Reputation
4,287
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
16 29
Newest
 Enlightened
Impact
~59k people reached

  • 0 posts edited
  • 2 helpful flags
  • 581 votes cast
Apr
23
comment Benchmarks for second round CAESAR competitors
I expect it to go like ChaCha{12,20}-Poly1305 -> NORX6441 -> Lake Keyak, going from fastest to slowest and considering the recommended variants of each on common x86 processors.
Apr
22
comment Benchmarks for second round CAESAR competitors
No, not really. eBACS is eventually going to be the place for such benchmarks, but not right now.
Apr
22
comment Integer factorization still hard with Hamming weight hypothesis?
@poncho Your combinatorial solution looks a lot like the algorithm from Heninger and Shacham.
Apr
17
comment A bijective hash function
Related question: crypto.stackexchange.com/questions/11576/…
Apr
15
awarded  Enlightened
Apr
15
awarded  Nice Answer
Mar
29
comment Could a strong round function be immune to slide attacks
I suppose I did misunderstand your question. I just added a couple of paragraphs addressing (I hope) the question.
Mar
29
revised Could a strong round function be immune to slide attacks
added 777 characters in body
Mar
29
answered Could a strong round function be immune to slide attacks
Feb
14
reviewed Approve What happens to NORX if the same (key, nonce, header data) triple is reused
Feb
13
answered What happens to NORX if the same (key, nonce, header data) triple is reused
Feb
4
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@poncho Perhaps better than picking a 64-bit prime factor for $p-1$ would be to pick a set of high prime powers. Say, $p-1 = 2^i 3^j 5^k$. This would still ensure instant discrete logs with Pohlig-Hellman, but no regular usage of $p-1$ factoring would be able to get at it. You could even make one of the prime factors of $p-1$ be, e.g., $(2^{32}-c)^{16}$ for good measure.
Feb
3
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
As long as the order of the multiplicative group order of each factor $p_i^{e_i}$ is smooth, i.e., whether $p_i^{e_i - 1}(p_i - 1)$ is smooth, Pohlig-Hellman will work quickly. The factors themselves can be arbitrarily large. But this cannot be the case, otherwise the number would be easily factorable with the $p-1$ method.
Jan
21
comment Are there any successful preimage attacks?
Maraca had a pretty catastrophic preimage attack. On the more theoretical side, MD2, MD4, and Snefru have known preimage attacks.
Jan
6
awarded  Nice Question
Dec
2
awarded  Enlightened
Dec
2
awarded  Nice Answer
Nov
30
comment Cryptographic operations for NISTP256 can be implemented using montgomery method?
The Montgomery ladder does exist for any group. What is not doable is to work with P-256 in Montgomery coordinates, since as @abejoe correctly points out, Montgomery curves are necessarily of order divisible by 4.
Nov
28
revised Help understanding basic Franklin-Reiter related message attack
deleted 9 characters in body
Nov
28
answered Help understanding basic Franklin-Reiter related message attack