Samuel Neves
Reputation
4,287
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
 Jun 10 comment RSA public key recovery from signatures With $e=3$ it should be nearly instantaneous---the $\gcd$ of two $1536$-bit numbers is pretty cheap. $e = 65537$ takes around 30 seconds in my machine. Jun 8 answered RSA public key recovery from signatures Jun 5 revised Why does anyone use elliptic curves for a CSPRNG? added 27 characters in body Jun 5 answered Why does anyone use elliptic curves for a CSPRNG? May 24 revised Logjam on Elliptic Curves? Fix formula May 23 comment Logjam on Elliptic Curves? The first logarithm requires $\sqrt{\pi n / 2} / 2^k$ storage, where $k$ is, as above, the number of bits defining a distinguished point. For a 256-bit curve, your $2^{60}$ storage bound implies $k \ge 68$, since that is the amount of storage needed for a single discrete log. Bernstein and Lange suggested (eprint.iacr.org/2012/318) $k = 86$ and a precomputation of $2^{86}$ distinguished points---at a cost of $2^{172}$---making individual logarithms computable with $2^{86}$ effort. Reducing $k$ greatly increases the amount of work; I doubt $2^{30}$ speedup would be achievable. May 23 revised Logjam on Elliptic Curves? added 83 characters in body May 23 answered Logjam on Elliptic Curves? May 8 awarded Revival May 7 answered Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core May 7 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) Thanks, changed. Also added a note stressing the importance of padding. May 7 revised How is HMAC(message,key) more secure than Hash(key1+message+key2) Stress the importance of padding; edited body May 6 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) Correct; that applies to the version without the $10^t$ padding. Yasuda notes: "We note that it is the lack of appropriate filling between the message M and the last key K, rather than the usage of a single key, that contributes to this key recovery attack." May 6 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) Being the envelope MAC was the point! A single key is enough to be secure, though two independent keys are also fine. May 6 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) OK, changed it to a less confusing formula, that matches Yasuda's paper. May 6 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) $1$, followed by enough $0$s to pad out to block length. I think it should be intelligible now? May 6 revised How is HMAC(message,key) more secure than Hash(key1+message+key2) Use Yasuda's notation May 6 comment How is HMAC(message,key) more secure than Hash(key1+message+key2) Right, I got the message padding wrong. Fixed now. May 6 revised How is HMAC(message,key) more secure than Hash(key1+message+key2) added 1 character in body May 6 answered How is HMAC(message,key) more secure than Hash(key1+message+key2)