2,612 reputation
719
bio website
location
age
visits member for 2 years, 11 months
seen 23 hours ago

Nov
26
answered Adding and multiplication in jacobian coordinates
Nov
21
comment When using Curve25519, why does the private key always have a fixed bit at 2^254?
It is true that the reference code protects against this by starting with $(P, \infty)$; however, every textbook displays the version I described, so there's a good chance that an independent implementer could make that mistake. Setting that bit to 1 is a preventive measure that costs almost nothing.
Nov
20
answered When using Curve25519, why does the private key always have a fixed bit at 2^254?
Nov
20
answered Why does the crypto_box functionality in NaCl library exposes the nonce to the programmer
Nov
8
comment What is so special about elliptic curves?
A sphere ($x^2 + y^2 + z^2 = 1$) would still not be secure; however, if you intersect two quadric surfaces (i.e. surfaces defined by quadratic polynomials) you actually can get a secure curve, which --- guess what --- is actually an elliptic curve! The Jacobi intersection curves are an example of this.
Nov
5
awarded  Nice Answer
Nov
5
answered What is so special about elliptic curves?
Oct
30
awarded  Civic Duty
Oct
3
revised How should I interpret this note on diffusion of the internal state of a PRNG?
added 68 characters in body
Oct
3
answered How should I interpret this note on diffusion of the internal state of a PRNG?
Sep
19
comment Is the inverse of a secure PRP, also a secure PRP?
The stronger concept of sPRP (e.g., 4-round Feistel with PRF) implies that the inverse is secure as well --- an sPRP allows the attacker to query both the permutation and its inverse.
Sep
15
comment What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?
This article may be helpful: eprint.iacr.org/2011/007 The short story is that given MWC output, it's fairly easy to recover internal state and do all kinds of bad things from there.
Aug
22
awarded  Yearling
Aug
1
comment What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”?
It is also worth noting that both the Grover and Brassard-Hoyer-Tapp algorithms for quantum search and collision finding are essentially optimal, i.e., they match the asymptotic known lower-bounds.
Jul
31
comment Practical consequences of using functional encryption for software obfuscation
There's nothing practical about that paper. Notice the use of multilinear maps and fully homomorphic encryption. I suspect this will only be practical when FHE is also practical.
Jul
15
answered What prevents continued hashing of a key from being used as a cipher when xored with plaintext?
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
The classical attack on the original 1978 parameters of McEliece is hardly evidence of weakness of the scheme. In comparison, RSA key size was originally proposed to be 200 digits (665 bits), and estimated to take billions of years to factor.
Jul
6
comment Snowden Challenge II: Can we solve Snowden challenge quantumly?
There are known quantum computer-resistant asymmetric cryptosystems out there (e.g., McEliece). Look up "post-quantum cryptography".
Jun
29
comment inverse problem about scalar multiplication on elliptic curve
You can recover $P$ by computing $(n^{-1} \bmod l)\cdot Q$, where $l$ is the order of $Q$.
Jun
1
comment Complex Numbers on Elliptic Curves & Usage in Tate Pairing
Watson is correct. Here's the example you mention spelled out in Sage.