4,655 reputation
1722
bio website
location
age
visits member for 2 years, 2 months
seen 2 hours ago

Aug
17
comment Voting scheme where the votes become public when a threshold is reached
@mikeazo: Most e-voting schemes are based on the premise that the individual votes should be kept secret even after counting has ended, but this is not how this question has been put: The votes are supposed to become public once the threshold has been reached. This is of course an unusual requirement for public elections, but not for e.g. board meetings.
Aug
16
comment Voting scheme where the votes become public when a threshold is reached
@e-sushi: I think the key phrase in the question is "authority free", which rules out a central server that has to be explicitly trusted by the participants. Electronic voting is a topic in cryptography crypto.stanford.edu/pbc/notes/crypto/voting.xhtml. However, I do agree that the question should be edited by the OP to include more details about the exact requirements.
Aug
16
comment Voting scheme where the votes become public when a threshold is reached
@e-sushi: You might be mistaken. The OP asks for an authority free scheme, and your solution would require an authority to count the votes and keep them secret until the threshold has been reached.
Aug
16
comment Could this be a valid variation of the Schnorr protocol?
@LRM: No, it doesn't. It just means that it is essential that $P$ chooses $r$ uniformly at random each time the protocol is played out.
Aug
16
comment Could this be a valid variation of the Schnorr protocol?
@LRM: I think it is better that I edit my answer, to avoid too many comments.
Aug
16
comment MIT says: mathematical theory behind encryption is wrong. What are the consequences?
As far as I can tell, the paper contains nothing that hasn't already been accounted for in modern cryptography, since, well, at least the 1970's.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseid: If $s \neq rc + x = log_g(t)c + log_g(y)$, then $g^s \neq t^cy$ as well, presuming only that $t$ and $y$ belong to the same cyclic subgroup that is generated by $g$, which is something $V$ might test.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: $r = log_g(t)$ and $x = log_g(x)$. There is no assumption in my answer that the adversary $A$ knows either of these value, just that the arithmetic relation is objectively true.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: Yes, that is the whole point, isn't it?
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
@Perseids: Your comment is a bit unclear. It doesn't matter if $A$ actually knows $r$ and $x$ or not. The logical requirement such an adversary can be turned into an adversary $A'$ that impersonates $P$ using the original formula, is that the challenge $c$ provided by $V$ is invertible. The law of distributivity under addition and multiplication works regardless if you actually know the value of the terms.
Aug
13
comment How to use salt when there is only one user
@Gilles: Quite right, I'll edit my answer.
Aug
13
comment How to use salt when there is only one user
@Gilles: Actually, using a separate key file (as rath suggested in a comment above) is a common way to make it possible to change the passphrase, without having to re-encrypt more than a single, relatively small file.
Aug
13
comment Why is the Pedersen commitment computationally binding?
Quite right, thanks. I hope you didn't miss my main point, though.
Aug
13
comment Why is the Pedersen commitment computationally binding?
Minor addition: The reason the sender can't compute $r'$ is because the $a$ value, such that $h = g^a \mod p$, is supposed to be discarded and forgotten once $h$ has been generated. If the sender is also the one who generated the system parameters, the sender might technically cheat and keep $a$.
Aug
13
comment Is it possible to subtract/multiply numbers using homomorphic encryption?
The formulas in your answer are not consistent with how ElGamal works. Do you mean Paillier? en.wikipedia.org/wiki/Paillier_cryptosystem
Aug
12
comment Pre-image resistant but not 2nd pre-image resistant?
@IlmariKaronen: The question I implied with my first question was if Reid might tighten up the argument that a not "pathological" hash function that is not primary preimage resistant, must lack secondary preimage resistance. I don't know, but it doesn't seem impossible, given a more technical definition of "pathological".
Aug
12
comment Pre-image resistant but not 2nd pre-image resistant?
@IlmariKaronen: The example in HAC is a function $h(x) = 1|x$ if $x$ is $n$ bits long, $h(x) = 0|g(x)$ otherwise. If $g(x)$ is a cryptographic hash function, then $h(x)$ will be collision resistant and secondary preimage resistant, but not primary preimage resistant.
Aug
12
comment How to use salt when there is only one user
@Thomas: Using a key encrypted random encryption key, means that each file is independently keyed. The only consequence is that CBC mode state collisions will be less likely. Should the number of files be very large, this might be something necessary.
Aug
12
comment How to use salt when there is only one user
@rath: You seem to be talking about an implementation detail, but perhaps I am missing something. Why not simply store all information required to decrypt the individual file (except the passphrase, of course) in the individual file itself?
Aug
12
comment Pre-image resistant but not 2nd pre-image resistant?
The easiest way to construct a provably secondary preimage resistant (hash) function, is to choose a bijective function. You might want to expand on that.