3,412 reputation
1519
bio website
location United States
age
visits member for 2 years, 9 months
seen 15 mins ago

22s
comment RSA with modulus n=p²q
More generally, one could also use moduli of the form $\; p^{\hspace{.03 in}j} \hspace{-0.02 in}\cdot q^{\hspace{.02 in}k} \;$ for coprime $j$ and $k$. $\hspace{1.28 in}$ Also, one could make the operations actual permutations by computing Lcm(x,N) and sending x to Lcm*((n/Lcm)^e mod N/Lcm). $\;\;\;\;\;\;\;\;$
1h
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
What padding do they use? $\:$ How many possible plaintexts are there? $\;\;\;\;$
4h
comment Lowest number challenge scheme
@owlstead : $\:$ "If you always run both of them," you'd be revealing whether or not $\:a=b\;$. $\hspace{.98 in}$
5h
comment RSA with modulus n=p²q
One could also use moduli of the form $\; p^{\hspace{.035 in}j} \hspace{-0.02 in}\cdot q^{\hspace{.02 in}k} \;$ for coprime $j$ and $k$. $\;\;\;\;$
7h
comment Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
I mean that it might be easy to modify a single ciphertext so that whether or not the decryptor rejects depends in a predictable-and-useful way on what the message was. $\:$ (That is not beyond "what MAC-then-encrypt in general allows".) $\;\;\;\;$
7h
comment Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
We "care if the ciphertext has been altered" because it might be easy to modify a single ciphertext so that whether or not the decryptor rejects depends in a predictable-and-useful way on what the message was. $\;$
7h
comment Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?
In addition to possibly allowing chosen-ciphertext attacks, it may even be malleable. $\hspace{1.3 in}$
9h
revised How can I solve this modular equation?
fixed punctuation and grammar
12h
comment Lowest number challenge scheme
@fkraiem : $\;\;\;$ How would that work? $\:$ Any use of that paper that I can think of would leak $\hspace{.83 in}$ which side a tie would have been broken in favor of. $\;\;\;\;\;\;\;$
1d
revised Publicly Verifiable Authenticator
fixed repeated misspellings and improved punctuation and grammar
1d
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
How long is the message? $\;$
1d
comment Lowest number challenge scheme
@Seth : $\;\;\;$ It's at least approximately that problem. $\:$ If ties are supposed to be broken at random, $\hspace{.41 in}$ then this question's problem may be more difficult. $\;\;\;\;\;\;\;$
1d
comment Allowing multiple password reset tokens, and a question on random number predictability
This is quite clever. $\:$ On the other hand, it requires that the reset component have access to the password-hash component, which would stop one from isolating the latter. $\:$ Related to that, RNG does matter, since if the token validity period is decreased by the same amount of time as passed between two token requests by the same user, then an eavesdropper on however the tokens were sent can tell whether or not the same password-salt combination was reused. $\;\;\;\;$
1d
comment Allowing multiple password reset tokens, and a question on random number predictability
What is r? $\;$
1d
comment Is there a generic attack on encrypted CRC32 when used as a MAC?
@fgrieu : $\:$ Is there such an attack when the hash goes before the plaintext? $\;\;\;\;$
1d
answered Is there a generic attack on encrypted CRC32 when used as a MAC?
2d
comment Allowing multiple password reset tokens, and a question on random number predictability
I'm less suited to address the follow-up to (4) than a large number of other users on this site; I also think that should be a separate question (though perhaps mentioning this application). $\:$ The RFC on UUIDs states that "The requirements for" name-based "UUIDs are as follows: The UUIDs generated at different times from the same name in the same namespace MUST be equal. ...". $\;\;\;\;$
2d
answered Allowing multiple password reset tokens, and a question on random number predictability
2d
comment Security equivalent to Diffie–Hellman problem?
This assumes the group's order is known. $\:$ Also, if the group's order is a composite with a small factor and $b$ is chosen to be a unit modulo it, then as far as I can see this only gives a complexity-theoretic equivalence rather than a cryptographic equivalence. $\;\;\;\;$
Jul
16
revised Security Model of Group Key Transfer Protocols
improved grammar