1,824 reputation
18
bio website
location
age
visits member for 1 year, 1 month
seen yesterday

Mar
19
comment How do the following new (2013) ECC curves compare in security or efficiency?
arxiv.org/abs/quant-ph/0301141
Mar
19
comment How do the following new (2013) ECC curves compare in security or efficiency?
Quantum computers can compute d.logs. on all of these curves. "Post-quantum" they have no security.
Mar
19
comment Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
This is reasonably correct. One quibble: Can $h_1g_1^{-1}$ and $h_2 g_2^{-1}$ be different?
Mar
18
answered Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
Mar
18
comment How do the following new (2013) ECC curves compare in security or efficiency?
"post-quantum"?
Mar
16
answered Should different key pairs be used for signing and encryption?
Mar
16
comment Elliptic Curves of different forms
The emphasis placed on "easy" is justified. People have an amazing ability to screw things up. Making it easier not to screw up is worthwhile. This is why we now have AEAD schemes instead of just encryption+MAC, etc., etc.
Mar
16
comment Elliptic Curves of different forms
Both. Modern curves are easier to implement correctly, and implementations are faster. No, I have no idea about implementations. Dan Bernstein probably has something sensible, but it may not be suitable for you.
Mar
16
comment How can I create an RSA modulus for which no one knows the factors?
A good place to start may be: Carmit Hazay, Gert Læssøe Mikkelsen, Tal Rabin, Tomas Toft: Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting. CT-RSA 2012: 313-331.
Mar
16
answered Elliptic Curves of different forms
Mar
6
answered Secure Broadcast Channel
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
Quantum computers suitable for running Shor's algorithm are still stuck at six qubits or so. Post-quantum cryptography is certainly interesting as a research topic, but compared to all the real threats you face today you should give it low priority.
Mar
4
comment GCM vs CTR+HMAC tradeoffs
Polynomial evaluation can be computed in parallel.
Mar
4
answered Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?
Mar
3
answered Is it meaningful to consider the leakage of master key of KGC?
Mar
3
reviewed Approve suggested edit on What RC4 key value will completely invert $S$ after initial permutation?
Mar
3
comment IND-CPA Security
Why didn't you mention that before? I can't be bothered looking up the details of the KDF, but for any reasonable KDF the answer is yes.
Mar
1
comment IND-CPA Security
If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs?
Feb
28
comment IND-CPA Security
What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ...
Feb
24
comment Using ECDSA keys for encryption
I agree that using ECIES and ECDSA with the same key is probably safe, but that you shouldn't do it. About provability: I don't think a proof of security for ECDSA is known (not counting generic group model proofs). A proof of joint security would imply a proof of ECDSA security, so we can't expect such a joint proof. Probably you could prove that the ECDSA signing oracle doesn't break ECIES if you only sign each message once.