# Tag Info

9

What choice did they have? F1 is a bitwise function with three inputs and one output. There are $2^8 = 256$ such functions. Only 70 of them are "unbiased" (i.e. have as many 0 and 1 outputs in their image). If you further require that each input, as well as the order of inputs, matters for the output, you are left with only 36. However, those 36 are all ...

-1

Here is another, very stupid answer. Use discrete logarithms. Have first the participants select some public cyclic group $G$, of order greater than all the secrets, with a generator $g$. Then each one of them, with the secret $x_i$, publishes $g^{x_i}$. (You could also use any OWF, or add some tweak, if needed).

2

No, that's not possible, as you calculate sha512(F2) without the state of sha512(F1). What you require is compress(mix(compress(mix(IH, F1)), F2)) while what you have is compress(mix(IH, F1)) and compress(mix(IH, F2)). So you would have to undo that last compression, which is obviously not possible. Here IH is the initial state (the values of $h_1$ etc.) ...

5

Most standard-use iterative hash functions (including SHA-512) are build in a way that these types of operation are not possible (without breaking the hash function). They work generally in this way: The message is split in same-size blocks (usually with some padding at the end to fill the last block): $pad(M) = M_0 || M_1 || M_2 ... || M_n$. There is ...

0

What you are describing sounds something like a Merkle Tree: https://en.m.wikipedia.org/wiki/Merkle_tree Note that the organization of a Merkle tree is fairly arbitrary; the graph can look like just about anything so long as it is acyclic. The interesting aspect of a Merkle tree is that any change anywhere in the data "bubbles up" the tree to the root, ...

0

Alright, so using per-round validation in almost all cases causes a decrease in performance. Simple probability tells us that after each round, there is a 1/x chance that the round will fall within the "valid" data set. This means that for any cycle through a Feistel network, the output has this 1/x chance of being correct. Likewise, any Feistel network ...

0

I don't think this would break correctness, but it's possible you might actually slow your algorithm down on average. You'd need a more rigorous combinatorial analysis of the expected number of repeated rounds vs. the expected number of full cycle walks. That really depends on the specific algorithm; are you using FFX? You'd also need to show that doing ...

1

The multiplicative group $Z_m$ of integers modulo $m$ has exactly $\phi(m)$ elements by definition. Thus for any element $a$ of $Z_m$ the equation $$a^{\phi(m)}=1~(mod~m)$$ holds, where $1$ is the multiplicative identity of $Z_m$ (the residue class $km+1$ of all integers congruent to 1 modulo $m$). In RSA, $e$ and $d$ are indeed inverses modulo ...

0

The equation above starts as $e\cdot d\cdot d^{-1} \equiv d^{-1}\cdot 1\bmod{(p-1)\cdot (q-1)}$ I replaced the $=$ in the original equation with $\equiv$ which is a congruence relation. This is undoubtedly what the author of the image meant. It is important to note that the congruence relation applies to the entire equation, not just the right hand side. ...

Top 50 recent answers are included