1,278 reputation
313
bio website xagawa.net
location
age
visits member for 2 years, 3 months
seen 11 hours ago

Jul
24
comment Universal hashing techniques based on matrix multiplication
Proving \epsilon-universality of random matrix hashing sounds an execise. I once found proofs in Shoup's textbook.
Jun
1
comment Reductionist proofs of decisional problems to computational
Do you need more explanation or easier one, e.g., "SearchLWE vs DecisionalLWE"?
May
27
comment Is there a public-key cryptography method that enables public keys to be much smaller than private keys?
Stretching a secret key often appears in the context of leakage-resilient cryptography.
Apr
22
comment Key construction in the Full Cramer-Shoup cryptosystem
Could we change the scheme? If so, there is a chance.
Apr
17
comment Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?
Note: Scheidler-Williams (DCC 1995) and Takagi-Naito (IEICE Trans. J81-A1, 19980in Japanese) may be relaed to this question and discuss security.
Apr
10
comment An example of Knapsack Cryptosystem cracks/attacks?
Try M = ...; M.LLL(); or M.BKZ()
Apr
9
comment Locally Dedcodable Codes and Private Information Retrieval
What is your question? PIR should hide an index in the query, while LDC needs not. There's a (little) gap.
Apr
4
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
No. It is contained in the list $\mathcal{Y}$ with $c_2^*$.
Apr
3
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
Hint: Inv stands for inversion. Check the meaning of $c_1^*$ and the claim on Pr[1].
Mar
24
comment Is a random oracle controled by the challenger?
What do you mean by "control"? Do you mean programmability that allows a challenger to program the table of the hash function? Or, observability?
Mar
16
comment What functions allow for practical indistinguishability obfuscation?
Note: The simplest one is a class that allows us to compute a normal form of a circuit efficiently. The class of log size circuits seems ok for iO without any assumptions.
Feb
26
comment PRP, PRF and modular arithmetic
Correctly speaking, the size of domain $2^{\ell}$ should be small, because the construction is based on $2^{\ell}$-DBDHI assumption.
Feb
25
comment PRP, PRF and modular arithmetic
Do you want DDH/RSA-based PRFs? If so, we have them and I will answer.
Feb
6
comment Help in understanding exactly how lattices used as one way functions for hashing
The note you refer starts from the definition of the Ajtai hash functions. What does confuse you?
Feb
6
comment Help in understanding exactly how lattices used as one way functions for hashing
There are six questions and the final one is on encryption. Can you divide them?
Feb
2
comment Bandwidth and block size for Paillier cryptosystem
Hi curious. The ciphertext length is log n^2 and that of plaintext is log n. Hence we got 1/2.
Feb
2
comment Is the Couvreur et al. polynomial time attack on McEliece practical?
The target of the attack is a wide class of algebraic geometry codes, while the binary Goppa code is a subcode of them. It seems hard to apply the attack to the subcode case.
Dec
10
comment Can you provide an example in relation to Hidden Field Equations Multivariate?
When $r$ is small, the degree of $P$ is at most $2q^{r-1}$. We assume this value is small. You can find several algorithms to find the root of P in textbooks on computer algebra or find programs implementing them; sage, pari, and so on.
Dec
4
comment Why can an RSA signature be authenticated ONLY with the signer's public key?
The papers, S. Blake-Wilson and A. Menezes, "Unknown key-share attacks on the Station-to-Station (STS) protocol" (PKC'99) and A. Menezes and N. Smart, "Security of Signature Schemes in a Multi-User Setting " (Designs, Codes, and Cryptography. 2004), considered the similar situation.
Dec
2
comment Why use two affine transformations in Multivariate Cryptography?
note that, in some signature schemes like UOV, the proposers omit $B$.