790 reputation
37
bio website
location
age
visits member for 3 years, 4 months
seen yesterday

Aug
2
awarded  Yearling
Aug
2
awarded  Yearling
Aug
1
comment a possibly stronger type of attack on identity-based encryption
I've not read it, but judging by the title this paper seems to address this exact situation: Bellare, Waters, Yilek: Identity-Based Encryption Secure against Selective Opening Attack.
Jul
31
comment Practical consequences of using functional encryption for software obfuscation
To be clear, expressing a program as a boolean circuit is just a prerequisite to obfuscation, and is not meant to impart any security itself (not sure if that's implicit in your comment). Any polynomial-time program (Turing machine) can be encoded as a polynomial-sized circuit. Of course there is a big (but poly) overhead, so it depends on what you mean by "extremely inefficient" (theoretician's definition or something informal). For the particular case of multiplying integers, that's something that computer engineers have been doing for ages: en.wikipedia.org/wiki/Binary_multiplier
Jul
31
answered Practical consequences of using functional encryption for software obfuscation
Jul
13
answered A block cipher with independent keys for each round
Jul
3
revised Construct a random permutation from a random function?
added 481 characters in body
Jul
3
answered Construct a random permutation from a random function?
Jun
10
comment Proofs of security methodologies
The UC framework is an instance of the "simulation-based" paradigm for security definitions. This paradigm first appeared in Goldreich, Micali & Wigderson (STOC 87), building on work of Goldwasser, Micali & Rackoff (STOC 85). The general idea is that, in contrast to defining a security game with one adversary in terms of a success probability, one defines a "real" interaction and asks that for every adversary there exist a simulator, operating in an "ideal" interaction that can achieve the same effect. Not all simulation-paradigm definitions have the composability properties of UC.
May
16
answered Is Functional Encryption about Access Control over encrypted data alone?
May
7
revised Indistinguishability attack example
resolve ambiguity about $m_0$
May
7
comment Indistinguishability attack example
If there is a choice of $m^{(0)}$ and $m^{(1)}$ that does not allow the adversary to distinguish, then the adversary would be pretty dumb to choose those two messages, wouldn't it? Especially when there are choices it can make that do allow it to distinguish.
May
6
comment Indistinguishability attack example
I think juaninf may be talking about $m_0$ and $m_1$ as two blocks in one of the plaintexts, in which case he is obviously on a better track. I revised the question to resolve the ambiguity of notation. The two choice messages in the security definition experiment are now $m^{(0)}$ and $m^{(1)}$, while $m_0$, etc refer to blocks of a single plaintext (so one could talk about $m^{(0)}_k$). Maeher: If you like the notation, perhaps consider updating your response?
May
6
suggested approved edit on Indistinguishability attack example
Apr
28
comment Question about proof of knowledge defintion?
$p(x)$ and $\kappa(x)$ are probabilities, but they are in the denominator. Think of $1/(p(x)-\kappa(x))$ as the expected number of trials to get a success, when the probability of success is $p(x) - \kappa(x)$; In this case, that quantity corresponds to the probability that "$P$ convinces $V$ and $P$ knows the secret.''
Apr
22
comment Connections between Instance Hiding and Fully Homomorphic Encryption
You are claiming that fhe_add and fhe_mul actually do nothing more than interpret ciphertexts as numbers, and just add and multiply those numbers? I encourage you to actually look at the source code of these functions to see how much stuff actually has to happen in order to multiply ciphertexts. In some schemes, yes, homomorphic addition is really an addition operation over ciphertexts, but it's a different operation than addition of plaintexts. For one, the plaintexts are integers mod 2, and ciphertexts are vectors over a larger modulus. Again, different operations!
Apr
22
comment Connections between Instance Hiding and Fully Homomorphic Encryption
Your comment and your edits don't seem relevant to anything in my answer, which I still believe is the correct answer to your question. Is there something specific about my answer that didn't make sense? $f(y)$ and $\text{Eval}(y,f)$ -- where Eval is the homomorphic evaluation procedure from an FHE -- are different operations. The AFK setting does not permit Bob to do the latter in order to help Alice learn $f(x)$, so none of the AFK impossibility results are relevant to outsourced computation using FHE (among other reasons).
Apr
22
awarded  Commentator
Apr
22
answered Connections between Instance Hiding and Fully Homomorphic Encryption
Mar
18
answered Solving congruences using PARI