Reputation
22,132
Next tag badge:
98/100 score
23/20 answers
Badges
4 30 80
Newest
 Constituent
Impact
~484k people reached

Jan
30
comment Rock-paper-scissors over network, how to protect from cheating server?
@Dillinur, yes, probably. See the paper published at IEEE Security & Privacy 2014 and other concurrent/subsequent work along those lines. Feel free to research those papers and write a detailed answer if you feel so inspired!
Jan
30
comment Hardness assumptions on composite order bilinear groups
I suggest you stick to one question per question. This site format doesn't work so well when you have more than one question in your question.
Jan
30
comment Achieving 32-bit verification code with 16-bit CRC?
I'm voting to close this question as off-topic because it is not about cryptography. (Questions about non-cryptographic checksums are off-topic; this site is for situations where there is an adversary, not about generic error detection mechanisms for non-adversarial situations.) See our help page for details of what is on-topic.
Jan
23
comment Hiding and Binding key in Groth-Sahai NIZK proof system
Please don't use images as the main content of your post. It's not accessible to the visually impaired and it's not indexed via search.
Jan
15
comment Formal security of recycled random blinding in a Paillier scheme
@Dave, for a fixed subset of the $R$'s, the chances of a collision are the same. Now count the number of such subsets. You'll find that there are exponentially many subsets, so once you sign a reasonably large number of messages, the probability that there exists some such multiplicative relationship is close to 1.
Jan
15
comment Formal security of recycled random blinding in a Paillier scheme
@Dave, I think some of your details are a bit off there: there's no reason that $R_a R_b = R_c R_d$ would require $a+b=c+d$.
Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
This might not be obvious, but the way this site works is that we expect all requirements to be in the question. This is not a discussion forum. Comments exist only to help you improve the question/the answer, and can disappear at any time. If you've worked out that the question needs to be revised/refined, you should edit the question accordingly -- and the same goes for your answer. Again, it's not a discussion forum, and readers shouldn't have to dive into some discussion in the comments to understand what the question is.
Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
Understood. But as I wrote... "that isn't quite what the question asked for". The question asked us to prevent issuing more than $n$ certificates. The answer doesn't mention this caveat. If the answer proposes a scheme that achieves something less than what was asked for, and where it might not be obvious that this is the case, it would be helpful to explain the limitations, describe what properties it does achieve, and explore whether the resulting scheme might still be adequate in practice or not. I suspect some child CA's might potentially be OK with their private key leaking.
Jan
15
comment Integrity protection in wireless sensor networks
For the future: 1. One question per question please. This site format doesn't work so well when you have a bunch of different questions stuffed together. 2. Please do more research before asking. We expect you to do a significant amount of research and self-study. Many of your questions are already answered in standard resources (textbooks, online resources, other questions on this site).
Jan
15
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
This proposed solution doesn't work. A signer can still re-use the nonce to sign multiple messages. Therefore, this scheme doesn't prevent a child CA from issuing more than the allowed number of certificates. (Of course, if the child CA does issue more than the allowed number of signatures, it might allow others to forge signatures that look like they came from the child CA, so it might have some negative consequences for the child CA, but that's a bit delicate and isn't quite what the question asked for.)
Jan
14
comment Possible to use an accumulator to “license” or restrict the qty of certificates being used?
This answer doesn't work. I think you are confused about what a $n$-time signature scheme is. A $n$-time signature scheme is a signature scheme that is secure as long as it is used only $n$ times. There is no guarantee that it's impossible to sign $n+1$ messages, and indeed every $n$-time signature scheme I've ever seen does allow signer to sign $n+1$ messages if he wishes (though this could enable others to forge additional signatures).
Jan
14
comment TimeStamp in Cache-time attacks on AES
This question appears to be off-topic because it is about the meaning of Intel x86 assembly instructions; this site is for questions about cryptography.
Jan
13
comment Automated testing of cipher security for import/export compliance
@TruthSerum, I still don't get it. In what sense does my answer not answer your question? Everything I wrote still applies. No, there is no known way to automatically test and grade the security of an arbitrary cipher. That's not how we do it in practice. Perhaps if you elaborate the question it will become clearer what you are looking for and/or why you think this doesn't answer the question?
Jan
13
comment Automated testing of cipher security for import/export compliance
@TruthSerum, you didn't state that in the question. Please edit your question, and this time make sure all relevant information is included in the question. Actually, I'm finding it difficult to guess exactly what you are asking or looking for. This is starting to look like a "chameleon question" (one that changes each time someone adds an answer); that's discouraged on this site and may discourage people from answering.
Jan
6
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, if you have requirements on how much expansion is allowed (how much longer the ciphertext can be than the plaintext), then state that in the quesiton. Don't assume that convergent encryption cannot meet those requirements; there are certainly convergent encryption schemes with relatively small expansion. Nothing forces you to have 256 bits of expansion. Don't judge all of convergent encryption by one particular scheme with one particular set of parameters.
Jan
6
comment Is a Combined Linear Congruential Generator secure for cryptography?
See crypto.stackexchange.com/q/21212/351 for a general answer to this question..
Jan
6
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, I can't understand what you are saying (your requirements do not seem to be stated very clearly, and I can't understand why you are rejecting convergent encryption), so I'm afraid I don't know how to help you. If you would like further help, I encourage you think about how to formulate your problem more precisely, and then edit the question.
Jan
6
comment Difference between statistical PRNG and cryptographic PRNG?
@cpast, I don't think that question (or the answer there) will help people with the confusion that my question is intended to get at. For instance, think of a typical reader who sees some awesome statistical PRNG (say, Mersenne twister) and thinks, hey, I bet I could use this for cryptography! I don't think the answer there is going to help them understand why that's a bad idea, and I don't think the question there will be meaningful to them. The question there also is a bit confused/unclear (a PRNG for key generation? no -- we use a CSPRNG for that). I think this is a better formulation.
Jan
5
comment (Re-)Using deterministic IV in CTR mode / How to: deterministic AES
@SebastianS, I can't understand what you are saying. (If you generate the IV as a hash of the plaintext, you'll still need to store it somewhere too, so I don't understand what your requirements/objections are.)
Jan
5
comment Is BBS used for generation of keys for any modem cryptosystem?
@111, right, but: if it doesn't have a security proof, then BBS has no advantages over competing schemes, so there would be no good reason to choose BBS.