Reputation
13,955
Next tag badge:
129/100 score
18/20 answers
Badges
3 34 73
Newest
 Nice Answer
Impact
~328k people reached

Nov
28
comment Design properties of the Rijndael finite field
I just looked in the book (The design of Rijndael), and the description of the SubBytes step (section 3.4.1, pages 34-37) doesn't contain much more information than what is in the specification linked (but said in more words).
Nov
28
revised Design properties of the Rijndael finite field
formatting
Nov
28
reviewed Approve Is a book cipher provably secure?
Nov
28
revised Unpredictability of X.509 serial numbers
edited tags
Nov
28
revised Should we MAC-then-encrypt or encrypt-then-MAC?
add information from comments
Nov
28
revised Should we MAC-then-encrypt or encrypt-then-MAC?
formatting (sorry Thomas, in English there is no space before `?`. Also, tags.
Nov
28
revised Should we MAC-then-encrypt or encrypt-then-MAC?
add links to the corresponding standards
Nov
27
answered AES and perfect ciphers
Nov
27
revised AES and perfect ciphers
formatting, adding commas
Nov
27
comment ElGamal message signatures retrieving the secret value x
Is this a homework task, or from where did you get this assertion?
Nov
27
comment How can one show that an ElGamal-like signature verification scheme is valid?
Your scheme is not the original ElGamal scheme, and I doubt that it is valid at all. First, ElGamal uses a hash of the message where you are using the message itself (which will make the scheme less secure, and only applicable for short messages, but verification should still work). Second, in the exponents of the verification you switched $s$ and $r$. Is this a typo (and you want actually a proof for the original ElGamal), or do you really search a proof for this modified scheme?
Nov
27
revised How can one show that an ElGamal-like signature verification scheme is valid?
formatting
Nov
26
comment Verilog simulation of Data Encryption Standard
What do you actually want to know? "Can I get help in understanding" is not really a good question.
Nov
26
comment What is pre-image resistance, and how can the lack thereof be exploited?
@Fixee: If we search an algorithm which attacks a block cipher with the given plaintext/ciphertext pairs, then there is (usually) just one correct key, so the algorithm which just outputs this key would be quite simple (and O(1)) and correct, too (assuming a key-finding algorithm, not a distinguishing one). But no: We want an algorithm (for a given cipher) which takes the plaintext/ciphertext pairs as input, and works for any such set of plaintext/ciphertext pairs, not just for a specific one. Analogously, I want a preimage finding algorithm which works for any hash given as input.
Nov
26
comment How does the wider cryptographic community view non-abelian group based cryptography?
Thanks for the link, I now understand what you mean here. As far as I can see, often the actual group used is not the secret in group-based protocols (like Diffie-Hellman, ElGamal, DSA), so I don't see how it would be problematic that there are not so many different ones. (In RSA, we are not actually using a single group.)
Nov
26
comment How does the wider cryptographic community view non-abelian group based cryptography?
Do you have any link or other reference to the Coincident Group Orders Theorem? I have never heard it before, and Google finds just this question.
Nov
23
comment How can I create a fixed length output in my hash function?
We had a conversation in chat to help to understand the answers.
Nov
23
comment Advanced Access Content System (AACS) and Subset Difference techniques for Broadcast Encryption
Welcome to Cryptography Stack Exchange. We actually prefer answers which contain the information itself, not only a web link. Could you add a summary of the information to the answer? Otherwise we will convert your answer to a comment.
Nov
23
revised How can I create a fixed length output in my hash function?
add a paragraph to show how this limits the output size
Nov
23
comment Using a Non-Random IV with modes other than CBC
To say it shorter: A mode is affected if the IV touches the plaintext before encryption (and after decryption), and not directly affected (but needs the uniqueness) if IV and plaintext are separated by encryption.