5,446 reputation
1726
bio website
location
age
visits member for 2 years, 8 months
seen 3 hours ago

Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
Surely there are better references, if we are discussing what to prove and how? For instance, in "Hashing Functions can Simplify Zero-Knowledge Protocol Design (too)", Damgård et all 1994, a definition of Perfect Zero-Knowledge wrt a Honest Verifier is given. My understanding is that there is a plethora of definitions in the literature. Maybe that was your point too?
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
I though Perfect Zero Knowledge was defined as security from an adaptive dishonest verifier. What is to be proved is that $s$ is uniformly distributed, even if we don't make it as our first assumption that $c$ is uniformly distributed.
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
@K.G.: Quite right, I do not prove perfect zero-knowledge (see the request for clarification in my comment to the OP).
Sep
28
comment Perfect zero knowledge for the Schnorr protocol?
The purpose of selecting $e \in \{0,1\}$ Schnorr protocol, is to reveal a dishonest prover (who has one authentic transcript but doesn't know the value of $x$) with a certain probability after a certain number of executions of the protocol. This means the protocol has to be played out in $2log_2(q)/2$ consecutive steps, to get the same level of assurance (that the prover knows $x$) that you would get from a single execution of the protocol if $e$ is selected uniformly from $\mathbb Z_q^*$.
Sep
27
comment What makes RSA secure by using prime numbers?
@poncho: Right, thanks, the implication goes the other way. Obviously, $d = 65$ satisfies $5d = 1 \pmod {\phi(133)}$.
Sep
23
comment Is the inverse of a secure PRP, also a secure PRP?
@RickyDemer: Quite right, the security model outlined in that paper entails that the adversary must have no better than a 0.5 probability to predict how the last two blocks in the code book are permuted. No feistel cipher is secure in that model. Arguably, neither is AES-128, since a (hypothetical) adversary that is able to process $2^{128}-2$ blocks, is implicitly also able to mount a brute force search of the key.
Sep
20
comment Is the inverse of a secure PRP, also a secure PRP?
@D.W.: AFAIK the strongest notion would be that the adversary in fact has the entire code book and is only limited by a linear function of the size of the code book. This notion might make more sense in the case of block ciphers with a 64 bit block size, but theoretically it ought to be stronger than both of the notions you mention.
Sep
18
comment Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?
@rath: Indeed, if the PBKDF doesn't produce pseudo random output because the internal function used as the "PRF" has a flaw, the crypto would be broken even if the derived key was used for a proper symmetric cipher.
Sep
14
comment RSA key pair generation using PRNG with same seed
@owlstead: No problem, edit away, but perhaps you should narrow down your question, so that it becomes clear my then last paragraph is the adequate answer.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
The point being raised by Dale Emmons here change.org/en-GB/petitions/… is that the hardware random bits are fetched after the other entropy has already been both collected and processed. This means that one might question the claim that the chosen string is really XORed with an unknown string.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
Could you provide some details about which "breakthroughs" everyone is talking about? It should be noted that neither RSA nor ECC are secure for post-quantum cryptography.
Sep
10
comment Security of S/MIME in case of CA compromise
In the case we got access to several 3rd parties of which at most a limited number are hostile, some readily available alternatives ought to be using cross-signed certificates; multiple PKCS#7 counter-signatures; or PGP keys.
Sep
10
comment Security of S/MIME in case of CA compromise
I take it that you are not aware of any formal security model, in which either Alice and Bob, or Mallory, by adding a few steps can get provable security against the respective adversary?
Sep
9
comment Security of S/MIME in case of CA compromise
I am inclined to accept this answer, since it is indeed a valid conclusion from my assumptions. But are my assumptions and my usage of the term "relatively secure" really that unproblematic?
Sep
9
comment Security of S/MIME in case of CA compromise
@Nemo: Are Alice and Bob a threat to the transparency of Mallory, only if the attack is large scale, Alice and Bob have an out-of-band channel, and they go the extra length to somehow compare the cipher text?
Sep
8
comment Security of S/MIME in case of CA compromise
@nightcracker: Sorry, didn't catch what you meant. Do you want me to change the formatting?
Sep
7
comment RSA key pair generation using PRNG with same seed
Obviously, a 2048 bit two-prime RSA modulus can't have any factors in common with a 1024 bit two-prime RSA modulus, so, yes, changing the parameters might entail different output. The same goes for implementation details: E.g. using a sieve or generating every candidate at random will also lead to different output even if the DRBG sequence is the same.
Sep
7
comment Camellia or AES - which should I use?
Technically, TLS only specifies that the server selects a cipher suite, and not how the order of the client cipher suites should influence this choice. If it does, it is an implementation detail. Hence, the only possible correct answer (that would have the same implications for any theoretically possible standard compliant server), is that you should only enable a cipher suite if you would find it acceptable that the server actually selects it. It is not really a question of which one is the best choice if you only get to pick one. If it was, simply disable the other.
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
Just to clarify - the term "generator" has different meaning in my comment and in Gilles comment. I use the term as it is used in e.g. RNG - random number generator.
Sep
4
comment Will rehashing an SHA256 hash continually, eventually produce every possible value?
The concept of a "random function" is normally used for a function selected uniformly at random - not for a random generator. While a random generator will not fall into cycles, a function selected uniformly at random will, just like a pseudo random function will.