# Tag Info

1

Question1: How can we show/prove that the random element only with a negligible probability can have such structure? If we assume the random oracle model and have $h: \{0,1\}^* \to \{0,1\}^n$ then we can state that $h(.)$ is equivalent to randomly sampling from $\{0,1\}^n$. Thus for a random element $r = r'||r''$ the probability that $r$ has the structure \$...

1

Besides Joshua Warner's excellent answer, I do also want to point out that someone has to "roll their own crypto" at some point for there to be any designs and implementations at all. On that front, the Signal protocol was chiefly designed by Moxie Marlinspike, a cryptography and security researcher with a solid track record and credited with multiple ...

2

Just to complement prof. Lindell's answer, although one cannot have a formal description of the case in which round complexity will matter more than communication or computation, a colleague of mine did some estimations two years ago, for a paper we were writing on round-efficient primitives for zero-knowledge. It's just a particular case, but having figures ...

10

Alright, I'll bite. First, let me propose bounding the discussion to just the core of the protocol. In particular, let's not get hung up on: Social engineering attacks How broadly the end-to-end encryption is applied (i.e. are all conversations in the app encrypted?) The backgrounds of the inventors and reasoning for inventing the protocol Metadata ...

5

First note that all polynomial-time functions can be securely computed with a constant number of rounds (Yao and BMR families) and all can be securely computed with protocols that have rounds dependent on the depth of the circuit computing the function (GMW families). The question is when is one type better than another. The answer to this question is not ...

Top 50 recent answers are included