1,744 reputation
8
bio website
location
age
visits member for 11 months
seen 13 hours ago

Jan
30
answered Derive both MAC and AES keys from same PBKDF2?
Jan
12
revised Difference between CBC-MAC and CMAC
added 110 characters in body
Jan
12
answered Difference between CBC-MAC and CMAC
Jan
9
answered Why does DSS have such formulas?
Jan
6
awarded  Custodian
Jan
6
reviewed Approve suggested edit on How does Clifford Cocks 'Non-Secret Encryption' work?
Dec
27
comment EC ElGamal versus static+ephemeral ECDH
ElGamal is a DH key exchange where the recipient has a fixed DH message (the public key), and the key is used to encrypt the message using a one-time shift cipher. ECIES is a DH key exchange where the recipient has a fixed DH message (the public key), and the key is used to encrypt the message using a secure one-time symmetric cryptosystem.
Dec
19
comment Are those two distributions indistinguishable?
It's Decision composite residuosity problem. And it's not about deciding if a square root exists, but if an $N$th root exists.
Dec
18
comment Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
Just to add to the above comment: This means you don't have to verify that strings represent group elements, which is typically costly. Protocols that omit this step without other countermeasures have been broken.
Dec
12
awarded  Student
Dec
11
comment Pohlig-Hellman exponentiation block cipher
There are many possible ways to define CTR mode. But the "moral" idea is that the successor function should be easy to compute relative to the cost of computing the block cipher. Given $rg^{i-1}$, it is easy to compute $rg^i$. Given $g^{r^{i-1}}$, it is expensive to compute $g^{r^i}$. Also, this alternative is insecure, since it is easy to decide if an element is an $r$th power of some other element when you know $r$.
Dec
11
asked Pohlig-Hellman exponentiation block cipher
Dec
10
comment Slow one-way pseudo-random permutation?
Not a typo, just a mistake. Maybe six times a prime works...
Dec
10
comment Slow one-way pseudo-random permutation?
The d.log. problem on the curve reduces to the d.log. problem in $GF(p^2). Inverting the map is probably more expensive than computing it in the first place, but I don't know by how much. And doing many inversions is much cheaper per inversion than doing one inversion. It may not work better than just using a finite field with appropriate maps.
Dec
10
comment Slow one-way pseudo-random permutation?
Supersingular curves map into a finite field of twice the size, so in principle you could do index calculus in that field. But I wouldn't know how fast index calculus in that field would be compared to baby-step giant-step or Pollard $\rho$ in the subgroup.
Dec
10
comment Slow one-way pseudo-random permutation?
Let $p$ be a prime such that $p+1$ is twice a prime, $p-1$ is not divisible by $3$ and $-1$ is not a square. Consider the supersingular elliptic curve $Y^2 = X^3+1$ that has $p+1$ points. Fix some sign function $sg$ on the finite field. We can map any non-zero point $(x,y)$ to $sg(y)(x^3+1)$. Compose this map with the map $a \mapsto (a+1)P$ for some generator $P$, and you are done.
Dec
9
revised How well does breaking multiple DH key exchanges over the same group scale?
added 407 characters in body
Dec
9
comment Slow one-way pseudo-random permutation?
Maybe you could use supersingular curves to get something very close to a bijection? And perhaps you could use many such curves to make inversion more expensive?
Dec
8
answered How well does breaking multiple DH key exchanges over the same group scale?
Dec
6
comment Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
If you want non-malleable encryption, there are constructions for doing so (e.g. EME). But be aware that those schemes are only useful in very special cases. In general, they are inappropriate. Also, don't design or tamper with cryptosystems unless you know what you are doing.