Paŭlo Ebermann
Reputation
15,358
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
 Dec 13 revised ElGamal: Multiplicative cyclic group and key generation formatting, some more details Dec 13 comment ElGamal: Multiplicative cyclic group and key generation ElGamal-like schemes can be used also with other groups than the standard "Integers modulo prime" group, where some more information might be necessary. Dec 13 revised Definition of Textbook RSA some minor additions (and formatting) Dec 12 comment What is the importance of Modular arithmetic in cryptography? @mikeazo: One could say that all ciphers can be defined in terms of bits, i.e. they use mod-2-arithmetic. But I suppose this is not what you mean :-) Dec 11 comment RSA-based authentication and key-agreement protocol What about TLS with client certificates? Or SSH with public-key authentication? Dec 11 revised Are there two known strings which have the same MD5 hash value? tags, title Dec 11 answered Are there two known strings which have the same MD5 hash value? Dec 11 comment Are there two known strings which have the same MD5 hash value? Welcome to Cryptography Stack Exchange. Your question was migrated here because of being not directly related to software development (the topic of Stack Overflow), and being fully on-topic here. Please register your account here, too, to be able to comment. Dec 11 comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? Nice summary of the comments to the other answer, thanks. Dec 10 comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? @fgrieu (Both @Paŭlo and @Paulo work to ping me ... just use whatever the auto-completion proposes, or what is more easy for you to type.) I think this depends on the definition of collision for a compression function - if every $c(x_1,y_1) = c(x_2,y_2)$ with $(x_1, y_1) \neq (x_2, y_2)$ counts, then there really must be some collision in $c$ (or a "tail-of-message" with a preimage to $I$, as mentioned before). And this seems to be the idea of the proof in the answer. (Of course there must exist some collisions, the problem is just how to find them.) Dec 10 comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? @fgrieu I think the point is that we want to avoid ABCD to hash to the same thing as XYZABCD (each letter being one block), when the internal state after hashing XYZ is the initialization vector again. This would be the "running out of blocks" mentioned there. The simple 10000... padding would do nothing here, it just helps against the simplest appending attacks. Dec 10 comment Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? @fgrieu: It was not my answer, I only edited it to add formatting (and an explicit example for Merkle-Damgard). I hope I didn't destroy anything by doing this. The necessary of encoding the message length in the padding is mentioned in the last paragraph, but could be explained in more detail. Dec 10 revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? formatting, and example for the Merke-Damgard construction Dec 10 revised Why does the padding in Merkle–Damgård hash functions like MD5 contain the message length? formatting, spelling, tags, title Dec 10 revised Is it safe to store initial counter value for AES-CTR alongside with ciphertext? edited tags Dec 10 comment Is it safe to store initial counter value for AES-CTR alongside with ciphertext? One could generate the nonce together with the key from some password and salt (or from a key exchange algorithm's shared secret), and then not transfer it explicitely. Dec 10 revised Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function? formatting Dec 10 comment Does hash_df use binary or an ASCII hexadecimal representation for numbers to be passed to the hash function? New users have to wait 8 hours before answering their own question. This is intended to prevent question clarifications as answers, but sometime also hits innocent users. Just get to 100 rep and this limitation will be lifted. Dec 10 revised Random oracle model proofs and programmability typo (P instead of V) Dec 9 comment Demonstrating the insecurity of an RSA signature encoding scheme Have a look at the corresponding verifying scheme. Can you find a number, which, when taken to the power $e$ (the public exponent), gives something in this encoding? (This depends on the public key, but assume it it something like $3$.)