Hot answers tagged

4

There exists a distinguisher that works with nontrivial advantage, $O(1/\log \phi(m))$. This is because $q_0$ must be a multiple of $p_0$; however $q_1$ is a random value between $0$ and $\phi(m)-1$. Hence, the distinguisher is "test both for primality, if one is prime, say that one is $r \cdot p_1 \bmod \phi(m)$" $q_1$ is a random value, and hence it ...


2

The adversary should definitely always be "allowed to know" the security parameter. In other words, a security definition should allow the adversary's behavior to depend on the security parameter. This can be accomplished either by quantifying the adversary after the security parameter is chosen, or by letting the security parameter be an explicit input to ...


1

The main question about this topic is: Guarding against cryptanalytic breakthroughs: combining multiple hash functions. There you will find some better combiners for multiple hash functions. I would generally recommend against the extra complexity - a single good hash ought to be enough. Now, regarding your way of combining them: Does this make sense? ...



Only top voted, non community-wiki answers of a minimum length are eligible