5,043 reputation
1723
bio website
location
age
visits member for 2 years, 5 months
seen 43 mins ago

Dec
21
asked Single Party Encryption, Multi Party Decryption
Dec
21
comment Private Messaging
I think your answer summarizes the (publicly known) state of the art of traffic analysis counter measures, but I am holding my accept to see if there are any other takers.
Dec
19
comment Private Messaging
I wasn't clear. With such a solution Alice would of course have to send a message with layered encryption. When Sue has peeled off the first layer, all that it says is that the message is intended for Carol, etc. Obviously, if the first mixer sees the final recipient, Eve will just have to compromise the first mixer to get the actual traffic data.
Dec
19
comment Private Messaging
It is possible to let a third client Carol act as a mix. Sue is however the only entity that all parties are able reach directly (i.e. the only one with a static IP or registered DNS name). The routing could e.g. be: Alice->Sue->Carol->Sue->David->Sue->Bob.
Dec
18
comment Private Messaging
@DrLecter: Am I correct that those papers deal with the details of the "ideal" solution I outlined, and hence suffer from an overhead that is linear in either the number of users or the total number of messages?
Dec
18
asked Private Messaging
Dec
17
comment Calculation of time to crack SHA-256 hash
Regardless, if you are only interested in a single password (for a specific user), brute force would be fast enough, to make actually programming the attack the most time consuming step, even if you attack by brute force.
Dec
17
comment Calculation of time to crack SHA-256 hash
Is this homework and you want an exact answer, or would "no more than two seconds" do?
Dec
16
awarded  Enlightened
Dec
16
awarded  Nice Answer
Dec
11
comment Pohlig-Hellman exponentiation block cipher
OK, that seems to point to the conclusion that a secure CTR mode would require a way to enumerate the elements of $G$ in a way that is completely independent of the group operation in $G$.
Dec
11
comment Pohlig-Hellman exponentiation block cipher
Why would you define CTR mode that way? A better alternative seems to be $c_i = (g^{r^i})^em_i$. Unless I am mistaken, both $g$ and $r$ might be left public with such a construct.
Dec
7
comment why RSA uses Semiprime numbers?
crypto.stackexchange.com/questions/10590/…
Dec
5
comment Can cryptocurrency mining devices be used for cryptanalysis?
@CodesInChaos: It might not be self-evident that PBKDF2-HMAC-SHA-256 is close to bitcoin mining. Bitcoin mining benefits from parallelization, while PBKDF2 (with a high iteration count) is serial by design. How large a database of intermediate values would you need, in order to not have the device sit idle while it is waiting for the next round?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Well, clearly you have to report something to the party that will reveal the hidden unit. Would a distributed commitment scheme that doesn't reveal any information about the players but might be verified when the game ends help?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Your example suggests that your problem is similar to the problem of e-cash: How do you spend any of your electronic coins, in such way that it is impossible for you to keep a copy of the same coin and spend it again later? I don't think this can be done completely on one client, without some sort of commitment that are stored in multiple locations.
Nov
29
comment What would make it impossible to deny that decryption of a package has taken place?
Please be more specific. Do you want a receipt that the user has read a license agreement and approved it (use certificates and a digital signature of "[license] I approve [name]", or do you need confirmation that the software has automatically performed a few simple steps (cf e.g. crypto.stackexchange.com/questions/9497/…)?
Nov
27
comment Timing attack on modular exponentiation
If there are conditional branches, you can't rely on it being constant time. In worst case the second alternative is just out of the instruction cache, and has to be loaded prior to execution, at each step. The algorithm here en.wikipedia.org/wiki/… is misleading. In order to get to constant time, you have use a constant time swap on the intermediates first, perform the square and mul and store it in temps, and swap the temps prior to assigning back to the intermediates.
Nov
21
comment Private Information Retrieval with a pre-prepared database
I am asking for functions $E$, $F$ and $D$, such that, for a set of records $\{r_j\}$, where, for some $i$, $r_i = E_U(m_U)$, then $m_U = D_U(F_U(\{r_j\}))$. Trivially, if $F$ simply consists in concatenating all records of the encrypted database, then $S$ will not learn $i$ by being asked by $U$ to perform $F_U$ on the entire database. My question is whether there exists more efficient functions.
Nov
21
comment Private Information Retrieval with a pre-prepared database
That is incorrect, I am asking for a protocol in which $S$ will not learn which item $U$ retrieves. We might assume the cipher text of the public key encryption is indistinguishable from uniform in the conventional sense.