Tag Info

New answers tagged


First note that it is not necessary for $B$ to guess the correct $n$. To see this, you can think of the PPT adversary $A'$ that on input $(y, 1^{n-1})$ outputs $A(y, 1^n)$. The sole purpose of the input $1^n$ is to allow $A$ to run in polytime in $n$. However, if the input (i.e., the output of $f$) to $B$ is of size, e.g., a constant $k$, then $B$ can not ...


We cannot - we might need another function to adjust the value to be acceptable. Assuming however that $h$ is a hash - this is the crypto site - then it should accept any size of input in bits; up to a seriously high limit anyway.


That is definitely not a good hash function, but as you already realized, it is not a hash function actually. Your construction can be seen as PRF or an HMAC, and for both it is not secure either. A general problem is, that you allow the attacker way too little. Giving him only $h$, that's similar to a ciphertext only attack, which is just not enough in ...


Since attacker does not know $m$, he can't directly apply discrete logarithm methods. On the other hand, small message space allows to run discrete log algorithm on each possible $m$. There are subexponential algorithms for dlog, but I am not sure if they are directly applicable here. But the general BSGS algorithm will find $e$ in $sqrt(e)$ operations, so ...

Top 50 recent answers are included