20,510 reputation
32573
bio website
location
age
visits member for 3 years, 2 months
seen yesterday

Jun
24
comment Choose a random number that is different from a bunch of other secret numbers
(...) in the first place, and could we change that procedure? Also, you might want to post a separate question where you take a step back and look at your application's requirements (what problem you want to use this protocol to solve) and ask about how to solve that problem, without assuming this protocol is the best way to do it. I suspect there might be other very different approaches that are possible, but without knowing the application, it's hard for tell.
Jun
24
comment Choose a random number that is different from a bunch of other secret numbers
I've been thinking about this some more, and I think there are a lot of options here. Cedric, can you tell us more? Will this protocol be repeated many times (with the same secret values for the participants), and if so, what are the requirements (a different random number each time, or it's OK for them to repeat) and how many times (more than $x-n$?)? What security property does your application need for the random numbers? Is there a trusted third party? Is there a trusted dealer (a TTP who can provide initial setup/keys)? How did the participants choose their secret values (...)
Jun
24
comment Choose a random number that is different from a bunch of other secret numbers
This is not a great scheme. The problem is that any time a participant vetos a candidate random number, everyone learns what that participant's secret number was (it must have been the same as the candidate random number we were considering). See my answer for a scheme that is a bit better, because it doesn't reveal which participant vetoed the candidate.
Jun
24
comment Choose a random number that is different from a bunch of other secret numbers
Thanks, nice edit! Here's one more intereseting fact. Proving that two numbers are different can actually be done efficiently, using the proper scheme. See my answer (you use a scheme that is homomorphic for 2-DNF formulas, noticing that $C$ computes a 2-DNF formula).
Jun
23
comment Fastest random number generator
Are you looking for true random numbers, a cryptographic-strength pseudorandom number generator, or a non-cryptographic pseudorandom generator? Please edit the question to state explicitly. Also please edit the question to respond to the other questions in the comments.
Jun
23
comment What would make it impossible to deny that decryption of a package has taken place?
package? What do you mean by that? Do you mean packet?
Jun
23
comment Which concrete applications benefit from Oblivious RAM constructions?
This paper is a great find and very relevant. On the other hand, its threat model makes some assumptions that might not be realistic in practice. It requires that the server know some of the queries (a known-plaintext setting) and have a priori knowledge on some frequency statistics concerning the unencrypted emails. I find it hard to tell whether their attacks will be realistic in the real world or not.
Jun
23
comment how to truncate a PRF on n bits to PRF on t bits where t < n?
Better, in what way? The construction Boneh provides is a perfectly reasonable choice. Unless you can define in what objective metric/criteria you would use to define "better", I don't think this question is well-defined.
Jun
23
comment Cryptography: Oblivious Transfer with at most one transfer?
I am finding this question hard to follow. What do you mean by a "transfer method"? What is $Sc$? Do you mean $s_c$? What counts as bits transferred to Bob? Can they invoke $F$ as many times as they want? Who provides the inputs to $F$ (does $x$ come from Alice and $y$ from Bob)? Are we guaranteed that $p,q$ are chosen randomly subject to the condition that $p \oplus q = x \times y$? Please edit the question to make the problem statement clearer.
Jun
23
comment How to prove NIZK proof of knowledge?
A standard way to prove that your protocol is a NIZK proof of knowledge is to show that a suitable variant is an (interactive) ZK proof of knowledge, then apply the Fiat-Shamir heuristic to it, and use the result.
Jun
21
comment Pseudo Random Generator with fixed Hamming Weight
Use the output of a crypto-quality PRG as your seed. Done. Yes, it'll be secure if the PRG is secure.
Jun
21
comment Pseudo Random Generator with fixed Hamming Weight
As it stands this question does not meet my quality expectations for this site. In the future please explain in greater detail what you want (e.g., what your specific requirements are), explain the context/motivation, do some research on your own, and show us what research you have done and what you have tried and where you got stuck. And pick just one question: a block cipher is very different from a PRG. P.S. What you want is obviously impossible if the length of the output is equal to the length of the input, as in your example.
Jun
20
comment Public and private key lengths
Thanks, BENZ.404! No need to acknowledge me or worry about my comment; I'll be happy to delete it once it no longer makes sense. For padding, normally we'd expect the library to do whatever is needed to make key generation secure. (For what it's worth, no padding is needed during RSA key generation, and depending upon how the private key is represented, it will often be of different length than the public key.)
Jun
20
comment Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?
@Gracchus, I'm going to give you some advice that might sound nasty, but I mean it in the best possible way: I don't think you should be designing cryptocurrency wallet software at this stage. This crypto stuff is subtle, and if you get it wrong, people could lose money. This kind of approach to design of cryptocurrency software is the sort of thing that causes people to lose money. It's exactly this sort of "let's just throw together some code and hope it works" that has caused multiple Bitcoin exchanges to lose lots of money. (For instance, there's a reason why we use a salt.)
Jun
20
comment Public and private key lengths
I still don't understand what you are trying to achieve. Why are you contemplating adding padding? What problem are you trying to solve? Why is the standard output problematic or unacceptable? What are your requirements? Also, when editing, please make sure the edited question stands on its own (don't add "edit: never mind this part", just delete the part that isn't relevant, and make it a good question on its own). We have a revision history, so you don't need to preserve prior versions. Make it something that'll be a great question for someone who encounters this for the first time.
Jun
20
comment Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?
Sorry, @Gracchus, I'm totally lost at what you are trying to do. How does login work? Are we talking about a system where the server stores a scrypt hash of the user's passphrase, or not? If not, what is the situation? The question is not very clear on how you plan to use scrypt. Are you talking about a system where a scrypt hash of the user's passphrase is used to seed a crypto-PRNG which is then used to generate their private/public keypair? If so, that has is about key generation, not login. I suggest you edit the question to make the application a lot clearer.
Jun
20
comment Ballot box with multiple parties. All can read it, or none can read it
@RickyDemer, yes, that's another possible problem if you do it wrong, but that one is easy to solve with standard methods (there are many standard schemes for non-malleable commitments). The issue I described is the harder one and the core of challenge, as far as I can see.
Jun
20
comment Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?
@Gracchus, why can't it be retrieved later? What prevents you from storing a salt together with the password hash? If you can store a password hash, why can't you store a random salt, too, in the same place (e.g., in the same database)? If you're not storing a password hash, what are you doing with the output of scrypt and what do you mean by a cryptocurrency login?
Jun
20
comment Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?
Why do you want to do this, as opposed to the standard approach of generating a random salt and storing it with the password hash? Is there an application where you think this will be preferable? There might be a better solution, but we'd need to know the context in which this question arises to determine that.
Jun
20
comment key-exchange with websockets in node.js
I find it hard to understand what you are asking. Are you asking about how to do key exchange? If so, have you read standard textbook and other descriptions of key exchange protocols, public key cryptography, PKI, and key management? I suggest you do a little more reading on crypto, then see if you can ask a clearer question.