20,396 reputation
32472
bio website
location
age
visits member for 3 years, 1 month
seen 2 hours ago

Mar
31
comment Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?
@fgrieu, yes, maybe posting a separate question would be best. When you do, can you spell out how we choose a random set of permutations with the commutativity property? Is that notion uniquely defined?
Mar
30
comment HKDF vs TLS PRF. Which of the one is better?
Better, in what sense? More secure, in what sense? For what purposes? Under what threat model? This question is too vague as it stands; I suggest you edit it to make it more specific.
Mar
29
comment Is Porticor's “homomorphic” key encryption something that can really be done or is it just marketing hype?
Can you edit your answer to provide a summary of the contents of those documents and their implications for the answer to the question that was asked here? As it stands, the main content of your answer is the links, but on this site we tend not to like link-only answers very much, because links may rot or disappear.
Mar
28
comment Is substitution with random prefix codes secure?
@Mok-KongShen, that's of course a different question, and of course the answer to that question will probably depend on the details. This is not a discussion forum: one question per question, please (so it's important to make sure that you frame your question well so it reflects what you really want answered).
Mar
28
comment What might be assumed about a PRF if the key has been chosen?
I'm confused by "what might be assumed about..." -- you can of course assume anything you want. Do you mean, assuming only that $f$ is a PRF, what can we say about security if the key parameter is not chosen randomly? If so, the answer is: there are no guarantees whatsoever. There are bad cases where the function $f$ is no good at all, if the key is predictable or has low entropy. In TLS, the spec calls the function a PRF, but actually the protocol implicitly requires stronger assumptions than just that it's a PRF; it also needs to have some hash-like properties as well.
Mar
28
comment ECDSA signature verifiable 1-way transformations
@ChristopheBiocca, you can turn any interactive ZKPoK into a non-interactive ZKPoK using the Fiat-Shamir heuristic (basically, use a hash function to choose the challenge). That should give you what you want.
Mar
28
comment Distinguishing Attack on CBC-MACs
@user11291, read fgrieu's earlier comment, and do some learning on your own about the birthday paradox.
Mar
28
comment secure integer comparison
@ahmed, alas, I don't know of a reference for this protocol, and unfortunately I don't know anything better -- sorry about that -- but if you want to explore further, it might be worth taking a look at the protocol I mention in the last paragraph.
Mar
22
comment Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?
Your statement "Alice cannot know if Bob accepted the message" does not seem to be well-justified (at least, it does not follow from the rest of your conditions).
Mar
21
comment Parallel-resistant proof-of-work scheme without hidden knowledge
Thanks, that helps! For randomized schemes, can't you always make them deterministic by seeding a deterministic PRNG with some seed and using its output everywhere that the algorithm makes a random choice? Now the problem/puzzle generated will be a deterministic function of the seed: the same seed always yields the same puzzle. Does that achieve what you're looking for or does it fall short in some way?
Mar
21
comment Is this approach to generating a “random” number from a sha512 hash effective?
Good answer! I'd also like to refer the author to crypto.stackexchange.com/q/767/351.
Mar
21
comment Can passwords be stored securely so that a similarity comparison can be made?
There are better answers to this question at security.stackexchange.com/q/3170/971 and security.stackexchange.com/q/36893/971 and security.stackexchange.com/q/53481/971.
Mar
21
comment secure integer comparison
Is it OK to reveal the offer of the winning ISP (the one with the best offer), in identity to the winning ISP? Do you care more about computation time or latency (total time)? Is it OK to do an interactive computation that involves many round of interaction if this keeps the computation time down?
Mar
21
comment Parallel-resistant proof-of-work scheme without hidden knowledge
I confess I don't understand point 3. What would it mean to violate point 3? Also, what do you want the third party to be able to verify, and would it be OK if verification requires cooperation from the creator of the puzzle?
Mar
21
comment Entropy when iterating cryptographic hash functions
Thanks, Stephen! I've edited the question further to ask about the general situation, as @fgrieu suggests.
Mar
20
comment What is the idea behind hashing the QueryString in OAuth?
I'd speculate that they want to protect the querystring parameters from tampering/modification. If they weren't included in the hash/MAC input, an attacker could change them freely and the modification would go undetected.
Mar
19
comment Zero Knowledge Proof for Correctness of the product of additive ElGamal Ciphers
I encourage you to put in a bit more effort on formatting the question to be easily readable. Did you know you can use Latex (Mathjax) on this site? See the help center for more.
Mar
19
comment Entropy when iterating cryptographic hash functions
@fgrieu, great point! For large enough $i$, this formula certainly becomes inaccurate. For instance, when $i \ge 2^{n/2}$, it is likely that the entropy will be about $n/2$ bits, and after a certain point it won't get any smaller no matter how much you increase $i$ (because typically when iterating a large random function, there is a single large cycle of length about $2^{n/2}$ that most inputs feed into). Thank you!
Mar
18
comment Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
JasonJones, yup! It does suggest that the DLP is easier to solve than in the corresponding elliptic curve. It does suggest that the DLP can be solved faster than exponential time. The faulty premise is in assuming this means it is claiming that the DLP can be solved in sub-exponential time, e.g., in $L_n[\alpha,c]$ time.
Mar
18
comment Meet in the middle attack - message and key
Read about known-plaintext attacks.