SDL

387 reputation

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	Mar 20 at 18:46
stats	profile views	19

	387 reputation	bio	website		visits	member for	1 year, 9 months
19 badges		location			seen	Mar 20 at 18:46

summary answers questions tags badges favorites bounties reputation activity

28 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 11	comment	Can one detect if two pairs of elements in Zp have the same exponential relation? @poncho: Thanks
Mar 11	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy Step 4 is ambiguous, as some other steps. IMHO you should write a technical paper and publish it. Even in that case, analyzing a transport protocol is not an easy task, so it's rarely done for free.
Mar 11	comment	Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy You're leaving out of the description many important details that are relevant to the protocol security, such as how the message length is sent. Is it encrypted? How? Is is sent in clear text? How is padding specified? It's specified by the AE method used or by any other means?
Mar 11	comment	Can one detect if two pairs of elements in Zp have the same exponential relation? Great pointer! thanks!
Mar 11	comment	Can one detect if two pairs of elements in Zp have the same exponential relation? @poncho: Could you clarify, in your equivalence between my problem and DDH, which is g,a,b and c from x1,x2,y1,y2,k1,k2?
Feb 24	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? I inserted the word "standard" in the question.
Feb 22	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? @CodesInChaos: Great!
Feb 22	comment	Why nobody considers counter re-keying as a standard Block Cipher Mode? CodesInChaos: What is k? Can you describe the said multi-target attack more clearly? Maybe add some links? thanx
Nov 2	comment	Is there a practical zero-knowledge proof for this special discrete log equation? @RickyDemer: Ok, question corrected.
Nov 1	comment	Is there a practical zero-knowledge proof for this special discrete log equation? @D.W., I think it can work. At the end, it looks similar to Golle Universal Re-encryption construction, which is: (g^x1,x2⋅(h^x1),g^x3, h^x3). The difference is the "x2" multiplied in the fourth term.
Nov 1	comment	Is there a practical zero-knowledge proof for this special discrete log equation? ElGamal is defined over a multiplicative cyclic group of order q.
Oct 31	comment	Is there a practical zero-knowledge proof for this special discrete log equation? Could you post that commitment format you're proposing? Maybe I can change it and still keep the remaining desired properties of the system. Thanks.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? Also I don't need to prove the decryption. I need to prove the encryption.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? x2 is not known to the verifier.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? Camenisch/Stadler paper "Proof Systems for General Statements about Discrete Logarithms" seems helpful, but I can't adapt my requirements to the system in the paper.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? (a,b) are an ElGamal pair, c is a deterministic commitment to x2, x1 is the ElGamal randomization value, x2 is the plaintext.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? What I didn't specify (for simplification) is that a commitment to m1 or m2 is also produced. Supposing that a disjunctive zero-knowledge is simple to construct, this is an example of a single case: Given (a,b,c) = (g^x1 , x2*(h^x1), h^x2) and (g,h) we must prove knowledge of x1 and x2. Is it clear?
Oct 30	comment	Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs? Nevertheless the same question applies to ElGamal encryption sharing key-pairs with DSA. Can one interfere with the other?
Oct 30	comment	Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs? Could you point out links or papers where the ElGamal signature scheme implementation flaws are discussed? Thanks.
Oct 30	comment	Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs? Unluckily not. Every user must have a single key pair.