30,918 reputation
12463
bio website
location
age
visits member for 3 years, 2 months
seen 9 hours ago

Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
@tylo: actually, because he wants the multiplicative operation to be preserved, the appropriate order is $x^a-1$. In any case, we can show that an injective map cannot exist; a surjective map (where surjective is defined to mean "we map to all elements of the field other than 0") does exist, however whether a nontrivial map exists in general is less clear.
Apr
16
answered Composing hashes and/or MACs
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
If you want to define a mapping between one set and the other, it's easy; you can define a mapping to $GF(2^{256})$ using SHA256. However, presumably you also insist that the mapping also preserve the group operation; however any field has two operations defined on it; which field operation should the group operation be mapped to? In other words, should $\phi(ab) = \phi(a)+\phi(b)$ or $\phi(ab) = \phi(a)\phi(b)$?
Apr
15
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I disagree; just because someone can deduce some information from $b$ doesn't disqualify a ZK proof; all it means is that the ZK proof can't reveal anything more. You can obviously put together a ZK proof by designing a circuit that computes $z^z \bmod p$ for $z<p$, and prove that you know an input $z$ that generates $b$. While this shows that a ZK proof is possible, it really doesn't answer the question; we are asked for a simple proof, and unless your definition of simple is considerably broader than mine, the circuit method wouldn't qualify.
Apr
15
revised Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?
added 448 characters in body
Apr
15
answered Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?
Apr
15
revised Block cipher and parity of permutation
Changed 'all Feistel cipher' to 'most Feistel cipher'; I did give a counterexample
Apr
15
answered Block cipher and parity of permutation
Apr
15
comment Does IKEv2 protocol have two modes like IKE
@Gev_sedrakyan: I tried to cover that in my answer; during initial SA bring up, IKEv2 does not have one set of exchanges to bring up the IKE SA, and then a second set to bring up the IPSec SA; it's done with one set. Now, afterwards, there is a "Child SA" exchange; that's used both as a "non-initial Quick Mode" (both to rekey IPSec SAs, and to create new ones), and as a way to rekey an IKE SA (which IKEv1 doesn't do; it does an independent Main Mode/Aggressive Mode to "rekey" an IKE SA).
Apr
15
comment Does IKEv2 protocol have two modes like IKE
@Gev_sedrakyan: actually, they are separate, for example, you can rekey one without the other, and one IKEv2 SA can parent multiple IPSec SAs simultaneously. However the IKEv2 mandates that they be initially generated at the same time, and that they are related in a closer way than what IKEv1 mandated.
Apr
15
revised Does IKEv2 protocol have two modes like IKE
Expanded explination
Apr
15
revised Does IKEv2 protocol have two modes like IKE
edited tags
Apr
15
answered Does IKEv2 protocol have two modes like IKE
Apr
14
comment Exchanging Keyspace and Message space in PRF
Have you tried to construct an $F$ for which $F(Key, Message)$ is a secure PRF, but $F(Message, Key)$ is not?
Apr
14
comment does re-encrypting the same value with multiple keys reduce security
@ZackNewsham: as far as we know, multiple encryptions to different keys is not harmful in CBC-mode, even if the plaintext consisted of a single block, and even if the IV was constant between all encryptions (there are other reasons to randomize IVs; it just happens to be OK in this scenario).
Apr
14
answered does re-encrypting the same value with multiple keys reduce security
Apr
14
answered How to make sure the pre-agreed information safe for DH-Key Exchange
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
I would like to point out that this arguments doesn't work when you start talking about MACs with nonces; in that case, if you model the nonce as a part of the state, then the probability of an internal collision between two different messages may be 0, because the two messages will always have different nonces.
Apr
11
reviewed Approve suggested edit on Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
Apr
11
answered How to keep phi(n) secret in RSA?