Reputation
486
Next privilege 500 Rep.
Cast close & reopen votes
Badges
2 4
Newest
 Commentator
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 5 votes cast
1d
answered How to decrypt a PGP message with only the two primes and the public exponent?
1d
answered About Primitive roots mod n in Diffie-Hellman
May
22
comment one-way deterministic hash for low entropy input?
Here's how facebook does it : twitter.com/filosottile/status/552830697942319105 Note - they use a salt, which you really should consider as well.
Apr
23
revised Is it an example of bilinear pairing?
added 549 characters in body
Apr
23
answered Is it an example of bilinear pairing?
Apr
17
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Thanks. Getting a "not" wrong is always the worst kind of mistake ... edited.
Apr
17
revised Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
deleted 4 characters in body
Apr
17
answered Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Apr
17
awarded  Commentator
Apr
17
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
I think you're right, but here's a case your formal definition will have to exclude. (Some of Bellare's games use failure events that depend on the internal state of the game.) Suppose $G_1$ begins by picking a bit $b$. Then, it inputs a bit $b'$ from the adversary. Some more interaction may follow. The adversary ends the game by outputting a guess $b''$ at $b$. Now define the event $F$ to be a collision between $b$ and $b'$ which is kind of "a priori" and consider a particular adversary for whom $b' = b''$ always holds. Same situation as above?
Apr
16
awarded  Yearling
Apr
15
answered Secure ElGamal with OAEP
Apr
14
comment What do these notations mean in the definition of Perfect Secrecy, if we read those in English?
Capital $M, C$ are random variables. The experiment is the following: pick $m$ from some probability distribution on the message space, create a key $k$ with Gen then create $c = Enc_k(m)$ and output $c$.
Apr
14
awarded  Editor
Apr
14
revised Weaker alternative to Ed25519?
added 455 characters in body
Apr
14
answered Weaker alternative to Ed25519?
Apr
14
comment Secure ElGamal with OAEP
Any reason not just to use Cramer-Shoup? That's a CCA2 extension of ElGamal and doesn't even require random oracles.
Apr
14
comment Weaker alternative to Ed25519?
Which export regulations?
Apr
14
answered Value of S and r in Fiat-Shamir Protocol
Apr
14
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Ok, so here's a counter-example (I think) to the original claim. Let $G_0$ be a game that picks a bit $b$ at random and outputs it; you win by guessing $b$ so $Pr[S_0] = 1$. Let $G_1$ be the game that picks $b$ at random but does not output it, so $Pr[S_1] = 1/2$. Now let $F$ be the event that the adversary guesses incorrectly in game 1. We have $Pr[F] = 1/2$ and $Pr[S_1|\neg F] = Pr[S_0] = 1$ yet $Pr[S_0]$ and $Pr[S_1]$ are not close.