Samuel Neves
Reputation
3,222
Top tag
Next privilege 3,500 Rep.
Protect questions
 Dec5 revised counting points on elliptic curve added 4 characters in body Dec5 revised counting points on elliptic curve added 3 characters in body Dec5 revised counting points on elliptic curve added 70 characters in body Dec5 answered counting points on elliptic curve Dec4 comment Keyed digest function with odds of collision below the birthday bound? Are you aware of any attempt to invert such permutations faster than brute-force? First step would probably be to distinguish the polynomial system from random. Nov26 answered Adding and multiplication in jacobian coordinates Nov21 comment When using Curve25519, why does the private key always have a fixed bit at 2^254? It is true that the reference code protects against this by starting with $(P, \infty)$; however, every textbook displays the version I described, so there's a good chance that an independent implementer could make that mistake. Setting that bit to 1 is a preventive measure that costs almost nothing. Nov20 answered When using Curve25519, why does the private key always have a fixed bit at 2^254? Nov20 answered Why does the crypto_box functionality in NaCl library exposes the nonce to the programmer Nov8 comment What is so special about elliptic curves? A sphere ($x^2 + y^2 + z^2 = 1$) would still not be secure; however, if you intersect two quadric surfaces (i.e. surfaces defined by quadratic polynomials) you actually can get a secure curve, which --- guess what --- is actually an elliptic curve! The Jacobi intersection curves are an example of this. Nov5 awarded Nice Answer Nov5 answered What is so special about elliptic curves? Oct30 awarded Civic Duty Oct3 revised How should I interpret this note on diffusion of the internal state of a PRNG? added 68 characters in body Oct3 answered How should I interpret this note on diffusion of the internal state of a PRNG? Sep19 comment Is the inverse of a secure PRP, also a secure PRP? The stronger concept of sPRP (e.g., 4-round Feistel with PRF) implies that the inverse is secure as well --- an sPRP allows the attacker to query both the permutation and its inverse. Sep15 comment What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator? This article may be helpful: eprint.iacr.org/2011/007 The short story is that given MWC output, it's fairly easy to recover internal state and do all kinds of bad things from there. Aug22 awarded Yearling Aug1 comment What exactly is the base for the KECCAK (SHA3) claim that a security strength of 256 bits is “post-quantum sufficient”? It is also worth noting that both the Grover and Brassard-Hoyer-Tapp algorithms for quantum search and collision finding are essentially optimal, i.e., they match the asymptotic known lower-bounds. Jul31 comment Practical consequences of using functional encryption for software obfuscation There's nothing practical about that paper. Notice the use of multilinear maps and fully homomorphic encryption. I suspect this will only be practical when FHE is also practical.