Reputation
3,707
Top tag
Next privilege 4,000 Rep.
Access 'trusted user' tools
Badges
12 26
Newest
 Enlightened
Impact
~44k people reached

  • 0 posts edited
  • 2 helpful flags
  • 554 votes cast
Jul
22
revised Logjam-style attack on Factoring?
added 33 characters in body
Jul
22
answered Logjam-style attack on Factoring?
Jul
17
awarded  Enlightened
Jul
17
awarded  Nice Answer
Jun
13
answered Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?
Jun
11
comment RSA public key recovery from signatures
Vanilla Python will likely be too slow here. Instead, try Sage or, if you do not want a gigantic package, use gmpy to use GMP for the arithmetic. It will be much faster than Python's native quadratic algorithms.
Jun
10
comment RSA public key recovery from signatures
With $e=3$ it should be nearly instantaneous---the $\gcd$ of two $1536$-bit numbers is pretty cheap. $e = 65537$ takes around 30 seconds in my machine.
Jun
8
answered RSA public key recovery from signatures
Jun
5
revised Why does anyone use elliptic curves for a CSPRNG?
added 27 characters in body
Jun
5
answered Why does anyone use elliptic curves for a CSPRNG?
May
24
revised Logjam on Elliptic Curves?
Fix formula
May
23
comment Logjam on Elliptic Curves?
The first logarithm requires $\sqrt{\pi n / 2} / 2^k$ storage, where $k$ is, as above, the number of bits defining a distinguished point. For a 256-bit curve, your $2^{60}$ storage bound implies $k \ge 68$, since that is the amount of storage needed for a single discrete log. Bernstein and Lange suggested (eprint.iacr.org/2012/318) $k = 86$ and a precomputation of $2^{86}$ distinguished points---at a cost of $2^{172}$---making individual logarithms computable with $2^{86}$ effort. Reducing $k$ greatly increases the amount of work; I doubt $2^{30}$ speedup would be achievable.
May
23
revised Logjam on Elliptic Curves?
added 83 characters in body
May
23
answered Logjam on Elliptic Curves?
May
8
awarded  Revival
May
7
answered Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core
May
7
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Thanks, changed. Also added a note stressing the importance of padding.
May
7
revised How is HMAC(message,key) more secure than Hash(key1+message+key2)
Stress the importance of padding; edited body
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Correct; that applies to the version without the $10^t$ padding. Yasuda notes: "We note that it is the lack of appropriate filling between the message M and the last key K, rather than the usage of a single key, that contributes to this key recovery attack."
May
6
comment How is HMAC(message,key) more secure than Hash(key1+message+key2)
Being the envelope MAC was the point! A single key is enough to be secure, though two independent keys are also fine.