Reputation
1,423
Next privilege 1,500 Rep.
Approve tag wiki edits
Badges
4 15
Newest
 Yearling
Impact
~9k people reached

Aug
19
comment Example describing Baek and Zheng’s threshold identity-based decryption scheme
$k_3$ might be $12$ instead of $4$.
Jun
16
comment pseudo random generator from length preserving one way function which is not permutation!
Read the HILL paper or related papers.
Apr
17
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
Thank you for pointing out my mistake. Well, I correct the form of the signature. But, please notice that the attack I described does not require knowledge of $k_1$.
Apr
6
comment Pseudorandom Function Proof
what happens if I query x=011...1 to your second candidate?
Feb
24
comment Randomness re-use in LWE encryption scheme
I'm sorry that I omit the details. I used the generalized leftover hash lemma, instead of the leftover hash lemma. Since $rb$ leaks $\log{q}$-bit information of $r$, I set $m \geq (n+2) \log q\ \ldots$ instead of $m \geq (n+1) \log q\ \ldots$. I'll add more explanations.
Feb
23
comment Zero Knowledge Non Interactive Proof with random oracle
Hint: Notice that the simulator can program the random oracle and the original protocol is honest-verifier ZK.
Aug
4
comment Public key in fully homomorphic encryption over the integers
What happens if you set it even?
Jul
24
comment Universal hashing techniques based on matrix multiplication
Proving \epsilon-universality of random matrix hashing sounds an execise. I once found proofs in Shoup's textbook.
Jun
1
comment Reductionist proofs of decisional problems to computational
Do you need more explanation or easier one, e.g., "SearchLWE vs DecisionalLWE"?
May
27
comment Is there a public-key cryptography method that enables public keys to be much smaller than private keys?
Stretching a secret key often appears in the context of leakage-resilient cryptography.
Apr
22
comment Key construction in the Full Cramer-Shoup cryptosystem
Could we change the scheme? If so, there is a chance.
Apr
17
comment Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?
Note: Scheidler-Williams (DCC 1995) and Takagi-Naito (IEICE Trans. J81-A1, 19980in Japanese) may be relaed to this question and discuss security.
Apr
10
comment An example of Knapsack Cryptosystem cracks/attacks?
Try M = ...; M.LLL(); or M.BKZ()
Apr
9
comment Locally Dedcodable Codes and Private Information Retrieval
What is your question? PIR should hide an index in the query, while LDC needs not. There's a (little) gap.
Apr
4
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
No. It is contained in the list $\mathcal{Y}$ with $c_2^*$.
Apr
3
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
Hint: Inv stands for inversion. Check the meaning of $c_1^*$ and the claim on Pr[1].
Mar
24
comment Is a random oracle controled by the challenger?
What do you mean by "control"? Do you mean programmability that allows a challenger to program the table of the hash function? Or, observability?
Mar
16
comment What functions allow for practical indistinguishability obfuscation?
Note: The simplest one is a class that allows us to compute a normal form of a circuit efficiently. The class of log size circuits seems ok for iO without any assumptions.
Feb
26
comment PRP, PRF and modular arithmetic
Correctly speaking, the size of domain $2^{\ell}$ should be small, because the construction is based on $2^{\ell}$-DBDHI assumption.
Feb
25
comment PRP, PRF and modular arithmetic
Do you want DDH/RSA-based PRFs? If so, we have them and I will answer.