Reputation
21,859
Next tag badge:
98/100 score
23/20 answers
Badges
4 29 79
Impact
~467k people reached

Apr
26
revised Zero-knowledge proof of a product
added 123 characters in body
Apr
26
comment Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
@fgrieu, awesome, thank you for the detailed comments! Would you like to either create your own answer or to edit this answer into a form that addresses these issues? I'm not quite sure how to take into account the first issue you mention (about 1% chance of success), so would need help on that. Thank you again!
Apr
26
revised Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Incorporate comments from fgrieu
Apr
26
comment Can I prove set membership and uniqueness without revealing the element?
P.S. I see: the Wikipedia article on commitment schemes is a bit sucky, and it has led you astray. Wikipedia seems to imply that $C(x)=g^x$ is a commitment scheme, but in fact, that's not a good commitment scheme. The Wikipedia article does go to admit that such a scheme is not hiding, but it fails to connect the dots and realize this means that the scheme wasn't a (secure) commitment scheme after all, and thus does not make a good example of a commitment scheme. So, don't rely upon Wikipedia as your main source of information about commitment schemes.
Apr
26
comment Can I prove set membership and uniqueness without revealing the element?
@DrLecter, yeah, you definitely have a misconception about commitment schemes. $g^a$ is not a secure commitment to $a$. It is not hiding (neither computationally hiding nor information-theoretically hiding). As a result, it is not classified as a secure commitment scheme. A secure commitment scheme must be both binding and hiding. Therefore, what you are talking about is not a DL commitment -- it's not a commitment at all; it's just a broken thing that doesn't work. Of course, when I mention using a commitment scheme, I assume you use a secure commitment scheme, not something broken.
Apr
25
comment Can I prove set membership and uniqueness without revealing the element?
@DrLecter, I think you have a confusion/misconception about DL commitments. I'm not sure what specifically you have in mind when you mention "DL commitments", but any commitment scheme (whether information-theoretically hiding or computationally hiding) will conceal what was committed to -- nothing is leaked. It doesn't matter whether the value being committed to is low entropy or not; secure commitment schemes promise not to leak what was committed, even if the value has low entropy. If it's not hiding, it's not a secure commitment scheme. For instance, $C(x)=g^x$ isn't secure.
Apr
25
revised Can I prove set membership and uniqueness without revealing the element?
Fix bugs with wrap-around modulo q.
Apr
25
revised Timestamping using a hashed linked list and public known events
added 453 characters in body
Apr
25
comment Nonlinearity of the J-K Flip Flop
@WilliamHird, I think you might have a misconception. It sounds like you want to design a secure stream cipher, and your approach is to try to find a function that in isolation has some combinatorial properties. This has two problems: (1) to design a secure stream cipher, you need to look holistically at the entire design; you can't just pick out one component/function used in the stream cipher and say that "since it has properties X,Y,Z, the cipher is secure"; (2) designing secure ciphers is very hard, and you're unlikely to do better than existing state-of-the-art schemes.
Apr
25
answered Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Apr
25
asked Multiple-prime RSA; how many primes can I use, for a 2048-bit modulus?
Apr
25
asked Zero-knowledge proof of a product
Apr
25
answered Can I prove set membership and uniqueness without revealing the element?
Apr
25
answered Can we parallelize the Feistel Networks?
Apr
25
answered Timestamping using a hashed linked list and public known events
Apr
21
comment Stateless hash based public key cryptography?
@HenrickHellström, the blog post (the first URL) has some more details. We save only the first level -- that's generated during key generation and treated as part of the private key. We regenerate the subtrees on the fly as needed. How are they generated? They can be generated via a GGM construction from a seed (e.g., computed as a PRF of some master key that's part of the private key, plus an identifier that identifies which subtree we're looking at). There's no need to save the subtrees, since they can be generated deterministically on demand as needed. Does that answer your questions?
Apr
21
answered Stateless hash based public key cryptography?
Apr
20
answered MAC security and adversaries with memory
Apr
17
comment Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?
Can you explain what you mean by "compose the modulus of some other quadratic ring"? Do you mean that instead of multiplying two integers to get the modulus, we multiply two elements of some quadratic ring? Have you worked out what the corresponding version of Euler's lemma is? What is the order of the multiplicative group of such rings? What's the motivation for your question? Are you hoping to get a cryptosystem that will be faster than RSA, for a given security level?
Apr
16
comment Are there any elliptic curve asymmetric encryption algorithms?
Thanks, DrLecter! Makes sense! On re-reading the question, the question is not as clear as I initially thought. The question says "Is there an algorithm which employs elliptic curve cryptography, fast asymmetric encryption, [...]" - I took that to mean it wants the encryption operation to be fast, like in RSA, but it's entirely possible that might not be the right reading. Perhaps the original author will take a moment to edit the question and make what he/she is looking for clearer.