User Myria

16 votes

0 answers

345 views

Name of an archaic type of RSA padding (0BBBBBBB...) [closed]

asked Jun 14, 2016 at 22:53

12 votes

2 answers

5k views

Is it possible to recover an RSA modulus from its signatures?

asked Nov 4, 2015 at 3:25

11 votes

3 answers

5k views

Usage difference between x86 RDRAND and RDSEED

asked Dec 16, 2016 at 0:55

11 votes

1 answer

1k views

Are DSA and ECDSA provably secure assuming DL security?

asked Jun 3, 2019 at 19:46

10 votes

0 answers

813 views

Are there attacks against broken RSA signature pad checking with $e = 65537$?

asked Jan 30, 2017 at 21:13

9 votes

2 answers

1k views

Are lookup tables safe when they fit in a cache line?

asked Jan 24, 2017 at 0:09

9 votes

1 answer

1k views

Does the security of RSA come from just the carries in multiplication?

asked May 7, 2021 at 19:37

8 votes

1 answer

823 views

Does "SHA-256/192" use different initial values from SHA-256?

asked Sep 12, 2022 at 22:46

8 votes

1 answer

192 views

How to implement "online" feature of GCM?

asked Feb 22, 2017 at 23:14

8 votes

3 answers

2k views

Why is it good to split a CTR-mode counter into nonce and counter?

asked Aug 13, 2015 at 3:47

7 votes

1 answer

295 views

How bad is it to leak $k$ in RSA?

asked Oct 28, 2021 at 19:23

6 votes

2 answers

208 views

Does Poly1305 have weak keys like GCM/GHASH?

asked Sep 8, 2021 at 23:07

6 votes

1 answer

681 views

Attacking a hardware AES implementation if it leaks the intermediate round states

asked Aug 18, 2014 at 6:06

5 votes

2 answers

3k views

How common are weak RSA keys?

asked Mar 8, 2016 at 20:56

5 votes

1 answer

214 views

What security checks do I need for SRP-6a?

asked May 10, 2016 at 19:10

4 votes

1 answer

84 views

How many bits of an exponent are leaked when doing a powmod?

asked Nov 6, 2015 at 2:01

4 votes

2 answers

746 views

Is there a standard format for compact 56-bit DES keys?

asked Sep 25, 2015 at 1:53

4 votes

1 answer

1k views

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

asked Oct 23, 2015 at 2:09

4 votes

1 answer

444 views

How rare are 1024-bit $B$-smooth numbers?

asked Mar 12, 2018 at 3:55

4 votes

1 answer

74 views

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

asked Jan 22, 2019 at 23:57

4 votes

2 answers

357 views

Isomorphism of Curve25519 and Ed25519?

asked Jun 7, 2022 at 18:05

3 votes

1 answer

129 views

Security issues with computing parallel hashes?

asked Jul 16, 2019 at 20:00

3 votes

1 answer

831 views

Origin of the SHA-224 initial hash value?

asked Dec 17, 2016 at 5:21

3 votes

1 answer

167 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

asked Jan 5, 2017 at 23:46

2 votes

0 answers

430 views

RSA signatures that allow hash to move around in block

asked Feb 25, 2018 at 2:40

2 votes

1 answer

350 views

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

asked Jun 7, 2019 at 0:05

2 votes

0 answers

74 views

RSA: Blinding versus fixed-time computation

asked Mar 20, 2019 at 22:02

2 votes

1 answer

110 views

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

asked Dec 6, 2021 at 22:36

2 votes

0 answers

268 views

How to recognize DER nested OCTET SEQUENCEs?

asked Dec 12, 2022 at 23:39

2 votes

0 answers

47 views

SRP on elliptic curves: replacing + and - operations?

asked Nov 9, 2023 at 23:28

Stack Exchange Network

39 Questions

Name of an archaic type of RSA padding (0BBBBBBB...) [closed]

Is it possible to recover an RSA modulus from its signatures?

Usage difference between x86 RDRAND and RDSEED

Are DSA and ECDSA provably secure assuming DL security?

Are there attacks against broken RSA signature pad checking with $e = 65537$?

Are lookup tables safe when they fit in a cache line?

Does the security of RSA come from just the carries in multiplication?

Does "SHA-256/192" use different initial values from SHA-256?

How to implement "online" feature of GCM?

Why is it good to split a CTR-mode counter into nonce and counter?

How bad is it to leak $k$ in RSA?

Does Poly1305 have weak keys like GCM/GHASH?

Attacking a hardware AES implementation if it leaks the intermediate round states

How common are weak RSA keys?

What security checks do I need for SRP-6a?

How many bits of an exponent are leaked when doing a powmod?

Is there a standard format for compact 56-bit DES keys?

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

How rare are 1024-bit $B$-smooth numbers?

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

Isomorphism of Curve25519 and Ed25519?

Security issues with computing parallel hashes?

Origin of the SHA-224 initial hash value?

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

RSA signatures that allow hash to move around in block

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

RSA: Blinding versus fixed-time computation

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

How to recognize DER nested OCTET SEQUENCEs?

SRP on elliptic curves: replacing + and - operations?