2,232 reputation
29
bio website
location
age
visits member for 1 year, 6 months
seen Apr 17 at 12:08

Apr
17
revised Is ElGamal still unforgable if the adversary knows r
formatting and latex
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Are you absolutely sure about that? Small number example: $p=3, q=5 \Rightarrow N^2=225, \phi(N^2)=120$. From the cardinality it would fit to the multiplicative group of $\mathbb{F}_{11^2}$, and both are cyclic groups wrt. their multiplication. And I think all finite cyclic groups are isomorphic to each other.
Apr
16
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I covered the basic problem for the lack of ZK too short, I guess: $f(x)=x^x$ is not a homomorphism. It does no preserve any kind of structure. So you can't find what you need in a ZKP: A sort of commitment, which is "related to $x$, but not $x$ itself", and which can be opened in multiple ways. This is similar to why there is no simple ZK proof of knowledge of a preimage of a hash function (except the circuit method).
Apr
16
answered Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Apr
15
comment SHA256 Padding and Parsing
This is a pure implementation issue, and that's kind-of offtopic here. And then you didn't even supply the according source code. Right now, I would just close it, with more details it might be okay for security-SE or stack overflow.
Apr
15
answered Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
Apr
15
comment In Pedersen Key Distribution, can the public key be persistent?
Concerning normal ElGamal: This problem does apply, if you use a fresh private/public key for every new message. And in the question it was stated, that in each round every party chooses a new $x_i$.
Apr
15
comment In Pedersen Key Distribution, can the public key be persistent?
It might be standard to re-use the public key in dlog-based systems, but the problem is that standard security definitions (IND-CPA, IND-CCA) do not consider multiple keys. It's proven, that IND-CPA does not imply security under (simulation-based and full indistinguishability-based) selective opening (actually, there are multiple variants of SO-security, see On definitions of selective opening security (Böhl, Hofheinz, Kraschewski, 2012), see figure in section 1). If you run any kind of scheme with "just" IND-CPA or IND-CCA security with multiple keys, this could potentially apply.
Apr
15
comment understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption
I'd suggest Pairings for cryptographers (Galbraith, Paterson, 2009) as a nice overview over elliptic curves. And when you look at the constructions, nothing else than elliptic curves is considered. Or you can have a look at On the Selection of Pairing-Friendly Groups (Baretto, Lynn, Scott, 2004)
Apr
14
comment does re-encrypting the same value with multiple keys reduce security
Concerning the hash-vs-encrypt topic: It's not that easy, but if you want to order them somehow encryption has the "harder requirements" (e.g. linear/differential cryptanalysis has no equivalent in hash functions). About your attack: Still, without choosing a certain encryption system, you can not make any statement like this. But if you really only consider entirely unrelated keys, then there is probably no additional advantage over usual chosen plaintext attacks.
Apr
14
comment does re-encrypting the same value with multiple keys reduce security
Related key attack is the correct term, yes. The wiki link will tell you more. But SHA is not an encryption algorithm, don't throw hashing and symmetric encryption in the same bin. They have different properties and security models.
Apr
14
comment does re-encrypting the same value with multiple keys reduce security
You might want to check out related-key attacks on AES. This is basically the same idea from a different point of view. But as a general answer: It depends on the actual scheme.
Apr
14
comment Why should a signature use PSS padding in RSA?
"... using RSA (encrypted with private key)" - this is wrong terminology, and quite unclear. RSA can refer to either the RSA encryption scheme or the RSA signature scheme. And in any encryption scheme, the public key is used to encrypt and the private key is used to decrypt. In a signature scheme the signing key is used to sign and the verification key is used to verify. If you look just at the basic scheme for both, the private key and the signing key are related, and the public key and the verification key are related
Apr
14
answered In Pedersen Key Distribution, can the public key be persistent?
Apr
14
answered How to make sure the pre-agreed information safe for DH-Key Exchange
Apr
14
comment How to select $g$ in Paillier Cryptosystem
If I remember correctly, $g=n+1$ fulfills the necessary condition and is a viable option if you don't need a random generator.
Apr
11
comment How do I express each element in a field F as a power of a primitive element?
Why would it be $g^8$? If your element is primitive and the polynomial is irreducible (I did not check), the multiplicative group generated by $g$ is cyclic and has exactly 15 distinct elements.
Apr
11
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
Ah right... I thought of Fermat, but not of throwing CRT on the problem with the coprime moduli. All I could up with involved somehow $p$ as a factor of $x$.
Apr
11
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
@poncho I can't see your solution, even if you allow greater $p$. At least not under the restriction that $x$ is coprime to $p$, and that is necessary if $b\neq0$.
Apr
11
comment How do I express each element in a field F as a power of a primitive element?
For the second question: If you say $g:= \beta + 1$, and want to express them as powers of $g$, then this is just $g^1,g^2,\dots,g^{15}=g^0$