Reputation
1,665
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 26
Impact
~70k people reached

  • 0 posts edited
  • 0 helpful flags
  • 155 votes cast
Sep
28
comment For Diffie-Hellman, must g be a generator?
@Thomas: Improved attacks could also kill DH (or require parameter adjustments). I guess I'm trying to advocate that authors of cryptographic content stop saying (for example) "factoring large integers is impossible" and instead say "there is no publicly-known efficient factoring algorithm on conventional computers". Although I suppose it can get tiresome after a while. Nonetheless, I'm very careful to say the latter when teaching.
Sep
28
comment For Diffie-Hellman, must g be a generator?
Implied in all of the above is "according to current cryptanalysis". The parameters above are a function of (1) our current computing model and (2) our current state of knowledge.
Sep
27
comment Is modern encryption needlessly complicated?
@Ivo: DES was regarded as "broken" upon release (due to key length); 3DES is still secure (but painfully slow); if you know an attack, please post it. 3DES has an effective key length of at least 110 bits. When I said that DES has never been broken, I mean the construction, not the parameter set.
Sep
27
comment In RSA, do I calculate d from e or e from d?
In general, I would trust this site for crypto more than wikipedia since things are vetted here pretty much immediately after they're written.
Sep
27
comment How to fairly select a random number for a game without trusting a third party?
Another fix is to require the number of random bits be higher than (say) 256, and disallow repeated digests. Or better, to force the 2nd publisher of a repeated digest to reveal first (better because it allows you conclusively identify cheaters).
Sep
22
comment Accelerating SHA-1
@fgrieu: Is there a way to see if I'm having cache misses and how much they're costing me?
Sep
22
comment Accelerating SHA-1
@Thomas: reducing my buffer results in no difference in runtime; I'm not sure why you think L1 cache matters here since we process data exactly once (I'm running SHA1 over an 8GiB file).
Sep
22
comment Accelerating SHA-1
@jug: I've never heard this before (that Intel is quite a bit faster on a single core)... can you point me at a reference for this? I'd like to see if switching hardware would help.
Sep
21
comment Accelerating SHA-1
@jug: I did find that link, which is what led me to updating to the latest OpenSSL. Unfortunately, it was no faster.
Sep
21
comment Accelerating SHA-1
@Samuel: I'm processing a single incoming stream arriving at 5Gbps from the network and I'm currently bottlenecked by SHA-1 at 2.6Gbps; you're right that SIMD is useful: the XMM and YMM registers are part of the SSE(1-4) instructions which are already used in the OpenSSL code.
Sep
20
comment Accelerating SHA-1
Thomas: the authors of the paper I cite in my answer claim that a GPU does help. But they talk about "SSL flows" so perhaps they are inducing parallelism this way?!
Sep
20
comment Accelerating SHA-1
@fgrieu: I'm hashing 128KiB at a time via SHA_Update (OpenSSL) in a tight read loop. I need a hash for the entire file, so I cannot run hash invocations in parallel (since SHA1 needs the previous chaining value to start computing the next).
Sep
20
comment Accelerating SHA-1
I have some latitude with the protocol... you're thinking to hash separately on multiple cores?
Sep
19
comment Converting a stream cipher into a block cipher
I'm asking out of general interest; to me it's interesting if one primitive can be efficiently converted to the other.
Sep
4
comment Is modern encryption needlessly complicated?
Modern crypto is needlessly complicated; but not because of the (simple) primitives like RSA, DES, and AES. It's universality composability and ZKPs that are the problem.
Sep
2
comment What is the sign bit for in Feige-Fiat-Shamir?
In HAC, 10.26 step b (p. 410) the authors claim that the sign is required to avoid leaking information. I can only guess that this information is the fact that $I_j$ is a square, which seems to not really be very useful (after all, you can't take the square root!). A simulator could produce this same distribution, right? Just generate a random square.
Sep
2
comment What is the sign bit for in Feige-Fiat-Shamir?
Hm, I'd never heard of "unrestricted input" ZK before. But in the excerpt you quoted above, FFS say that we must have our $I_j$ range over all Jacobi symbol +1 values for ZKPs of knowledge. They don't mention "unrestricted input" (perhaps they have some definition of ZK that requires it I guess).
Sep
2
comment What is the sign bit for in Feige-Fiat-Shamir?
It's more than this. The FFS scheme equiprobably multiplies each $1/S_i^2$ by -1 or 1. Since -1 is a non-square with Jacobi symbol 1 (because $n$ is a Blum integer), this preserves the Jacobi symbol while expanding the range of values produced. I don't know why they do this (and the wikipedia version doesn't do it at all).
Sep
1
comment What is the sign bit for in Feige-Fiat-Shamir?
The section you cite seems to be a (slightly) different scheme from the one cited in wikipedia (the wikipedia entry doesn't even contain the $I_j$'s; I wonder if it's correct?!)
Sep
1
comment Should we MAC-then-encrypt or encrypt-then-MAC?
Also see the unpublished paper at citeseerx.ist.psu.edu/viewdoc/…