David Cash
Reputation
976
Top tag
Next privilege 1,000 Rep.
 Nov 13 awarded Yearling Nov 13 awarded Yearling May 9 awarded Enlightened May 9 awarded Nice Answer Apr 27 awarded Revival Apr 2 comment Encrypting the same message using different schemes The argument works with different $E_1,E_2$ or $E_1 = E_2$, as long as $k_1$ and $k_2$ are independent. The trick is that the reductions will choose one of the keys itself (depending on which step of the hybrid argument you're doing), and it will let the game choose the other key and use its oracles to simulate the hybrid. Apr 2 answered Encrypting the same message using different schemes Mar 20 comment Soundness idea of basic zero knowledge prood Are you saying that a ZKPoK is inherently weaker because it leaks the fact that the prover knows the witness? Formally speaking, ZKPoK is stronger than plain ZKP. Feb 18 comment Exercise: Attack on a Two-Round DES Cipher Try multiple inputs with the same $R_0$ or $L_0$ and looking for a pattern. Jan 31 comment Security based on PRF Proving CPA/CCA/AE security of a blockcipher mode is usually done using only PRF - not strong, not weak. (Weak PRF has yet another technical meaning, so there is strong PRF, PRF, and weak PRF.) One place where strong PRFs (which we should be calling strong PRPs) are used is with disk encryption - see e.g. en.wikipedia.org/wiki/Disk_encryption_theory. Jan 30 answered Security based on PRF Jan 25 comment Question Error Correcting Codes I meant in $\mathrm{Img}\ G$ (typo). Jan 24 comment Question Error Correcting Codes Do you want some structure on $C''$? It could be empty. Anyway, finding another element of the coset is equivalent to finding a non-zero vector in $\mathrm{Ker}\ G = \mathrm{Img}\ H = \mathrm{Img}\ H\times S$, which is trivial. Jan 11 answered 2PC Private Set Intersection Optimized for asymmetrically sized sets Nov 13 awarded Yearling Aug 9 comment Is this method of deterministically using CBC secure? I'm posting this as a comment rather than an answer because I'm not sure I understand the security requirements. The MAC-then-hash part aims at deterministically computing a pseudorandom nonce for every message. This will do that (and it correctly avoids length-extension attacks on the hash that may enable attacks against the encryption), but a cleaner (IMO) approach is to compute the nonce by first applying the hash function and then AES. Both constructions give a "variable input-length PRF," which is the correct theoretical primitive for this job. Jul 19 answered Why do fully homo-morphic constructions use 'ring' or 'lattice' structures? Jun 12 comment Can any one explain Circuit Privacy using fully homomorphic encryption from Gentry's thesis? It sounds like @Reid has not attempted to read the final paragraph of chapter 20, which is light on details :). I think this question is valid and also very unlikely to get an answer. My advice to the OP: If you want to understand homomorphic encryption constructions and circuit privacy, it'll be a lot easier if you start with subsequent works that extracted, simplified, and extended the ideas in this thesis. The paper linked here is particularly nice: cs.toronto.edu/~vinodv/BrakerskiV-FOCS2011.pdf Mar 19 comment Encryption with Deduplication Here's one published this year: eprint.iacr.org/2012/631.pdf Mar 16 answered Strong encryption done by hand