Reputation
456
Next privilege 500 Rep.
Cast close and reopen votes
Badges
2 4
Newest
 Commentator
Impact
~2k people reached

2d
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Thanks. Getting a "not" wrong is always the worst kind of mistake ... edited.
2d
revised Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
deleted 4 characters in body
2d
answered Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
2d
awarded  Commentator
2d
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
I think you're right, but here's a case your formal definition will have to exclude. (Some of Bellare's games use failure events that depend on the internal state of the game.) Suppose $G_1$ begins by picking a bit $b$. Then, it inputs a bit $b'$ from the adversary. Some more interaction may follow. The adversary ends the game by outputting a guess $b''$ at $b$. Now define the event $F$ to be a collision between $b$ and $b'$ which is kind of "a priori" and consider a particular adversary for whom $b' = b''$ always holds. Same situation as above?
Apr
16
awarded  Yearling
Apr
15
answered Secure ElGamal with OAEP
Apr
14
comment What do these notations mean in the definition of Perfect Secrecy, if we read those in English?
Capital $M, C$ are random variables. The experiment is the following: pick $m$ from some probability distribution on the message space, create a key $k$ with Gen then create $c = Enc_k(m)$ and output $c$.
Apr
14
awarded  Editor
Apr
14
revised Weaker alternative to Ed25519?
added 455 characters in body
Apr
14
answered Weaker alternative to Ed25519?
Apr
14
comment Secure ElGamal with OAEP
Any reason not just to use Cramer-Shoup? That's a CCA2 extension of ElGamal and doesn't even require random oracles.
Apr
14
comment Weaker alternative to Ed25519?
Which export regulations?
Apr
14
answered Value of S and r in Fiat-Shamir Protocol
Apr
14
comment Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Ok, so here's a counter-example (I think) to the original claim. Let $G_0$ be a game that picks a bit $b$ at random and outputs it; you win by guessing $b$ so $Pr[S_0] = 1$. Let $G_1$ be the game that picks $b$ at random but does not output it, so $Pr[S_1] = 1/2$. Now let $F$ be the event that the adversary guesses incorrectly in game 1. We have $Pr[F] = 1/2$ and $Pr[S_1|\neg F] = Pr[S_0] = 1$ yet $Pr[S_0]$ and $Pr[S_1]$ are not close.
Apr
14
answered What do these notations mean in the definition of Perfect Secrecy, if we read those in English?
Apr
8
awarded  Yearling
Apr
8
answered Fault-based transition for crypto proof (a la Shoup) with big probability of fault - does it work?
Apr
8
answered Zero knowledge-proof for discrete log that is not honest-verifier
Apr
8
answered difference between soundness in ZKPoK and special soundness for sigma proofs