D.W.

8,004 reputation

826

bio	website
	location
	age
visits	member for	1 year, 9 months
	seen	59 mins ago
stats	profile views	137

	8,004 reputation	bio	website		visits	member for	1 year, 9 months
826 badges		location			seen	59 mins ago

summary answers questions tags badges favorites bounties reputation activity

377 Comments

suggestions reviews revisions comments badges posts accepts all

Nov 4	comment	RSA and prime difference @poncho, I'm not saying FIPS 186-3 said that -- I'm saying that SquareRootOfTwentyThree's question seemed to contain an implicit assumption that this is how we should pick RSA keys.
Nov 4	comment	RSA and prime difference Your question seems to start from an assumption that there exists some $\Delta$ for which it is sensible/useful to check that $\|p-q\|\ge \Delta$. This assumption is not valid (in my opinion). Can you rephrase the question in a way that does not contain implicit assumptions?
Nov 4	comment	RSA and prime difference There is absolutely no point in checking this condition (that $\|p-q\|\le \Delta$ holds). If you generated $p,q$ properly, the probability of a violation of this condition is about $1/2^{100}$, or negligibly small. Checking this condition is a waste of time and software development resources, adds unnecessary complexity, and just distracts people from the things that truly matter. It's far more likely that you have an error in the computation due to a cosmic-ray bitflip, than that $\|p-q\|$ happens to be too small when you generated $p,q$ by the proper procedure.
Nov 4	comment	RSA and prime difference @SquareRootOfTwentyThree, sorry, I didn't know it covered RSA now. I edited my answer to reflect this. My bottom-line answer remains the same.
Nov 3	comment	CPA Secure Chosen plaintext scheme This answer might be a bit confusing, because it confuses a PRF with a PRP. A block cipher is a PRP. For a block cipher/PRP, it is generally assumed that one can compute $E_k^{-1}(y)$. But the question asked about a PRF (not a PRP). We normally don't assume, in general, that one can necessarily compute $F_k^{-1}(y)$ when $F$ is a PRF. I agree your answer does get you to the correct final answer, because of this connection (which wasn't spelled out): any PRP is also a PRF, and any PRP is reversible, so at least some PRFs are reversible (even though in general not all PRFs are reversible).
Nov 2	comment	Is there a practical zero-knowledge proof for this special discrete log equation? @SDL, I think RickyDemer's point is that multiplying by $x_2$ implies that $x_2 \in G$ ($x_2$ is a group element), whereas raising to the $x_2$th power implies that $x_2$ is an integer. Thus, what you wrote is possibly only if $G$ is a subgroup of integers modulo $n$; $G$ cannot be an arbitrary multiplicative group. I've edited the question to reflect this. I think this is a minor point and not a big deal.
Nov 1	comment	Computer appliance protocol Sounds like a question that's better-suited for the IT Security site.
Nov 1	comment	Proving that a scheme is not IND-CPA-secure I think the answer will depend upon the particular textbook you are using, and how they define $\text{Game}^CPA_A$. It sounds to me like your question could be paraphrased as: please help me understand what the definition of IND-CPA security means, and help me work through the details. That's probably going to depend upon the precise formulation of IND-CPA that your textbook or instructor happens to be using.
Oct 31	comment	Is there a practical zero-knowledge proof for this special discrete log equation? @SDL, I was thinking of $\textrm{commit}(x_2) = (g^{x_3}, x_2 h^{x_3})$, but I just now realized this might be problematic: this is binding for everyone, but not concealing against the person who holds the private key (the person who knows the discrete log of $h$ to base $g$ can infer what value was committed to without permission), which I suspect might not meet your needs. So, I withdraw my previous comment. Sorry for my error.
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? @SDL, if g,h,x2 are known to the verifier, you should be able to use standard techniques for proof of knowledge of a discrete log. If x2 is not known to the verifier, then I would need to understand better how the scheme works to have an opinion; however, if you have the freedom to pick a different, more convenient commitment scheme, I expect there'll probably be efficient solutions (e.g., using a zk proof that two El Gamal ciphertexts decrypt to the same plaintext).
Oct 31	comment	How can I prove in zero knowldege that an ElGamal shuffle is correct for a special setting? @SDL, I'm puzzled by your statement. I can't think of any mixnet that requires a shared secret. A basic mixnet protocol has only one party: the mixer (who permutes and re-encrypts/decrypts the ciphertexts provided as input, and then proves to the rest of the world that this computation was done correctly). I don't know how familiar you are with mixnets; might it be worth spending a little more time reviewing the variety of schemes and how they work?
Oct 28	comment	What is the complexity of the Square attack against the reduced 4-rounds 128-bit Rijndael variant? Why don't you show us the work you've done so far? You might also want to check out the FAQ, particularly the section titled "Do we accept basic level/homework questions?" and the resources linked to from there
Oct 28	comment	Subgroups generators with respect to group generators of composite order curious, I'd also like to point you to the FAQ, particularly the section titled "Do we accept basic level/homework questions?" and the resources linked to from there.
Oct 26	comment	Does chaining random number generators lead to loss of randomness? Perfect! Thanks for helping me refine the wording to convey my meaning more clearly, @fgrieu. That's exactly what I meant, but you put it better.
Oct 26	comment	Does chaining random number generators lead to loss of randomness? @InemesitAffia, just click "flag" at the bottom of your question and leave a note to the moderators. They can migrate it for you.
Oct 24	comment	Finding where I am in a linear recurrence relation Some ideas I've thought about that don't seem to lead anywhere: write a matrix that expresses $x(n)=(a(n),\dots,a(n-k+1),1)$ in terms of $x(n-1)$, then reduce to a previous question I asked about matrices; compute the characteristic polynomial $p(t)$, then try working in $GF(p)(t)/(p(t))$; write a generating function for $a(\cdot)$, and use the characteristic polynomial $p(t)$ to express $a(n)$ as a weighted sum of $\alpha_i^n$, for some $\alpha_1,\dots,\alpha_k$ (if $p(t)$ has no repeated roots). None of these seem to get me anywhere. Any ideas?
Oct 24	comment	A discrete-log-like problem, with matrices: given $A^k x$, find $k$ Thanks for the edit, @bob! Good catch.
Oct 24	comment	A discrete-log-like problem, with matrices: given $A^k x$, find $k$ Oh, right! Good point, @ThomasPornin. I've edited the answer to point this out. Thank you.
Oct 23	comment	How does one calculate the cryptoperiod? @D.H., many textbooks will mention this. It might be filed under "birthday attack on CBC". I like Cryptography Engineering and Handbook of Applied Cryptography for practical details about designing crypto. See also CBC key lifetime, or, “how big is too big?”.
Oct 23	comment	symmetric-key cryptography based key establishment techniques @fgrieu, sure! Wikipedia has some discussion of the flaw and fixes. For an introduction to Kerberos v4, I like Designing an Authentication System: a Dialogue in Four Scenes, though you're not going to get a crisp specification of the Kerberos v4 protocol in that paper. (I think there are RFCs with that, though I'm not sure.)