962 reputation
48
bio website
location Waterloo, Canada
age 29
visits member for 2 years, 11 months
seen Jan 20 '13 at 4:30

I am a PhD student with an interest in theoretical cryptography and mathematical tools used for cryptanalysis.


Apr
9
comment Does encrypting twice using the same block cipher produce a security weakness?
I don't disagree with your comment, but I disagree with the formulation of your answer which for the first time gives an indication that you need to keep the keys independent if you want to use the same cipher text again. I just figured out that I was a bit hasty in making the second comment. You can construct an artificial PKC which is secure on one encryption, but leaks least (most) significant bits when doubly encrypted with the same key.
Apr
9
comment Does encrypting twice using the same block cipher produce a security weakness?
"as long as the keys you chose to encrypt a second time are independent of the keys you use the first time" This is not right, encryption keys are usually long lived keys. In fact, your statement questions the semantic security of the PKC in multiple message model. The second paragraph holds only for information theoretic security and that is because of Shannon's lower bound on the size of the key length.
Apr
4
comment ECC algorithm pollard's $\rho$ complexity
@VineetMenon: Complexity of an algorithm is always measured in terms of input size. In group-theoretic algorithms, the input is group and so it is measured by the order of the group that defines the group. Same for the graph. You define the complexity of a graph-theoretic algorithm in terms of the size of the graph, which is the number of vertices and the number of edges. If you have a sparse graph, then you just specify the number of vertices, edges are considered to be $O(n)$. For a general graph, you need both edges and vertices as for any connected graph, $\Omega(n) \leq E(G) \leq O(n^2).$
Apr
3
comment ECC algorithm pollard's $\rho$ complexity
The Handbook of Applied Cryptography says on Page 92 that it is $O(n^{1/4})$. I am not sure now where this poly-log factor came in to the picture!
Apr
3
comment ECC algorithm pollard's $\rho$ complexity
Can you give more details on why $poly \log$ factor is there? I don't understand what efficiency has to do with it. Thanks in advance!
Apr
3
comment Trouble with diffie-hellman groups
$O(2^{256})$ is still $O(1)$.
Mar
31
comment Can you make a hash out of a stream cipher?
The negative vote down, can you state the reason why you are not satisfied with the answer?!
Mar
31
comment Can you make a hash out of a stream cipher?
If you will look at the security requirement in an universal hash function, you will notice the difference from the well-known security requirements of cryptographic hash functions, viz collision resistance. The reason why UOWHF were introduced was to construct much efficient signature scheme without relying on stronger properties like collision resistance.
Mar
10
comment Alternatives to FHE for secure function evaluation
Verifiable homomorphic OT exists, and by the completeness result that existence of secure OT implies existence of secure party computation, I believe we can have verifiability using FHE as well (not sure if composition will work fine or not. As far as I remember, UC model has nothing to say about composobility of homomorphic encryption scheme.) On that note, what is FE?
Mar
10
comment Complexity of arithmetic in a finite field?
Oh yes, I should have mentioned that explicitly. I will do it now. Thanks for bringing this to notice.
Mar
10
comment Alternatives to FHE for secure function evaluation
NIZKP helps in proving to the other party that the gates are constructed properly without any interaction. This will work fine if you are doing SFE because there is no binding on the second party to share the output to the first party. Proactive cryptography works in the scenario where you don't change the shares after some time epoch. It is first studied in the realms of secret sharing, where the first share are formed as in normal SS, but later on, when you need to redistribute the share for same secret, you construct a polynomial with constant 0 and redistribute the share as in normal SS.
Mar
10
comment Alternatives to FHE for secure function evaluation
I will edit my answer appropriately later today to cover these questions as well. They won't fit in one comment space ;) But yes, these are very natural questions. For example, Jarecki and Shmatiko made a garbled circuit secure against active adversary by incorporating that the first party proves in ZK-way the correctness of every gate. Note that in garbled circuit, one party construct the circuit and other computes. It thereby, does not prevent against unfair adversary. Till now, there is no way to get fair computation using Yao's method.
Mar
5
comment What is the most practical fully homomorphic cryptosystem?
To add to D.W., the talk given by Halevi is also online on IACR's channel on youtube. It was a very nice talk.
Mar
5
comment What is the flaw in this model for homomorphic encryption?
@mikeazo, I see. I usually jump to the main part of the paper, so missed out the introduction. That was useful information. Thanks!
Mar
5
comment What is the flaw in this model for homomorphic encryption?
@mikeazo, this is public key encryption scheme! I have already this paper. This was the second paper in the line and was later published in EUROCRYPT 2010. The public key is random $x$!
Mar
5
comment What is the flaw in this model for homomorphic encryption?
What I meant to say is that it cannot be a public-key system. Mike, can you please give me the reference as well. I would very much like to read the paper.
Feb
29
comment Is the $\ell$-Diffie Hellman Inversion easy when g is known?
Thanks for pointing. I corrected the link.
Feb
4
comment How to account for moore's law in estimating time-to-crack?
Thanks for correcting me. I know these stuffs from theoretical point of view and to be honest, don't have much idea about practice.
Feb
1
comment Can md5 be used for encrypting data?
On the second paragraph, there has been a recent attack on finding collision on the MD5 with just single block. Since the method used in finding collision and second-preimage for MD5 were very closely related, I don't see any reason why the recent attack can't be molded properly to find even single block second preimage. So, there is good chance that a work will come that that finds another string that short that hashes to same value and it can be found pretty easily! I am quiet sure about that and hence skeptic about using MD5.
Jan
30
comment Are there two known strings which have the same MD5 hash value?
I just saw it too on eprint and was about to post this one, but you beat me to that :)