651 reputation
29
bio website
location
age
visits member for 2 years, 8 months
seen Apr 16 at 14:10

Apr
11
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
@poncho: If the problem is easy, then my question is meaningless.
Apr
8
comment Is there a malleable pubkey digital signature scheme?
Corrected. Are there more trivial solutions?
Apr
8
comment Is there a malleable pubkey digital signature scheme?
OK. Now I have cleared my mind and I re-wrote the whole question. At least now I can be told it's impossible.
Apr
8
comment Is there a malleable pubkey digital signature scheme?
Not seems to be related to multi-signatures. I try to build a signature which has plausible deniability: If I sign a document I can always claim it was signed by another unknown party, but still nobody can sign with my pubkey.
Feb
24
comment Attack against modular inversion operation using side-channels?
As stated in the question, the value to be inverted is not secret. The modulus factorization (and phi(m)) are the secret values, so using Fermat's Little Theorem makes inverting similar to an RSA private operation regarding timing attacks.
Dec
16
comment Attack against modular inversion operation using side-channels?
It seems that you solved the problem, while we still don't know if there is a problem or not. I'm sure that someone must have analyzed modinv side-channels in the past...
Dec
15
comment Attack against modular inversion operation using side-channels?
He may be able to measure computing time. He does not have access to the output nor to the modulus. He knows only the value that will be inverted.
Dec
4
comment How hard is to invert the function that computes the middle-bits of (x^2)?
The brute-force attack is obviously a upper bound in the number of computations. It does not help me much to known how much time an attacker will require to invert it.
Dec
2
comment How hard is to invert the function that computes the middle-bits of (x^2)?
Also I'm interested in the number of logic gates it takes to implement the inversion circuit, as compared to the number of logic gates it takes to compute f.
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
I said clearly in the question that I needed a practical computing difference between F and F^-1, not unfeasibility. Maybe the question does not belong to crypto, then where?
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
What about making the word length big enough, like using a T-function of 64 bits in a 64-bit CPU? I think inverting it may take at least k*64 machine instructions, while generating it may take only 3 instructions. E.g. F(x) = x + (x^2 v 5)
Nov
15
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Ok. so shuffling adds nothing.
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
If you agree, then I will edit the answer to reflect these ideas.
Nov
14
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
Yes. My answer was missing some info. I said "using" a T-function, but I didn't said how. Let T1.. Tn be T-functions. Let S1..Sn be fixed bit-shuffles. Then F=(T1 o S1 o T2 o S2 .... Tn o Sn) should be hard to invert. What do you think?
Nov
11
comment Are there any bijective one-way functions not based on number-theoretic hardness assumptions?
The function is for a special kind of Proof-of-work. Currently I'm using a hash function using the subset of invertible values of the domain. But this is far from perfect.
Jul
8
comment Is there a practical zero-knowledge proof for this special discrete log equation?
To clarify: Since the proof must be practical, I can accept a proof in ROM (using Fiat-Shamir heuristic, for example). I could even accept a proof of knowledge that is not zero knowledge. The key is that is must be practical, and secure regarding some standard security assumptions. Thanks.
Mar
11
comment Can one detect if two pairs of elements in Zp have the same exponential relation?
@poncho: Thanks
Mar
11
comment Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
Step 4 is ambiguous, as some other steps. IMHO you should write a technical paper and publish it. Even in that case, analyzing a transport protocol is not an easy task, so it's rarely done for free.
Mar
11
comment Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
You're leaving out of the description many important details that are relevant to the protocol security, such as how the message length is sent. Is it encrypted? How? Is is sent in clear text? How is padding specified? It's specified by the AE method used or by any other means?
Mar
11
comment Can one detect if two pairs of elements in Zp have the same exponential relation?
Great pointer! thanks!