19,622 reputation
32171
bio website
location
age
visits member for 2 years, 11 months
seen 11 hours ago

Mar
21
comment Parallel-resistant proof-of-work scheme without hidden knowledge
I confess I don't understand point 3. What would it mean to violate point 3? Also, what do you want the third party to be able to verify, and would it be OK if verification requires cooperation from the creator of the puzzle?
Mar
21
comment Entropy when iterating cryptographic hash functions
Thanks, Stephen! I've edited the question further to ask about the general situation, as @fgrieu suggests.
Mar
20
comment What is the idea behind hashing the QueryString in OAuth?
I'd speculate that they want to protect the querystring parameters from tampering/modification. If they weren't included in the hash/MAC input, an attacker could change them freely and the modification would go undetected.
Mar
19
comment Zero Knowledge Proof for Correctness of the product of additive ElGamal Ciphers
I encourage you to put in a bit more effort on formatting the question to be easily readable. Did you know you can use Latex (Mathjax) on this site? See the help center for more.
Mar
19
comment Entropy when iterating cryptographic hash functions
@fgrieu, great point! For large enough $i$, this formula certainly becomes inaccurate. For instance, when $i \ge 2^{n/2}$, it is likely that the entropy will be about $n/2$ bits, and after a certain point it won't get any smaller no matter how much you increase $i$ (because typically when iterating a large random function, there is a single large cycle of length about $2^{n/2}$ that most inputs feed into). Thank you!
Mar
18
comment Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
JasonJones, yup! It does suggest that the DLP is easier to solve than in the corresponding elliptic curve. It does suggest that the DLP can be solved faster than exponential time. The faulty premise is in assuming this means it is claiming that the DLP can be solved in sub-exponential time, e.g., in $L_n[\alpha,c]$ time.
Mar
18
comment Meet in the middle attack - message and key
Read about known-plaintext attacks.
Mar
18
comment Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
This question starts from a faulty premise. The accepted answer you link to does not suggest that there are subexponential algorithms for solving DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$. (In fact I don't even see the word subexponential in that answer.)
Mar
18
comment Are there hash algorithms with variable length output?
@curious, again, ask a new, separate question -- and make sure to follow best practices before doing so (e.g., searching to make sure it hasn't been answered before). This is not a discussion forum. One question per question. I'm not going to answer any new questions posed in the comment threads.
Mar
18
comment Are there hash algorithms with variable length output?
@curious, that's a different question, which is probably best answered separatately, but the concise answer is: treat the output of SHA256(m) as a 256-bit integer, reduce it modulo 360, and use the remainder a syour random number.
Mar
16
comment What functions allow for practical indistinguishability obfuscation?
Thanks, @xagawa! On log-size circuits: What is the log of? i.e., log of which parameter? (presumably not the size of the input to the circuit) For normal forms: are there known classes of circuits that have a normal form? I know that BDDs can be put into normal form. That's all I know but I'm guessing probably more is known....
Mar
16
comment How can I create an RSA modulus for which no one knows the factors?
Yes, but the algorithms are not practical for reasonable-sized RSA modulus. I'm pretty sure this has been asked before on this site but I can't seem to find where...
Mar
14
comment How to best mix two arbitrary/random n-bit words?
@Mok-KongShen, it would have been better if you had listed those requirements in the question. This is related to why poncho told you your question was too broad/ill-defined. Generally speaking, we tend not to like chameleon questions where someone asks a broad question without listing the requirements, then when they get an answer that answers the question-as-stated, they respond by saying "oh, that wasn't really what I was looking for, I actually had this extra requirement/goal/criterion I didn't tell you about". You can avoid that by asking narrower questions that include all the criteria.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@Seth, thank you! I have fixed the error you pointed out. (I had miscounted the number of queries made by my distinguishing algorithm. I've revised my answer; should be fixed now.)
Mar
14
comment Traitor-tracing PRF
@RickyDemer, I realized there is a big hole in my reasoning. The argument only shows that if the PRF can be evaluated in NC1, then it's implausible that something like I described can be used for traitor tracing (since we have good reason to believe that indistinguishability obfuscation of NC1 functions is possible). However, if the PRF lives in a higher complexity class, then I think that kind of reasoning goes away, since if I understand correctly, we only know plausible constructions for obfuscation of NC1. Is that right?
Mar
14
comment Traitor-tracing PRF
Thank you! The first paragraph doesn't rule out all constructions, right, since we don't know whether indistinguishability obfuscation is possible beyond NC1? Are there any guesses/conventional wisdom about whether indistinguishability obfuscation is likely to be feasible for higher complexity classes? Your construction from a puncturable PRF is elegant... but alas, I was hoping for something efficient in practice, and with known constructions for indistinguishability obfuscation, I'm afraid this will be highly inefficient.
Mar
13
comment Traitor-tracing PRF
2. Do any other alternative approaches occur to you, for dealing with this problem? Namely, the problem that one of the participants might have their server hacked and their key stolen, and if that happens, it'd be nice if there was some way to track down which participant was responsible (which participant didn't secure their server well enough). Any creative ideas?
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, yup! Isn't that exactly the scheme I described in the body of the question? Or am I misunderstanding something? Thank you for all your help thinking through this!
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, if it would help for Alice and Bob to have a shared secret, feel free to assume they have one. That's not unreasonable.
Mar
11
comment Private set intersection, using a semi-trusted server
@DrLecter, yes, the elements have relatively low entropy (say, 10-40 bits). Therefore, applying a deterministic unkeyed one-way hash function would be highly insecure, because it's so easy to brute-force them, as you say. The use of a (keyed) PRF helps with this particular problem -- but maybe there is an even better or more secure solution?