5,446 reputation
1726
bio website
location
age
visits member for 2 years, 8 months
seen 2 hours ago

Dec
23
comment Single Party Encryption, Multi Party Decryption
Benaloh's scheme seems to be exactly what I am asking for, yes. On the negative side, though, the scheme uses commitments that induce an overhead for the mixes by a factor greater than 100 (with the parameter values recommended in the paper). It is obvious that there would be a risk for integrity if only two commitments were used by each mix, but would it lead to a risk of compromised anonymity?
Dec
23
comment Single Party Encryption, Multi Party Decryption
I am missing your thoughts on how, exactly, this might be applied to a mixnet scheme.
Dec
22
comment How does a backdoor in the RNG enable an attacker to break encryption protocols?
schneier.com/blog/archives/2007/11/the_strange_sto.html
Dec
21
comment Private Messaging
I think your answer summarizes the (publicly known) state of the art of traffic analysis counter measures, but I am holding my accept to see if there are any other takers.
Dec
19
comment Private Messaging
I wasn't clear. With such a solution Alice would of course have to send a message with layered encryption. When Sue has peeled off the first layer, all that it says is that the message is intended for Carol, etc. Obviously, if the first mixer sees the final recipient, Eve will just have to compromise the first mixer to get the actual traffic data.
Dec
19
comment Private Messaging
It is possible to let a third client Carol act as a mix. Sue is however the only entity that all parties are able reach directly (i.e. the only one with a static IP or registered DNS name). The routing could e.g. be: Alice->Sue->Carol->Sue->David->Sue->Bob.
Dec
18
comment Private Messaging
@DrLecter: Am I correct that those papers deal with the details of the "ideal" solution I outlined, and hence suffer from an overhead that is linear in either the number of users or the total number of messages?
Dec
17
comment Calculation of time to crack SHA-256 hash
Regardless, if you are only interested in a single password (for a specific user), brute force would be fast enough, to make actually programming the attack the most time consuming step, even if you attack by brute force.
Dec
17
comment Calculation of time to crack SHA-256 hash
Is this homework and you want an exact answer, or would "no more than two seconds" do?
Dec
11
comment Pohlig-Hellman exponentiation block cipher
OK, that seems to point to the conclusion that a secure CTR mode would require a way to enumerate the elements of $G$ in a way that is completely independent of the group operation in $G$.
Dec
11
comment Pohlig-Hellman exponentiation block cipher
Why would you define CTR mode that way? A better alternative seems to be $c_i = (g^{r^i})^em_i$. Unless I am mistaken, both $g$ and $r$ might be left public with such a construct.
Dec
7
comment why RSA uses Semiprime numbers?
crypto.stackexchange.com/questions/10590/…
Dec
5
comment Can cryptocurrency mining devices be used for cryptanalysis?
@CodesInChaos: It might not be self-evident that PBKDF2-HMAC-SHA-256 is close to bitcoin mining. Bitcoin mining benefits from parallelization, while PBKDF2 (with a high iteration count) is serial by design. How large a database of intermediate values would you need, in order to not have the device sit idle while it is waiting for the next round?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Well, clearly you have to report something to the party that will reveal the hidden unit. Would a distributed commitment scheme that doesn't reveal any information about the players but might be verified when the game ends help?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Your example suggests that your problem is similar to the problem of e-cash: How do you spend any of your electronic coins, in such way that it is impossible for you to keep a copy of the same coin and spend it again later? I don't think this can be done completely on one client, without some sort of commitment that are stored in multiple locations.
Nov
29
comment What would make it impossible to deny that decryption of a package has taken place?
Please be more specific. Do you want a receipt that the user has read a license agreement and approved it (use certificates and a digital signature of "[license] I approve [name]", or do you need confirmation that the software has automatically performed a few simple steps (cf e.g. crypto.stackexchange.com/questions/9497/…)?
Nov
27
comment Timing attack on modular exponentiation
If there are conditional branches, you can't rely on it being constant time. In worst case the second alternative is just out of the instruction cache, and has to be loaded prior to execution, at each step. The algorithm here en.wikipedia.org/wiki/… is misleading. In order to get to constant time, you have use a constant time swap on the intermediates first, perform the square and mul and store it in temps, and swap the temps prior to assigning back to the intermediates.
Nov
21
comment Private Information Retrieval with a pre-prepared database
I am asking for functions $E$, $F$ and $D$, such that, for a set of records $\{r_j\}$, where, for some $i$, $r_i = E_U(m_U)$, then $m_U = D_U(F_U(\{r_j\}))$. Trivially, if $F$ simply consists in concatenating all records of the encrypted database, then $S$ will not learn $i$ by being asked by $U$ to perform $F_U$ on the entire database. My question is whether there exists more efficient functions.
Nov
21
comment Private Information Retrieval with a pre-prepared database
That is incorrect, I am asking for a protocol in which $S$ will not learn which item $U$ retrieves. We might assume the cipher text of the public key encryption is indistinguishable from uniform in the conventional sense.
Nov
21
comment Private Information Retrieval with a pre-prepared database
AFAICT, the paper you refer to in your last paragraph describes a protocol where $U$ and $TP$ negotiates the query in real time. I am however interested in a protocol where $TP$ and $U$ do not communicate at all, save for the exchange of long term public keys. That is, $TP$ is able to pick the query without communicating with $U$.