User fgrieu

55 votes

2 answers

9k views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

asked May 25, 2013 at 16:00

48 votes

2 answers

7k views

How is the Swiss post e-voting system supposed to work, and how was it wrong?

asked Mar 13, 2019 at 11:40

40 votes

1 answer

5k views

What is “Fast Prime”?

asked Oct 16, 2017 at 17:24

39 votes

1 answer

2k views

Who first published the interest of more than two prime factors in RSA?

asked Feb 17, 2014 at 14:11

32 votes

3 answers

5k views

Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

asked Mar 6, 2017 at 16:27

30 votes

1 answer

4k views

How secure would HMAC-SHA3 be?

asked Apr 24, 2014 at 11:46

27 votes

3 answers

2k views

Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

asked Dec 1, 2011 at 6:21

25 votes

3 answers

5k views

Proving knowledge of a preimage of a hash without disclosing it?

asked Jan 28, 2012 at 10:55

25 votes

4 answers

5k views

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

asked May 23, 2012 at 11:32

24 votes

1 answer

1k views

Memory-hard password hash in practice?

asked Jun 30, 2017 at 8:56

22 votes

2 answers

7k views

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

asked Jan 13, 2014 at 17:43

21 votes

1 answer

2k views

Security of RSA for paranoids with padding?

asked Apr 12, 2014 at 23:07

20 votes

3 answers

976 views

Collision or second preimage for the ChaCha core?

asked Jun 21, 2015 at 20:16

20 votes

2 answers

3k views

Security of Schnorr signature versus DSA and DLP

asked Jun 21, 2017 at 21:53

19 votes

1 answer

5k views

How does IBM's 53-bit quantum computer compare to classical ones for cryptanalytic tasks?

asked Sep 18, 2019 at 19:36

19 votes

1 answer

1k views

Message-Recovery variant of Ed25519 signature?

asked Sep 27, 2016 at 8:32

18 votes

1 answer

1k views

Verbatim of early work on public-key cryptography?

asked Nov 20, 2014 at 14:42

18 votes

1 answer

1k views

Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?

asked May 29, 2013 at 5:41

18 votes

1 answer

7k views

What changed in PKCS#1 v2.2, and why?

asked Mar 7, 2013 at 22:10

18 votes

2 answers

2k views

Why was the winner of the AES competition not a Feistel cipher?

asked Sep 29, 2013 at 17:23

18 votes

0 answers

446 views

Finding $x$ such that $g^x\bmod p<p/k$?

asked Jun 20, 2017 at 15:57

17 votes

3 answers

5k views

What does the special form of the base point of secp256k1 allow?

asked Jun 30, 2018 at 13:32

17 votes

2 answers

2k views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

asked Apr 14, 2014 at 10:21

17 votes

2 answers

971 views

Status of Algebraic Eraser key exchange?

asked Nov 18, 2015 at 11:41

16 votes

2 answers

4k views

How much can we compress RSA public keys?

asked Jan 18, 2012 at 22:52

16 votes

1 answer

4k views

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

asked Apr 26, 2012 at 11:49

15 votes

1 answer

734 views

Compact digital signature for noisy data

asked Jun 11, 2014 at 22:17

15 votes

3 answers

727 views

Expected entropy in $P(x)\oplus x$ for random $x$, where $P$ is a random permutation

asked Jan 31, 2017 at 10:21

14 votes

1 answer

600 views

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

asked Apr 1, 2014 at 4:57

14 votes

1 answer

6k views

Is a second preimage attack on MD5 feasible?

asked Aug 2, 2012 at 16:50

Stack Exchange Network

188 Questions

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

How is the Swiss post e-voting system supposed to work, and how was it wrong?

What is “Fast Prime”?

Who first published the interest of more than two prime factors in RSA?

Applicability of IBM's projected 50-qubit quantum computer Q to cryptanalysis?

How secure would HMAC-SHA3 be?

Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

Proving knowledge of a preimage of a hash without disclosing it?

Attacks of the MAC construction $\mathcal{H}(m\mathbin\|k)$ for common hashes $\mathcal{H}$?

Memory-hard password hash in practice?

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

Security of RSA for paranoids with padding?

Collision or second preimage for the ChaCha core?

Security of Schnorr signature versus DSA and DLP

How does IBM's 53-bit quantum computer compare to classical ones for cryptanalytic tasks?

Message-Recovery variant of Ed25519 signature?

Verbatim of early work on public-key cryptography?

Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?

What changed in PKCS#1 v2.2, and why?

Why was the winner of the AES competition not a Feistel cipher?

Finding $x$ such that $g^x\bmod p<p/k$?

What does the special form of the base point of secp256k1 allow?

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Status of Algebraic Eraser key exchange?

How much can we compress RSA public keys?

Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?

Compact digital signature for noisy data

Expected entropy in $P(x)\oplus x$ for random $x$, where $P$ is a random permutation

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Is a second preimage attack on MD5 feasible?