# Tag Info

0

This is really an extended comment followed by a suggestion. You have the basic design down correctly, and are asking the wrong question. Take five LFSRs with feedback polynomials that are different primitive binary polynomials of degree $10$, and one LFSR with feedback polynomial that is a primitive binary polynomial of degree $5$. Load each LFSR with a ...

3

The polynomial factorisation of $X^{2^L-1}+1$ into irreducible factors gives you all the polynomials $g_i(X)$ that can be used as LFSR polynomials in generating any sequence of period $2^L-1.$ Say your goal is to generate a sequence of this period with linear complexity $c.$ Assume $$(X^{2^L-1}+1)=\prod_{i=1}^v g_i(X),$$ there will be no repeated factors. ...

1

That property lets a trusted n2-byte random string be enough to make the rest of public keys fit into n bytes. In particular, forward secrecy can be more efficient if the sender can store such a string, since the string can have been generated by the same party as generates the rest of the public keys. Also, if for random private keys and independent n2-...

7

Yes. There is an $\Omega(\log n)$ lower bound on ORAM. Therefore directly using ORAM to transform a non-oblivious algorithm to oblivious algorithm would incur a logN overhead. It is an open problem to design an ORAM matching the lower bound. No. There exists algorithms that do not have more efficient solution. As an apparent example, accessing a memory cell ...

10

The answer to this question is not straightforward and has a lot to do with the "conference culture" of computer science. Unlike other fields, the main publication venues for CS are conferences and not journals. This isn't to say that journals don't have an important role; rather, you don't follow journals to see what research is being done - you follow ...

1

Why do most of papers in the well-known conferences provide only the proof sketch? Space constraints, mostly (the paper has to fit in a certain number of pages). Often, the full proofs are given in the preprint version, available from the author's home page or the ePrint archive.

2

The permutation used for Even-Mansour needs to approximate a random permutation. This is the model in which all of the $r$-round Even-Mansour proofs are done. If you have a permutation that is distinguishable from random in a small number of queries, those proofs become null and voidâ€”though in some cases the cipher may still be secure. Now, it is perfectly ...

3

Let $a$ and $b$ be the numbers emited rsp. by person A and person B. $E(x)$ means encoded form of $x$. $E(a)$ and $E(b)$ are publicly known, right? Note that if person A knows $a$, $E(a)$, $E(b)$ and person B knows $b$, $E(a)$, $E(b)$ and it is possible to calculate $a+b$ from $E(a)$ and $E(b)$ (that is what you want to do, right? So it must be possible) ...

10

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a classical no-whitebox implementation on a different platform. The goal is that an attacker having access to the whole computation and intermediate values cannot ...

9

I believe the concept you're looking for is a cryptographical hash. This is a function that takes a (potentially) long input, produces a short (fixed length) output, and for which it is impractical to find two different inputs that generate the same output. It is a fixed function; anyone (including your customer) can generate a hash for any input. How it ...

Top 50 recent answers are included