4,672 reputation
1722
bio website
location
age
visits member for 2 years, 2 months
seen 50 mins ago

Dec
17
comment Calculation of time to crack SHA-256 hash
Regardless, if you are only interested in a single password (for a specific user), brute force would be fast enough, to make actually programming the attack the most time consuming step, even if you attack by brute force.
Dec
17
comment Calculation of time to crack SHA-256 hash
Is this homework and you want an exact answer, or would "no more than two seconds" do?
Dec
11
comment Pohlig-Hellman exponentiation block cipher
OK, that seems to point to the conclusion that a secure CTR mode would require a way to enumerate the elements of $G$ in a way that is completely independent of the group operation in $G$.
Dec
11
comment Pohlig-Hellman exponentiation block cipher
Why would you define CTR mode that way? A better alternative seems to be $c_i = (g^{r^i})^em_i$. Unless I am mistaken, both $g$ and $r$ might be left public with such a construct.
Dec
7
comment why RSA uses Semiprime numbers?
crypto.stackexchange.com/questions/10590/…
Dec
5
comment Can cryptocurrency mining devices be used for cryptanalysis?
@CodesInChaos: It might not be self-evident that PBKDF2-HMAC-SHA-256 is close to bitcoin mining. Bitcoin mining benefits from parallelization, while PBKDF2 (with a high iteration count) is serial by design. How large a database of intermediate values would you need, in order to not have the device sit idle while it is waiting for the next round?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Well, clearly you have to report something to the party that will reveal the hidden unit. Would a distributed commitment scheme that doesn't reveal any information about the players but might be verified when the game ends help?
Nov
30
comment What would make it impossible to deny that decryption of a package has taken place?
Your example suggests that your problem is similar to the problem of e-cash: How do you spend any of your electronic coins, in such way that it is impossible for you to keep a copy of the same coin and spend it again later? I don't think this can be done completely on one client, without some sort of commitment that are stored in multiple locations.
Nov
29
comment What would make it impossible to deny that decryption of a package has taken place?
Please be more specific. Do you want a receipt that the user has read a license agreement and approved it (use certificates and a digital signature of "[license] I approve [name]", or do you need confirmation that the software has automatically performed a few simple steps (cf e.g. crypto.stackexchange.com/questions/9497/…)?
Nov
27
comment Timing attack on modular exponentiation
If there are conditional branches, you can't rely on it being constant time. In worst case the second alternative is just out of the instruction cache, and has to be loaded prior to execution, at each step. The algorithm here en.wikipedia.org/wiki/… is misleading. In order to get to constant time, you have use a constant time swap on the intermediates first, perform the square and mul and store it in temps, and swap the temps prior to assigning back to the intermediates.
Nov
21
comment Private Information Retrieval with a pre-prepared database
I am asking for functions $E$, $F$ and $D$, such that, for a set of records $\{r_j\}$, where, for some $i$, $r_i = E_U(m_U)$, then $m_U = D_U(F_U(\{r_j\}))$. Trivially, if $F$ simply consists in concatenating all records of the encrypted database, then $S$ will not learn $i$ by being asked by $U$ to perform $F_U$ on the entire database. My question is whether there exists more efficient functions.
Nov
21
comment Private Information Retrieval with a pre-prepared database
That is incorrect, I am asking for a protocol in which $S$ will not learn which item $U$ retrieves. We might assume the cipher text of the public key encryption is indistinguishable from uniform in the conventional sense.
Nov
21
comment Private Information Retrieval with a pre-prepared database
AFAICT, the paper you refer to in your last paragraph describes a protocol where $U$ and $TP$ negotiates the query in real time. I am however interested in a protocol where $TP$ and $U$ do not communicate at all, save for the exchange of long term public keys. That is, $TP$ is able to pick the query without communicating with $U$.
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
Surely there are better references, if we are discussing what to prove and how? For instance, in "Hashing Functions can Simplify Zero-Knowledge Protocol Design (too)", Damgård et all 1994, a definition of Perfect Zero-Knowledge wrt a Honest Verifier is given. My understanding is that there is a plethora of definitions in the literature. Maybe that was your point too?
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
I though Perfect Zero Knowledge was defined as security from an adaptive dishonest verifier. What is to be proved is that $s$ is uniformly distributed, even if we don't make it as our first assumption that $c$ is uniformly distributed.
Sep
29
comment Perfect zero knowledge for the Schnorr protocol?
@K.G.: Quite right, I do not prove perfect zero-knowledge (see the request for clarification in my comment to the OP).
Sep
28
comment Perfect zero knowledge for the Schnorr protocol?
The purpose of selecting $e \in \{0,1\}$ Schnorr protocol, is to reveal a dishonest prover (who has one authentic transcript but doesn't know the value of $x$) with a certain probability after a certain number of executions of the protocol. This means the protocol has to be played out in $2log_2(q)/2$ consecutive steps, to get the same level of assurance (that the prover knows $x$) that you would get from a single execution of the protocol if $e$ is selected uniformly from $\mathbb Z_q^*$.
Sep
27
comment What makes RSA secure by using prime numbers?
@poncho: Right, thanks, the implication goes the other way. Obviously, $d = 65$ satisfies $5d = 1 \pmod {\phi(133)}$.
Sep
23
comment Is the inverse of a secure PRP, also a secure PRP?
@RickyDemer: Quite right, the security model outlined in that paper entails that the adversary must have no better than a 0.5 probability to predict how the last two blocks in the code book are permuted. No feistel cipher is secure in that model. Arguably, neither is AES-128, since a (hypothetical) adversary that is able to process $2^{128}-2$ blocks, is implicitly also able to mount a brute force search of the key.
Sep
20
comment Is the inverse of a secure PRP, also a secure PRP?
@D.W.: AFAIK the strongest notion would be that the adversary in fact has the entire code book and is only limited by a linear function of the size of the code book. This notion might make more sense in the case of block ciphers with a 64 bit block size, but theoretically it ought to be stronger than both of the notions you mention.