2,852 reputation
1022
bio website
location
age
visits member for 3 years, 3 months
seen 12 hours ago

Nov
19
comment Do data-dependent rotations have any advantage over fixed rotations?
Probably. Analysis is still more difficult on data-dependent rotations, and so it may be wise to assume the attacker can force them to have no difference. This is especially the case in hash functions, where the attacker controls almost everything; here's an example. When assuming no differences in the rotations, fixed rotations start to seem like the better choice.
Nov
19
answered Do data-dependent rotations have any advantage over fixed rotations?
Nov
9
awarded  Enlightened
Nov
9
awarded  Nice Answer
Oct
30
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
Nevermind, I was assuming you had direct access to the points on the twist. Here you cannot use plain rho.
Oct
30
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
The complexity for kangaroo is slighly different when taking the negation map into account. You can use rho in this situation, though, like you would in Pohlig-Hellman.
Oct
30
comment What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
$\log(\pi/4 l)/\log(4) = \log(\sqrt{\pi/4 l})/\log(2) = \log(\sqrt{\pi l / 2} / \sqrt{2})/\log(2)$. It's the usual Pollard rho complexity with the negation map taken into account.
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 5 characters in body
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 12 characters in body
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 12 characters in body
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 154 characters in body
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 50 characters in body
Oct
29
revised Understanding Twist Security with respect to short Weierstrass curves
added 223 characters in body
Oct
29
answered Understanding Twist Security with respect to short Weierstrass curves
Oct
7
awarded  Revival
Aug
23
awarded  Enlightened
Aug
23
awarded  Nice Answer
Aug
22
awarded  Yearling
Aug
18
answered SRP-6 vulnerabilities when N is small
Aug
15
comment Subverting the key generation step in RSA public key cryptography
This method subverts the RSA public key in several ways, one of which is by embedding part of the secret prime in the modulus itself. The rest can be recovered in polynomial time.