5,551 reputation
1828
bio website
location
age
visits member for 2 years, 10 months
seen 7 hours ago

Nov
29
comment What would make it impossible to deny that decryption of a package has taken place?
Please be more specific. Do you want a receipt that the user has read a license agreement and approved it (use certificates and a digital signature of "[license] I approve [name]", or do you need confirmation that the software has automatically performed a few simple steps (cf e.g. crypto.stackexchange.com/questions/9497/…)?
Nov
27
comment Timing attack on modular exponentiation
If there are conditional branches, you can't rely on it being constant time. In worst case the second alternative is just out of the instruction cache, and has to be loaded prior to execution, at each step. The algorithm here en.wikipedia.org/wiki/… is misleading. In order to get to constant time, you have use a constant time swap on the intermediates first, perform the square and mul and store it in temps, and swap the temps prior to assigning back to the intermediates.
Nov
21
comment Private Information Retrieval with a pre-prepared database
I am asking for functions $E$, $F$ and $D$, such that, for a set of records $\{r_j\}$, where, for some $i$, $r_i = E_U(m_U)$, then $m_U = D_U(F_U(\{r_j\}))$. Trivially, if $F$ simply consists in concatenating all records of the encrypted database, then $S$ will not learn $i$ by being asked by $U$ to perform $F_U$ on the entire database. My question is whether there exists more efficient functions.
Nov
21
comment Private Information Retrieval with a pre-prepared database
That is incorrect, I am asking for a protocol in which $S$ will not learn which item $U$ retrieves. We might assume the cipher text of the public key encryption is indistinguishable from uniform in the conventional sense.
Nov
21
comment Private Information Retrieval with a pre-prepared database
AFAICT, the paper you refer to in your last paragraph describes a protocol where $U$ and $TP$ negotiates the query in real time. I am however interested in a protocol where $TP$ and $U$ do not communicate at all, save for the exchange of long term public keys. That is, $TP$ is able to pick the query without communicating with $U$.
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
Surely there are better references, if we are discussing what to prove and how? For instance, in "Hashing Functions can Simplify Zero-Knowledge Protocol Design (too)", Damgård et all 1994, a definition of Perfect Zero-Knowledge wrt a Honest Verifier is given. My understanding is that there is a plethora of definitions in the literature. Maybe that was your point too?
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
I though Perfect Zero Knowledge was defined as security from an adaptive dishonest verifier. What is to be proved is that $s$ is uniformly distributed, even if we don't make it as our first assumption that $c$ is uniformly distributed.
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
@K.G.: Quite right, I do not prove perfect zero-knowledge (see the request for clarification in my comment to the OP).
Sep
28
comment Perfect zero knowledge for the Schnorr protocol?
The purpose of selecting $e \in \{0,1\}$ Schnorr protocol, is to reveal a dishonest prover (who has one authentic transcript but doesn't know the value of $x$) with a certain probability after a certain number of executions of the protocol. This means the protocol has to be played out in $2log_2(q)/2$ consecutive steps, to get the same level of assurance (that the prover knows $x$) that you would get from a single execution of the protocol if $e$ is selected uniformly from $\mathbb Z_q^*$.
Sep
27
comment What makes RSA secure by using prime numbers?
@poncho: Right, thanks, the implication goes the other way. Obviously, $d = 65$ satisfies $5d = 1 \pmod {\phi(133)}$.
Sep
23
comment Is the inverse of a secure PRP, also a secure PRP?
@RickyDemer: Quite right, the security model outlined in that paper entails that the adversary must have no better than a 0.5 probability to predict how the last two blocks in the code book are permuted. No feistel cipher is secure in that model. Arguably, neither is AES-128, since a (hypothetical) adversary that is able to process $2^{128}-2$ blocks, is implicitly also able to mount a brute force search of the key.
Sep
20
comment Is the inverse of a secure PRP, also a secure PRP?
@D.W.: AFAIK the strongest notion would be that the adversary in fact has the entire code book and is only limited by a linear function of the size of the code book. This notion might make more sense in the case of block ciphers with a 64 bit block size, but theoretically it ought to be stronger than both of the notions you mention.
Sep
18
comment Can PBKDF2 be used to create an XOR cipher key to encrypt random plaintext?
@rath: Indeed, if the PBKDF doesn't produce pseudo random output because the internal function used as the "PRF" has a flaw, the crypto would be broken even if the derived key was used for a proper symmetric cipher.
Sep
14
comment RSA key pair generation using PRNG with same seed
@owlstead: No problem, edit away, but perhaps you should narrow down your question, so that it becomes clear my then last paragraph is the adequate answer.
Sep
10
comment Could RDRAND (Intel) compromise entropy?
The point being raised by Dale Emmons here change.org/en-GB/petitions/… is that the hardware random bits are fetched after the other entropy has already been both collected and processed. This means that one might question the claim that the chosen string is really XORed with an unknown string.
Sep
10
comment Should new applications still use RSA? Is it worth going down the ECDH route for protocols?
Could you provide some details about which "breakthroughs" everyone is talking about? It should be noted that neither RSA nor ECC are secure for post-quantum cryptography.
Sep
10
comment Security of S/MIME in case of CA compromise
In the case we got access to several 3rd parties of which at most a limited number are hostile, some readily available alternatives ought to be using cross-signed certificates; multiple PKCS#7 counter-signatures; or PGP keys.
Sep
10
comment Security of S/MIME in case of CA compromise
I take it that you are not aware of any formal security model, in which either Alice and Bob, or Mallory, by adding a few steps can get provable security against the respective adversary?
Sep
9
comment Security of S/MIME in case of CA compromise
I am inclined to accept this answer, since it is indeed a valid conclusion from my assumptions. But are my assumptions and my usage of the term "relatively secure" really that unproblematic?
Sep
9
comment Security of S/MIME in case of CA compromise
@Nemo: Are Alice and Bob a threat to the transparency of Mallory, only if the attack is large scale, Alice and Bob have an out-of-band channel, and they go the extra length to somehow compare the cipher text?