12,262 reputation
32559
bio website paul-ebermann.tumblr.com
location Berlin, Germany
age
visits member for 2 years, 9 months
seen 15 hours ago

Don't fear to edit my posts: even if I have more reputation than you, I do make mistakes.

I'm now also a Moderator Pro Tempore (= until the first elections) at Cryptography Stack Exchange: feel free to come around and ask some cryptography questions.


My personal name is spoken as /ˈpawlo/ (IPA), in English this would be written similar to Powlo, I think (i.e. the vowels are ow and o), with an accent on the before-last syllable (which is the first in this case). It's the Esperanto form of my given name.

The photo shows my shadow, taken at night. My camera sometimes seems to forget all the other frequencies and only stores the green ones.

My current main private programming project is the game of fencing, an online abstract turn based strategy game. Implemented as a Java applet, using git as a version control system.


Some more links:


1d
comment ECDSA verification is too slow
Welcome to Cryptography Stack Exchange. Your question is far to unspecific for an answer to be possible. What means "too slow"? How long does a verification takes, with which software and on which hardware? Speeding it up depends on what you are doing. You might read a book about elliptic curve cryptography for some ideas – it comes down to fast multiplication in the base field, and fast combination of that to implement the curve operations. Please edit your question to make it more specific, then we might reopen it.
2d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
@curious Please use the edit button to include your additional requirements into the question. (And it would also be useful adding some context how this relates to cryptography, for now this looks like generic math.)
2d
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Every function between finite subsets of $\mathbb R$ can be represented by a polynomial (just use the Lagrange interpolation polynomial). I would guess this transfers to maps from $\mathbb Z_{N^2}^*$ to $\mathbb F$, even though that polynomial might not be the simplest possible one.
2d
comment How can I convert numbers into prime numbers?
Welcome to Cryptography Stack Exchange. From your answer, it seems like you have some more needs which are not clearly stated in the question. Maybe you could expand your question a bit?
2d
comment Using Stream Cipher as CSPRNG
@StephenTouset The "outputs won't repeat" distinguisher is not universal for stream ciphers, I think, just for counter mode block ciphers or similar stuff. E.g. if you use a stream cipher build from a PRF in CTR mode, it will repeat just as often as expected for a true random stream.
Apr
16
comment The relationship between the key length and encrypt time in Xor algorithm?
Could you elaborate a bit what your "encryption algorithm using the XOR method" is exactly? For an one-time pad, the key length should be as much as the message length, so I suppose you are using something with repeated key?
Apr
16
comment Is it possible to crack any MD5 hash?
Welcome to cryptography Stack Exchange. Could you please elaborate a bit what you mean with "any" and "crack"?
Mar
30
comment Why the need to hash before signing small data?
Hmm, while this corrects some mistakes in the question, it doesn't really answer the underlying question: Would ECDSA be safe for small messages if we omitted the hashing step?
Mar
26
comment How useful is NIST's Randomness Beacon for cryptographic use?
Actually, an insider potentially could know these strings even longer ahead, assuming a predictable internal source.
Mar
23
comment Questions about hash functions
It looks like this would contradict the meaning of "secure hash", but I'm not sure how to formally prove it from the usual hash properties (collision/preimage/second preimage resistance)
Mar
19
comment Difference RSA keypair creation openSSL and openPGP?
@humanityANDpeace If you think this answer answered your question, please use the check mark button beside it to mark it as "accepted".
Mar
17
comment Why does Openssh use only SHA1 for signing and verifying of digital signatures?
Actually, the list of registered key exchange method names contains some with SHA-256.
Mar
17
comment Why does Openssh use only SHA1 for signing and verifying of digital signatures?
There is a MAC algorithm spec for SHA-2 in RFC 6668.
Mar
17
comment Why does Openssh use only SHA1 for signing and verifying of digital signatures?
I suppose that most of the SSH protocol is older than SHA-2, and nobody bothered to add new key exchange algorithms with SHA-2 to it.
Mar
17
comment Hash Based Encryption (fast & simple), how well would this compare to AES?
This exact algorithm you are proposing was already discussed at Is SHA-256 secure as a CTR block cipher?.
Mar
15
comment counter to indicate hotp count
Your server still has to make sure that the counter number only ever goes upward, to avoid replay attacks.
Mar
15
comment Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password
You calculated the attackers worst case duration ... average case is half of this.
Mar
13
comment Why does SHA-1 have 80 rounds?
You are right, not every "round" function is a bijection. I generalized too much from AES here, I suppose.
Mar
13
comment Why does SHA-1 have 80 rounds?
In a block cipher, each round function is actually a bijection, and often the inverse is (almost) as easy to calculate as the original one. In hash functions based on block ciphers (like SHA-1 and SHA-2), it is the same.
Mar
10
comment What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?
It depends on the actually used cipher suite ... make sure it is not NONE, for example. Also, if you are just defining the protocol (i.e. no existing application to be compatible to), and don't have a highly performance critical or resource limited application, don't use SHA-1, use one of the SHA-2 variants instead in your HMAC.