Reputation
939
Top tag
Next privilege 1,000 Rep.
Edit questions and answers
Badges
5 7
Newest
 Yearling
Impact
~11k people reached

Aug
13
answered Why is it good to split a CTR-mode counter into nonce and counter?
Aug
7
comment Signatures with Hybrid Encryption
If sign-then-encrypt works generically with any public-key encryption scheme, then it will work with a hybrid encryption scheme since hybrid encryption is just one way to obtain public-key encryption.
Aug
4
comment can cramer-shoup public key have two difefrent private key?
Cramer-Shoup security proof characterizes what an attacker should know, and indeed it is important in the security proof that the attacker doesn't know $\log_{g_1} (g_2)$ so we can apply the DDH property. But the secret-key holder can know this value, no problem (there is no security that needs to hold against the secret-key holder).
Aug
4
answered Is Cramer-Shoup backdoorable?
Aug
2
awarded  Yearling
Jul
23
awarded  Taxonomist
Jan
23
comment display an image encrypted with ECB
See this blog post for a detailed account of how to generate ECB penguins
Jan
14
answered Difference between Pseudorandom Function vs randomly chosen function
Aug
2
awarded  Yearling
Aug
2
awarded  Yearling
Aug
1
comment a possibly stronger type of attack on identity-based encryption
I've not read it, but judging by the title this paper seems to address this exact situation: Bellare, Waters, Yilek: Identity-Based Encryption Secure against Selective Opening Attack.
Jul
31
comment Practical consequences of using functional encryption for software obfuscation
To be clear, expressing a program as a boolean circuit is just a prerequisite to obfuscation, and is not meant to impart any security itself (not sure if that's implicit in your comment). Any polynomial-time program (Turing machine) can be encoded as a polynomial-sized circuit. Of course there is a big (but poly) overhead, so it depends on what you mean by "extremely inefficient" (theoretician's definition or something informal). For the particular case of multiplying integers, that's something that computer engineers have been doing for ages: en.wikipedia.org/wiki/Binary_multiplier
Jul
31
answered Practical consequences of using functional encryption for software obfuscation
Jul
13
answered A block cipher with independent keys for each round
Jul
3
revised Construct a random permutation from a random function?
added 481 characters in body
Jul
3
answered Construct a random permutation from a random function?
Jun
10
comment Proofs of security methodologies
The UC framework is an instance of the "simulation-based" paradigm for security definitions. This paradigm first appeared in Goldreich, Micali & Wigderson (STOC 87), building on work of Goldwasser, Micali & Rackoff (STOC 85). The general idea is that, in contrast to defining a security game with one adversary in terms of a success probability, one defines a "real" interaction and asks that for every adversary there exist a simulator, operating in an "ideal" interaction that can achieve the same effect. Not all simulation-paradigm definitions have the composability properties of UC.
May
16
answered Is Functional Encryption about Access Control over encrypted data alone?
May
7
revised Indistinguishability attack example
resolve ambiguity about $m_0$
May
7
comment Indistinguishability attack example
If there is a choice of $m^{(0)}$ and $m^{(1)}$ that does not allow the adversary to distinguish, then the adversary would be pretty dumb to choose those two messages, wouldn't it? Especially when there are choices it can make that do allow it to distinguish.