equiv1\pmod{\phi(n)}$ or $ed\bmod\phi(n)=1$. Problem with $ed=1\bmod\phi(n)$ is that it can (and arguably should) be read $ed=(1\bmod\phi(n))$, that is $ed=1$. Also, $ed\equiv1\pmod{\phi(n)}$ is a sufficient condition, but is not necessary; the necessary and sufficient condition, used in PKCS#1, is $ed\equiv1\pmod{\lambda(n)}$. $d=413$ is a valid private exponent, but $17\times413\bmod3120\ne1$.
Jan
7
comment Permutation of keys that guarantees different hashes
@petermlm: please confirm (or infirm) that the question is as follows: given two fixed distinct $x$ and $y$, is there a (hash) function $H$ with $H(x)=H(y)$ and such that for any permutation $m$ distinct from identity, $H(m(x))\neq H(m(y))$ ?
Jan
7
comment Simple RSA Key Generation example
The other question is asked with $(e,N)$ given; when the present question is asked with $(p,q,e)$ given. So the present question is not quite a duplicate, and is computationally easier. Hint1: with $p$ and $q$ distinct odd primes, for $e$ to be valid you need $\gcd(e,p-1)=\gcd(e,q-1)=1$ ; or equivalently $\gcd(e,\varphi(p\cdot q))=1$ ; or yet equivalently $\gcd(e,\lambda(p\cdot q))=1$ (some require $e>2$, perhaps $e<p\cdot q$ or $e<\varphi(p\cdot q)$ ). Hint2: if $u$ is prime and $v>0$, then $\gcd(u,v)=1$ if and only if $u$ is not a divisor of $v$.
Jan
7
comment Hash function that allows to decide if A > B if you only have hash(A) and hash(B)?
We do not have a precise definition of hash; SHA-512 restricted to 60-byte input could be said to be a hash @Guut Boy
Jan
7
comment Various RSA encryption times
What's wrong with ronald benchmarks here? There is no such thing as "standard times for RSA encryption" without some context. 64-bit CPU running at 4GHz, 8-bit CPU drawing 0.1W, co-processor for a Smart Card, HSM, ASIC designed specifically for RSA acceleration? Is the message small (a PIN code) or large (a video, encrypted with hybrid encryption) ? Are we doing encryption, or decryption (and in the later case, with or without CRT, and with how many factors)? Are things optimized for speed? As a relatively minor aside, what is the modulus size?
Jan
6
comment Is there a simple hash function that one can compute without a computer?
As pointed in comment above, Gaussian elimination allows to find a preimage (if there is one), and that implies this is not collision-resistant.
Jan
6
comment Which crytographic standard were RC5, CAST5 and Blowfish based on?
We don't do homework, or simple multiple choice questions, especially poorly worded ones (I do not see how Blowfish could be considered to be based on either of AES, RC2, 3DES or DES).
Jan
5
comment Proof of RSA security dependent on public key exponent
I do agree with " $e=65537$ reduce the consequences of certain implementation mistakes"; in particular: no padding at all; and PKCS#1 v1.5 encryption padding with a deciphering entity susceptible to padding oracle attack by leaking information thru an error code, or timing. But, because choice of $e$ is not independent of what implementation mistakes are made, I disagree with "A standard with exponent $3$ will - on average - have weaker implementations than a standard with larger exponent". @K.G.
Jan
4
comment Proof of RSA security dependent on public key exponent
That's the forward search attack; but a simple proof is better than a source! $\;$ If the unknown name $x$ of a classmate is enciphered as $c=x^e\bmod N$, with $N$, $e$, $c$ known (the standard assumption in RSA encryption): simply compute $c_j={x_j}^e\bmod N$ for the name $x_j$ of each classmate; find for which $j$ it holds that $c=c_j$; the classmate $x$ is now known, that's $x_j$. This basic attack (totally overlooked in many bad introductory texts) works regardless of the choice of the public key $(N,e)$.
Jan
4
comment Proof of RSA security dependent on public key exponent
I recommend that you illustrate why padding is a must, using a simple example: enciphering the value of a dice throw, or the name of a classmate. Without padding, regardless of public exponent, that's entirely insecure (because anyone can test all few possible values to ascertain the right one). That's fixed with a simple random padding, where random bits or digits are added on the left of what's enciphered before exponentiation, and removed at decryption. With enough of such random padding, any valid public exponent is believed to be just fine (we have no proof, for that simple padding).
Jan
4
comment Uniformly distributed secure floating point numbers in [0,1)
There is the detectable characteristic (which conceivably could be an issue in some applications) that for the subset of the numbers x < 0x1p-32, the quantity x * 0x1p64 is more regularly spaced than expected for an ideally random double x in rang [0,1). In particular, for IEEE 754 double-precision floats and n<=64, x * 0x1p64 will always be an exact multiple of 1<<(64-n).
Jan
4
comment Why does DES implement so much Cross Wiring?
I have written a rebuttal of your guess.
Jan
3
comment NIST PRIMES - cryptography
The notation $a\equiv b\pmod p$ simply means that $a-b$ is a multiple of $p$. Thus for $p =\text{P-192}=2^{192}-2^{64}-1$, it holds that $2^{192}\equiv2^{64}+1\pmod p$ simply because $2^{192}-(2^{64}+1)$ is that $p$, thus is a multiple of that $p$. To prove that $2^{256}\equiv2^{128}+2^{64}\pmod p$ or $2^{320}\equiv2^{128}+2^{64}+1\pmod p$ you just need to apply that definition, and do simple algebra.