Reputation
4,100
Next tag badge:
46/100 score
25/20 answers
Badges
4 18
Newest
 Constituent
Impact
~49k people reached

Jul
16
comment What good is a hash accompanying a program?
The first two sentences indicate, you believe SHA-2 to be vulnerable to finding preimages to a certain hash value (e.g. with the length extension...). This is wrong. As others have already pointed out: SHA-2 is considered one of the stronger hashes (and pretty much state-of-the-art in practical applications). Even MD5 is still considered secure against preimage attacks (but not recommended any more). And that is still enough if you get the hash from a trusted source.
Jul
16
comment Is it a good practice to use plain text for derivation of Keys?
My guess is, that you are trying to re-invent key encapsulation like it is done in hybrid encryption, without defining if you are using symmetric or asymmetric crypto. Right now there is no reason to "hash" the plaintext to derive a key. Comparing to choosing a random one, this only can introduce possible weaknesses without granting any benefit. Especially, since your notation does not actually indicate the use of a hash function, or a PBKDF - which would be necessary, if the plaintext is somehow predictable or easy to guess.
Jul
14
revised Computational indistinguishability: are function parameters known?
added 257 characters in body
Jul
14
comment Computational indistinguishability: are function parameters known?
I did not claim the Mersenne Twister is a good CSPRNG. It is a useful PRNG for simulations etc. where you need randomness with good statistical properties. It is kinda crucial to think of the "CS" part seperately: But I will point that out more explicitly
Jul
13
comment Computational indistinguishability: are function parameters known?
They are not cryptographically secure pseudorandom number generators. They aren't PRFs in the cryptographical sense either.
Jul
13
answered Computational indistinguishability: are function parameters known?
Jul
13
comment Why should the primes used in RSA be distinct?
Newton's method with integer division also works quite good. Complexity should be similar to binary search, but I think it approximates slightly faster.
Jul
13
comment Brute forcing the secret key in Elgamal encryption
"i just did a quick run in python with my code..." Python has arbitrary-length integers by default, Java doesn't, which seems to be the problem.
Jul
13
comment Brute forcing the secret key in Elgamal encryption
If you know the basic elements all fit within the length of int, then you can use long instead, so that you can do the multiplication steps. Arbitrary-length integers are preferable of course, but if this is a one-time assignment, long would be sufficient and easier to handle.
Jul
13
comment How is an epsilon of 1/1000 non-negligible?
There is an error in your definition: To be secure, $\epsilon$ has to be smaller than a negligible function. If the advantage is non-negligible, then it is insecure. Anyway about the example: If it includes a specific $n$, then you can calculate the advantage or an upper bound of it. If the advantage is independent of $n$, it can not be negligible.
Jul
13
comment What is the difference between the standard representants of $\mathbb Z/q\mathbb Z$?
In lattices the elements are vectors and not just integers (more precisely equivalence classes of vectors. This is along the lines of the modulus for integers, but for vectors).
Jul
8
comment Is one-time-pad still secure if the number of 1's in the key is revealed to the attacker?
You definitely loose the information theoretic security. How bad it is depends on your $n$: In a bitstring of length $2x$ and hamming weight $x$, there are ${{2x}\choose{x}} \approx \frac{4^x}{\sqrt{\pi n}}$possibilities, which differs from the full $2^{2x}$ only by the denominator. However, the lower or higher values can give a lot of information about the key.
Jul
7
comment RSA with $\lambda(n)$ or $\varphi(n)$
@fgrieu You're wrong about the "always": The calculation of the modular inverse is done with a smaller exponent by a factor of at least 2. But that does not necessarily imply, that the product $ed$ is smaller (it usually is). Small number example: $n=7\cdot 11 \Rightarrow \varphi=60; \lambda=30$. For $e=11$, we get that $d=11$ in both cases ($11 \cdot 11 = 1$ for both moduli).
Jul
7
answered Weakening of Pallier cryptosystem due to ciphertext equivalence and order in CryptDB
Jun
25
comment Why is the public/private key length used in libsodium so much shorter than needed for RSA
This question appears quite off-topic, since only guesswork can be done to answer this. Anyway, public key crypto with 256 bit can be done - just not with RSA and dlog-based crypto in $\mathbb{F}_p$.
Jun
23
comment Is secure communication without public-key crytography feasible?
What are your actual assumptions about the initial setup? What do parties know of each other? Is there some trusted third party, a public bullet board, a PKI with certificates? Basically: If you got no prior knowledge of each other and trust no one else, you can't build any form of authentication.
Jun
23
awarded  Constituent
Jun
23
awarded  Caucus
Jun
22
comment Is Encryption without knowing the input directly possible at all?
If all the $t_i$ are known to everyone, this works, because everyone can check the output of Bob, when he revealed his key. Basically this is like a commitment scheme. However, this way Alice will also find out later who got which text, after Bob revealed his key. All you need then is a proof that Alice actually used those commitments and used each one just once.
Jun
22
comment Is Encryption without knowing the input directly possible at all?
The enitre point of ZKP is that it is a proof to other people. This answer does not address the question at all.