User Myria

16 votes

0 answers

337 views

Name of an archaic type of RSA padding (0BBBBBBB...) [closed]

asked Jun 14, 2016 at 22:53

11 votes

1 answer

944 views

Are DSA and ECDSA provably secure assuming DL security?

asked Jun 3, 2019 at 19:46

10 votes

3 answers

4k views

Usage difference between x86 RDRAND and RDSEED

asked Dec 16, 2016 at 0:55

10 votes

0 answers

774 views

Are there attacks against broken RSA signature pad checking with $e = 65537$?

asked Jan 30, 2017 at 21:13

9 votes

2 answers

991 views

Are lookup tables safe when they fit in a cache line?

asked Jan 24, 2017 at 0:09

9 votes

1 answer

1k views

Does the security of RSA come from just the carries in multiplication?

asked May 7, 2021 at 19:37

8 votes

1 answer

638 views

Does "SHA-256/192" use different initial values from SHA-256?

asked Sep 12, 2022 at 22:46

8 votes

1 answer

185 views

How to implement "online" feature of GCM?

asked Feb 22, 2017 at 23:14

8 votes

3 answers

1k views

Why is it good to split a CTR-mode counter into nonce and counter?

asked Aug 13, 2015 at 3:47

8 votes

2 answers

4k views

Is it possible to recover an RSA modulus from its signatures?

asked Nov 4, 2015 at 3:25

7 votes

1 answer

218 views

How bad is it to leak $k$ in RSA?

asked Oct 28, 2021 at 19:23

6 votes

2 answers

170 views

Does Poly1305 have weak keys like GCM/GHASH?

asked Sep 8, 2021 at 23:07

6 votes

1 answer

650 views

Attacking a hardware AES implementation if it leaks the intermediate round states

asked Aug 18, 2014 at 6:06

5 votes

2 answers

3k views

How common are weak RSA keys?

asked Mar 8, 2016 at 20:56

5 votes

1 answer

189 views

What security checks do I need for SRP-6a?

asked May 10, 2016 at 19:10

4 votes

1 answer

76 views

How many bits of an exponent are leaked when doing a powmod?

asked Nov 6, 2015 at 2:01

4 votes

2 answers

732 views

Is there a standard format for compact 56-bit DES keys?

asked Sep 25, 2015 at 1:53

4 votes

1 answer

1k views

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

asked Oct 23, 2015 at 2:09

4 votes

1 answer

391 views

How rare are 1024-bit $B$-smooth numbers?

asked Mar 12, 2018 at 3:55

4 votes

1 answer

72 views

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

asked Jan 22, 2019 at 23:57

3 votes

1 answer

117 views

Security issues with computing parallel hashes?

asked Jul 16, 2019 at 20:00

3 votes

2 answers

232 views

Isomorphism of Curve25519 and Ed25519?

asked Jun 7, 2022 at 18:05

3 votes

1 answer

788 views

Origin of the SHA-224 initial hash value?

asked Dec 17, 2016 at 5:21

3 votes

1 answer

162 views

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

asked Jan 5, 2017 at 23:46

2 votes

0 answers

419 views

RSA signatures that allow hash to move around in block

asked Feb 25, 2018 at 2:40

2 votes

0 answers

71 views

RSA: Blinding versus fixed-time computation

asked Mar 20, 2019 at 22:02

2 votes

1 answer

74 views

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

asked Dec 6, 2021 at 22:36

2 votes

1 answer

311 views

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

asked Jun 7, 2019 at 0:05

1 vote

1 answer

153 views

Lookup table for DSA/ECDSA/Schnorr multiplication

asked Jul 8, 2019 at 21:21

1 vote

0 answers

135 views

Should Ed25519 verification multiply by the cofactor?

asked Nov 15, 2021 at 22:58

Stack Exchange Network

36 Questions

Name of an archaic type of RSA padding (0BBBBBBB...) [closed]

Are DSA and ECDSA provably secure assuming DL security?

Usage difference between x86 RDRAND and RDSEED

Are there attacks against broken RSA signature pad checking with $e = 65537$?

Are lookup tables safe when they fit in a cache line?

Does the security of RSA come from just the carries in multiplication?

Does "SHA-256/192" use different initial values from SHA-256?

How to implement "online" feature of GCM?

Why is it good to split a CTR-mode counter into nonce and counter?

Is it possible to recover an RSA modulus from its signatures?

How bad is it to leak $k$ in RSA?

Does Poly1305 have weak keys like GCM/GHASH?

Attacking a hardware AES implementation if it leaks the intermediate round states

How common are weak RSA keys?

What security checks do I need for SRP-6a?

How many bits of an exponent are leaked when doing a powmod?

Is there a standard format for compact 56-bit DES keys?

Fast reduction in $GF(2^{128})$ using x86 `PCLMULQDQ`

How rare are 1024-bit $B$-smooth numbers?

How to handle the extra 12451 elements in Sophie-Germain Counter Mode?

Security issues with computing parallel hashes?

Isomorphism of Curve25519 and Ed25519?

Origin of the SHA-224 initial hash value?

Is having AES tables on a distinct physical page enough to avoid cache timing attacks?

RSA signatures that allow hash to move around in block

RSA: Blinding versus fixed-time computation

Is there an algorithm to compute the wNAF for an exponent faster than quadratic?

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

Lookup table for DSA/ECDSA/Schnorr multiplication

Should Ed25519 verification multiply by the cofactor?