17,730 reputation
32063
bio website
location
age
visits member for 2 years, 8 months
seen 9 hours ago

Mar
13
asked Traitor-tracing PRF
Mar
13
accepted Private set intersection, using a semi-trusted server
Mar
13
answered How to best mix two arbitrary/random n-bit words?
Mar
13
answered Do any one-key-of-many cryptographic schemes exist?
Mar
13
answered Linear Cryptanalysis - possible without plaintext?
Mar
13
answered Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
Mar
13
revised Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
Clean up the question. Improve the latex. Eliminate unnecessary parenthesis, avoid gratuitous \big's. Generalize and focus the question slightly.
Mar
13
answered Are there use cases where a signature itself needs to be signed?
Mar
13
awarded  Popular Question
Mar
12
awarded  rsa
Mar
12
awarded  Enlightened
Mar
11
awarded  Nice Answer
Mar
11
revised Private set intersection, using a semi-trusted server
Clarify that S* is computed locally.
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, yup! Isn't that exactly the scheme I described in the body of the question? Or am I misunderstanding something? Thank you for all your help thinking through this!
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, if it would help for Alice and Bob to have a shared secret, feel free to assume they have one. That's not unreasonable.
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, yes, the elements have relatively low entropy (say, 10-40 bits). Therefore, applying a deterministic unkeyed one-way hash function would be highly insecure, because it's so easy to brute-force them, as you say. The use of a (keyed) PRF helps with this particular problem -- but maybe there is an even better or more secure solution?
Mar
11
asked Private set intersection, using a semi-trusted server
Mar
2
answered NTRU crypto from unseen.is; myth busting help
Mar
2
revised If $G'(s)=G(s0^{|s|})$ and $G$ is a PRNG, is $G'$ necessarily a PRNG?
Fix typo.
Feb
28
comment ElGamal signature without calculating the inverse
Nice scheme! For the curious: You are right, it is not secure. Let $(\gamma,\delta)$ be a valid signature on the message $x$. Then $(\gamma^2,\gamma \delta)$ will be a valid signature on the message $\gamma x/2$. (This works as long as either $\gamma$ or $x$ is even.) Therefore, the scheme is not secure against existential forgery. Your answer still seems like a good response to the textbook question, though.