29,856 reputation
12359
bio website
location
age
visits member for 3 years
seen 7 hours ago

Feb
18
comment Finding if exponent share is present in dlog instance
If $y$ is an integer, and $x_1$ is a group element, how does $y - x_1 = x_2$ make sense? Are you assuming a specific group representation (so you can map between integers and group elements)? Are, if you compute $y - x_1$ either in the integers or within the group, won't such an $x_2$ always exist?
Feb
18
revised Digital signatures under plain RSA
deleted 2 characters in body; edited tags
Feb
18
comment Digital signatures under plain RSA
We rather expect you to do your own homework. What have you tried?
Feb
17
revised ElGamal in private set intersection: how to handle negative numbers?
More explicit
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
This is homework, right? Well, you're supposed to learn from homework. Neither fgrieu nor I will give you the answer, because you'll learn by figuring it out yourself. The point of this exercise is not this specific question, but how to think about problems like this. Just consider the hints that we've been giving you.
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
$n$ and $e$??? You mean $g$ and $p$, maybe? Hint: it turns out you don't really need $g$. And, for extra credit (after you solve this problem), if you don't have $p$, but do have the first 3072 bits of plaintext-ciphertext, how can you recover $p$?
Feb
17
comment Partially-known-plaintext attack of a stream cipher based on modular arithmetic
You have the first 1024 bits of plaintext-ciphertext; how can you deduce $F(r)$ from that? If you have $F(r)$, how do you deduce $F(2\cdot r)$?
Feb
17
answered ElGamal in private set intersection: how to handle negative numbers?
Feb
17
comment GCM encryption for 256-bit and 512-bit block ciphers
@CodesInChaos: hmmm, good point. GCM, as specified, matches the block size with the field size. If we break that assumption, and: use the first 128 bits of the encryption of 0 as your H; and do some reasonable splitting of the keystream to encrypt the payload and the tag (I can think of two reasonable alternatives), well, one gets something that is distinctly GCM-ish, and I still believe the security proofs still apply.
Feb
16
comment Simplified Fiat-Shamir example generates wrong output
No, he means checking whether $y^2 \equiv x \cdot v^e\ (\bmod\ n)$. One way of writing that is checking whether $(y^2 \bmod n) = ((x v^e) \bmod n)$. Remember, the squaring of $y$ occurs within the group, and hence is implicitly done modulo $n$.
Feb
15
answered GCM encryption for 256-bit and 512-bit block ciphers
Feb
15
comment Hash functions with or without secret key
"Usually MACs are not called hash functions (with key)"; this is certainly true, because often a MAC is not a secure hash function against someone who knows the MAC key. Nothing in the definition of a MAC requires it to be, and a lot of real MACs in practice (e.g. CMAC) don't even have preimage resistance if you know the key.
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki
Feb
15
reviewed Approve suggested edit on threshold-cryptography tag wiki excerpt
Feb
15
reviewed Approve suggested edit on alternating-step tag wiki excerpt
Feb
15
reviewed Approve suggested edit on threshold-cryptography tag wiki
Feb
14
revised Encrypting firmware with AES and no IV
Man, there's been a lot of typo's here
Feb
14
revised Encrypting firmware with AES and no IV
More Latex corrections...
Feb
14
answered Encrypting firmware with AES and no IV
Feb
14
revised Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?
Corrected from BER to DER