Reputation
767
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 14
Newest
 Nice Answer
Impact
~11k people reached

  • 0 posts edited
  • 1 helpful flag
  • 19 votes cast
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
I said clearly in the question that I needed a practical computing difference between F and F^-1, not unfeasibility. Maybe the question does not belong to crypto, then where?
Nov
15
revised Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Adds nothing
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
What about making the word length big enough, like using a T-function of 64 bits in a 64-bit CPU? I think inverting it may take at least k*64 machine instructions, while generating it may take only 3 instructions. E.g. F(x) = x + (x^2 v 5)
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Ok. so shuffling adds nothing.
Nov
14
revised Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Text was misleading. Badly written.
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
If you agree, then I will edit the answer to reflect these ideas.
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Yes. My answer was missing some info. I said "using" a T-function, but I didn't said how. Let T1.. Tn be T-functions. Let S1..Sn be fixed bit-shuffles. Then F=(T1 o S1 o T2 o S2 .... Tn o Sn) should be hard to invert. What do you think?
Nov
14
accepted Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Nov
14
answered Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Nov
11
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
The function is for a special kind of Proof-of-work. Currently I'm using a hash function using the subset of invertible values of the domain. But this is far from perfect.
Nov
7
asked Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Aug
3
awarded  Yearling
Jul
24
accepted Is there any weak message for an ECDSA signature?
Jul
22
asked Is there any weak message for an ECDSA signature?
Jul
8
comment Is there a practical zero-knowledge proof for this special discrete log equation?
To clarify: Since the proof must be practical, I can accept a proof in ROM (using Fiat-Shamir heuristic, for example). I could even accept a proof of knowledge that is not zero knowledge. The key is that is must be practical, and secure regarding some standard security assumptions. Thanks.
Mar
11
comment Can one detect if two pairs of elements in Zp have the same exponential relation?
@poncho: Thanks
Mar
11
accepted Can one detect if two pairs of elements in Zp have the same exponential relation?
Mar
11
comment Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
Step 4 is ambiguous, as some other steps. IMHO you should write a technical paper and publish it. Even in that case, analyzing a transport protocol is not an easy task, so it's rarely done for free.
Mar
11
comment Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
You're leaving out of the description many important details that are relevant to the protocol security, such as how the message length is sent. Is it encrypted? How? Is is sent in clear text? How is padding specified? It's specified by the AE method used or by any other means?
Mar
11
answered Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy