D.W.

8,057 reputation

828

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	21 hours ago
stats	profile views	137

	8,057 reputation	bio	website		visits	member for	1 year, 9 months
828 badges		location			seen	21 hours ago

summary answers questions tags badges favorites bounties reputation activity

903 Actions

suggestions reviews revisions comments badges posts accepts all

Nov 1	comment	Computer appliance protocol Sounds like a question that's better-suited for the IT Security site.
Nov 1	answered	CPA Secure Chosen plaintext scheme
Nov 1	comment	Proving that a scheme is not IND-CPA-secure I think the answer will depend upon the particular textbook you are using, and how they define $\text{Game}^CPA_A$. It sounds to me like your question could be paraphrased as: please help me understand what the definition of IND-CPA security means, and help me work through the details. That's probably going to depend upon the precise formulation of IND-CPA that your textbook or instructor happens to be using.
Oct 31	comment	Is there a practical zero-knowledge proof for this special discrete log equation? @SDL, I was thinking of $\textrm{commit}(x_2) = (g^{x_3}, x_2 h^{x_3})$, but I just now realized this might be problematic: this is binding for everyone, but not concealing against the person who holds the private key (the person who knows the discrete log of $h$ to base $g$ can infer what value was committed to without permission), which I suspect might not meet your needs. So, I withdraw my previous comment. Sorry for my error.
Oct 31	revised	Is there a practical zero-knowledge proof for this special discrete log equation? edited body
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? @SDL, if g,h,x2 are known to the verifier, you should be able to use standard techniques for proof of knowledge of a discrete log. If x2 is not known to the verifier, then I would need to understand better how the scheme works to have an opinion; however, if you have the freedom to pick a different, more convenient commitment scheme, I expect there'll probably be efficient solutions (e.g., using a zk proof that two El Gamal ciphertexts decrypt to the same plaintext).
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? @SDL, I'm puzzled by your statement. I can't think of any mixnet that requires a shared secret. A basic mixnet protocol has only one party: the mixer (who permutes and re-encrypts/decrypts the ciphertexts provided as input, and then proves to the rest of the world that this computation was done correctly). I don't know how familiar you are with mixnets; might it be worth spending a little more time reviewing the variety of schemes and how they work?
Oct 31	answered	Real world use cases of Multi Party Computation
Oct 31	answered	Counter mode secure hash algorithm
Oct 31	answered	Modifications of CBC-MAC
Oct 31	answered	Messages of different lengths and one-time computationally-secret
Oct 31	answered	Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?
Oct 31	revised	Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)? added 978 characters in body
Oct 31	answered	Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)?
Oct 31	answered	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting?
Oct 31	answered	Optimising Pollard's Rho algorithm for large semi-primes
Oct 31	answered	Distinguish messages
Oct 28	comment	What is the complexity of the Square attack against the reduced 4-rounds 128-bit Rijndael variant? Why don't you show us the work you've done so far? You might also want to check out the FAQ, particularly the section titled "Do we accept basic level/homework questions?" and the resources linked to from there
Oct 28	comment	Subgroups generators with respect to group generators of composite order curious, I'd also like to point you to the FAQ, particularly the section titled "Do we accept basic level/homework questions?" and the resources linked to from there.
Oct 26	comment	Does chaining random number generators lead to loss of randomness? Perfect! Thanks for helping me refine the wording to convey my meaning more clearly, @fgrieu. That's exactly what I meant, but you put it better.