20,530 reputation
32573
bio website
location
age
visits member for 3 years, 2 months
seen 16 hours ago

Jan
21
comment Efficiently computing the neutral element in a ring isomorphic to Z/NZ?
If you can select a random element of $S$, and you can multiply in $S$, then a simple algorithm is: factor $N$, then let $x$ be a random element in $S$, and compute $x^{\varphi(N)}$. This is a subexponential time algorithm to compute the element $1$ in $S$. If this isn't allowed in your model, you need to clarify your model. (If $N=\infty$, your problem is not well-defined. For instance, how were you planning to represent ring elements? It's also unlikely to be relevant to crypto. So I suggest you throw that one out.)
Jan
21
comment Efficiently computing the neutral element in a ring isomorphic to Z/NZ?
I'm having a hard time understanding the question. What's given? What are you trying to compute? Am I given an integer $N$, and told that there is some ring $S$ that is isomorphic to the ring $\mathbb{Z}/N\mathbb{Z}$, but I'm given no other information about $S$, and my job is to find the image of $1$ in $S$? That is obviously not solvable. Did you mean to supply some additional side information? For instance, do you have some way of representing elements in $S$, and some black box that can perform addition, multiplication, inversion in $S$, and that can apply the isomorphism function?
Jan
15
comment Oracle DBMS_RANDOM algorithm?
What research have you done? There's lots written in textbooks and on the Internet (and on this site) about the criteria for a PRNG to be fit for cryptography. Also, please, one question per question; you've crammed two different questions into one post.
Jan
13
comment Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?
@fgrieu, yup, it doesn't allow you to verify that a LFSR given to you by someone else is maximal-length. However, as I suspect you already know, if you want to generate a LFSR that others can verify is probably maximal-length, you could seed a deterministic PRNG (DRBG) with a "nothing-up-my-sleeve number", and then use the output of that PRNG as the random numbers for my algorithm. That'll allow anyone else to verify that you've generated the LFSR polynomial in a way that you can't easily bias. The security level will depend on the value of $n$.
Jan
13
comment Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?
@fgrieu, OK, those are good points. I've added those to the algorithm. Setting the constant term and requiring an odd number of taps is just an optimization. (If you choose a polynomial that doesn't have the low bit set, then it'll fail the check that its period divides $2^n-1$ and will be rejected in step 3 of my algorithm.)
Jan
10
comment Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?
For instance, the Unix factor commands factors $2^{320}-1$ in 1.5 seconds, yielding the factorization $2^{320}-1 = 3 \times 5 \times 5 \times 11 \times 17 \times 31 \times 41 \times 257 \times 641 \times 61681 \times 65537 \times 414721 \times 3602561 \times 6700417 \times 4278255361 \times 44479210368001 \times 94455684953484563055991838558081$.
Jan
10
comment Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?
Well, that's a different problem statement. You might do better by asking about the actual problem you want to solve. I think the simplest solution to that problem will involve factoring $2^n-1$. I think you are over-estimating the complexity of that approach. You should be able to factor $2^{320}-1$ using standard tools, without breaking a sweat. (cont.)
Jan
10
comment Maximal-length LFSR with $n$ bits when the factorization of $2^n-1$ is unavailable?
Why would you need a LFSR of length $n=2991$? (1) Why would you need such a long LFSR? (2) Even if you needed a LFSR that has at least 2991 bits of state for some reason I haven't anticipated, why can't you just use a slightly larger LFSR, say $n=2992$?
Jan
10
comment How to prove that a ciphertext is encrypting multiplication of two values?
@curious, about your question on generic proof argument: see the sentence in my answer "It is known that every statement in NP..." Generic proof argument refers to a ZK proof that uses that general result.
Jan
10
comment How to judge if my work is meaningful in cryptography?
@Alex, I don't know! I can't answer that, without knowing what you mean by meaningful. I don't understand why you refuse to clarify. How are we supposed to help you if you won't tell us what you mean by "meaningful"? Is your definition of meaningful "approved by most of people in the field"? Is your question about how to get your work accepted in a conference? Is it about how to tell whether most people in the field agree with your results?
Jan
9
comment How to judge if my work is meaningful in cryptography?
I still don't understand what the author means by "meaningful". Do you mean "correct"? "important"? "novel"? "useful"? "valuable"? "worth money"? something else? The question needs a lot more clarification. P.S. I'm not sure what is meant by "Can I say...?" You can say anything you want; it doesn't mean you'll be right, but you can say it.
Dec
29
comment Diffie-Hellman Secret Exponent Size and Shared Secret Usage
What's the question? The entire body of the question seems to be a bunch of sentences about what you are planning to do, but I can't see any specific question. We expect questions on this site to ask a specific, objectively answerable question.
Dec
26
comment Zero knowledge proof protocol example?
Paul Wagland is 100% correct. If Bob is teasing (he is lying, and Alice is actually wearing two same-color gloves), then there's no way Bob will be able to fool Alice into thinking her gloves are mismatched. But, if Bob claims that Alice is wearing matched gloves, Alice has no way to tell whether Bob is telling the truth or not (Bob might have noticed that Alice is wearing mismatched gloves and decided to lie about it; then when they conduct the ZKP, he answers randomly). In other words: there's a proof that Alice's gloves are mismatched, but there's no proof that Alice's gloves are matched.
Dec
26
comment Does the key schedule function need to be a one-way function?
This question is not clear about what function is/isn't one-way. And, I can't make any sense of the very first sentence of the post. (Are you perhaps making some assumptions about what a key schedule must look like? If so, those assumptions are not valid. Many key schedules don't look anything like that.) Anyway, I think the question is poorly framed; it is too hard to tell what you're asking.
Dec
26
comment Security Level Estimate when Cascading/Compositing Ciphers?
You've loaded too many questions together into one. Please pick one question per question. Your first question is too broad; the answer will depend upon whether you're talking about a block cipher or something else. I suggest you just tell us about the real problem you have; or else ask multiple separate questions.
Dec
23
comment Now that quantum computers have been out for a while, has RSA been cracked?
This answer does not seem to add any added value over the existing answers.
Dec
20
comment Is this algorithm demonstrating “proof of work”
In the future, we generally ask that questions on Crypto.SE should use pseudocode to describe the algorithm concisely -- rather than giving a full implementation. Here the code makes it harder to understand what is going on, whereas you could describe the basic algorithm in one or two lines of simple mathematics. Just letting you know for the future....
Dec
20
comment Is this algorithm demonstrating “proof of work”
@kylek, I think you've misunderstood rolfl's answer. Rolfl is 100% correct on both of his criticisms, and I think you misunderstood his points and haven't fully grokked his critique yet. Maybe read it a second time? (Rolfl clearly does understand that this is for proof-of-work, not for authentication.)
Dec
19
comment Are those two distributions indistinguishable?
Thanks, @curious, that was a typo on my part. I certainly intended it to be mod $N^2$, but that did not make it from my brain to my fingers -- oops. Fixed. Thank you again.
Dec
19
comment Are those two distributions indistinguishable?
Are you sure you've got the definition of the decisional quadratic residuosity problem right? Do you have a reference? I'm not familiar with this specific hardness assumption, but based on the name, I would have expected something called the "decisional quadratic residuosity problem" to be about $x^2 \bmod N^2$ vs $r \bmod N^2$.