Reputation
4,932
Next tag badge:
51/100 score
30/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~47k people reached

Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell : $\;\;\;$ "is usually fine" in the sense of "won't be a problem as long as its relatively prime to phi". $\:$ However, if the primes are chosen randomly (rather than specifically to let e=3 work), then 3 would be relatively prime to phi only about 1/4 of the time. $\:$ (So, in that sense, it's not usually fine.) $\;\;\;\;\;\;\;\;$
Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell : $\;\;\;$ I'm referring to a hypothetical step in which the key generation algorithm would check the length of d. $\:$ What is "this"? $\:$ If key generators had such a step, then it would certainly change the distribution of public keys. $\:$ Whether that change makes a difference would depend on the rejection criteria for d. $\;\;\;\;\;\;\;\;$
Jul
9
answered PK systems using groups in practice
Jul
8
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell : $\:$ I mean "the key generation algorithm detecting" that the smallest $d$ is (too) small and thus not outputting that key-pair. $\;\;\;\;$
Jul
8
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell : $\;\;\;$ (I don't know anything about that attack, but) I got the impression from j.p.'s comment that the attack works whenever the smallest $d$ is (too) small. $\:$ Using $\phi(n)$ instead of $\lambda(n)$ wouldn't let the key generation algorithm detect that. $\;\;\;\;\;\;\;\;$
Jul
8
comment RSA algorithm assignment
What endianness does that use? $\;$
Jul
8
comment Is this a secure method of encrypting with authentication?
(... continued) $\:$ I suppose you might regard that as "effectively accomplish"ing defense against surreptitious forwarding, but one way to actually defend against that is "including the intended recipient's public key" and the recipient's identity (and the message) in the signature, as a tuple rather than via concatenation (since its entries are not fixed-length). $\;\;\;\;$
Jul
8
comment Is this a secure method of encrypting with authentication?
What do you mean by "and then again as a function of their private key"? $\:$ For adversarial public keys generated as I described, the adversary won't be able to decrypt messages sent to its identities with those public keys. $\:$ Even "including the intended recipient's public key in the signature" would not solve that, since the adversary could just use the same public key as someone else. $\:$ (continued ...) $\;\;\;\;$
Jul
8
comment Is this a secure method of encrypting with authentication?
Your method is vulnerable to surreptitious forwarding. $\:$ The adversary can choose an integer $c$ and let their public key be (receiver's_ECIES_public_key)^c and write "ECDSAPublicKey + ECIESPub^c + IV + Encrypted + Sig". $\;\;\;\;$
Jul
8
revised AES-Paillier Homomorphic encryption
fixed grammar
Jul
7
comment If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
By the link I gave, both instances of "and space" should be removed. $\;$
Jul
7
comment Is this a secure method of encrypting with authentication?
@user1193112 : $\;\;\;$ What do you mean by the initial step 1? $\:$ The ECDH parameters must already exist beforehand or be generated as part of EC PKE key generation. $\;\;\;\;\;\;\;\;$
Jul
7
comment If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
For small $e$, there's an even faster attack. $\:$ Even for large $e$, the amount of space used can be made trivial. $\:\:$
Jul
7
answered RSA with $\lambda(n)$ or $\varphi(n)$
Jul
7
comment Diffe-Helman Exchange result is always 1
That means you'll get the same results as if you raised $1$ to the exponents. I get 5 from J.D.'s comment and your comment.
Jul
7
comment Why have round constants in hashes?
Encryption is not known to be sufficient for collision-resistance‌​. $\;$
Jul
7
comment Diffe-Helman Exchange result is always 1
@Jake : $47 \equiv 1\not\equiv 5 \pmod{23}$
Jul
7
comment Diffe-Helman Exchange result is always 1
$47 \equiv 1 \pmod{23}$
Jul
6
comment Mutual verification of shared secret
This attempts to slow down such tries, but heuristically doesn't actually stop either party from just trying candidates for the other party's input. $\:$ Also, how does she know "he saw that their ek2s matched"? $\hspace{.36 in}$
Jul
6
comment Mutual verification of shared secret
@codebeard : $\;\;\;$ Well, $=\hspace{.02 in},\hspace{-0.03 in}\neq$ indicate whether the parties' inputs are equal or unequal, $\perp$s indicate "that foul play has taken place", and $T$ is the time it takes honest parties to solve the time-lock puzzles. $\:$ The only thing which might be at all impractical is the initialization phase (corresponding to $\operatorname{Sharegen}_r$), but I have no clue how practical or not that would be. $\;\;\;\;\;\;\;\;$