Reputation
4,122
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
15 28
Impact
~54k people reached

  • 0 posts edited
  • 2 helpful flags
  • 581 votes cast
Feb
4
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
@poncho Perhaps better than picking a 64-bit prime factor for $p-1$ would be to pick a set of high prime powers. Say, $p-1 = 2^i 3^j 5^k$. This would still ensure instant discrete logs with Pohlig-Hellman, but no regular usage of $p-1$ factoring would be able to get at it. You could even make one of the prime factors of $p-1$ be, e.g., $(2^{32}-c)^{16}$ for good measure.
Feb
3
comment How does a non-prime modulus for Diffie-Hellman allow for a backdoor?
As long as the order of the multiplicative group order of each factor $p_i^{e_i}$ is smooth, i.e., whether $p_i^{e_i - 1}(p_i - 1)$ is smooth, Pohlig-Hellman will work quickly. The factors themselves can be arbitrarily large. But this cannot be the case, otherwise the number would be easily factorable with the $p-1$ method.
Jan
21
comment Are there any successful preimage attacks?
Maraca had a pretty catastrophic preimage attack. On the more theoretical side, MD2, MD4, and Snefru have known preimage attacks.
Jan
6
awarded  Nice Question
Dec
2
awarded  Enlightened
Dec
2
awarded  Nice Answer
Nov
30
comment Cryptographic operations for NISTP256 can be implemented using montgomery method?
The Montgomery ladder does exist for any group. What is not doable is to work with P-256 in Montgomery coordinates, since as @abejoe correctly points out, Montgomery curves are necessarily of order divisible by 4.
Nov
28
revised Help understanding basic Franklin-Reiter related message attack
deleted 9 characters in body
Nov
28
answered Help understanding basic Franklin-Reiter related message attack
Nov
6
answered Is there any reason not to use Single-Key EM with AES and a constant key?
Oct
24
answered How bad is it to use the identity function as hash for ECDSA?
Oct
18
comment What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?
Turtle's high-level structure is also known as the "Russian Dolls" construction, which was analyzed by Patarin and Seurin. It is secure, but requires a lot of key material (cf. §4).
Oct
14
awarded  Good Answer
Oct
13
comment Using a product of a series of curve25519 scalars as a private key
Yes; it is perfectly fine to multiply scalars together, but you will have to ensure implementation correctness yourself.
Oct
13
comment Using a product of a series of curve25519 scalars as a private key
Your other question regarding the higher bits is answered here.
Sep
8
revised Using same modulus for RSA
deleted 4 characters in body
Sep
8
answered Using same modulus for RSA
Sep
1
revised Edwards / Montgomery ECC with Weierstrass Implementation?
added 27 characters in body
Sep
1
revised Edwards / Montgomery ECC with Weierstrass Implementation?
added 20 characters in body
Sep
1
answered Edwards / Montgomery ECC with Weierstrass Implementation?