31,112 reputation
12463
bio website
location
age
visits member for 3 years, 2 months
seen 15 mins ago

Apr
25
answered Are the RFC3526 MODP groups Schnorr groups?
Apr
25
comment ECC Complexity order of point addition, scalar point multiplication and selecting random point
Actually, it is considerably more complex than that. For example, if you're adding two points in homologous format, and want the result in homologous format, there's a multiplicative inverse involved, and that's more expensive than all the rest of the operations combined.
Apr
25
answered Is the product of two primes only factorisable by those two primes?
Apr
25
comment FHE over the Integers - reduction to approximate gcd problem
You might want to give a link to the paper you're referring to. Also, $\pi \approx 3.14159$, and so $\pi/6 \approx 0.523599$
Apr
24
answered Why does knowing the number of points on a curve help solve ECCDLP?
Apr
23
comment Are the MD5 constants an S-Box?
@HennoBrandsma: Yes, I know; I did say that the sboxes in AES were not the original. However, it is easier to explain the sboxes there than the sboxes within DES, hence I used that as the example.
Apr
22
comment Are the MD5 constants an S-Box?
@BastianBorn: no, that data is added to the current data; it's no more an "sbox" than the "S" constants are.
Apr
22
answered Are the MD5 constants an S-Box?
Apr
22
comment Is less security required for a short stream cipher than for the AES enciphering of very long messages?
"If I invent my own crypto scheme ... I will know it is free of ... other weakness that the community just doesn't know about today". Actually, you don't know that; in fact, any scheme you can come up with is likely to be less secure than AES.
Apr
22
comment Why does computing g^a * g^{-a} with the PBC library result in zero?
Also, doesn't element_pow_zn take three parameters?
Apr
21
comment One time pad: why is it useless in practice?
@rossum: What you say is true; however I didn't raise that issue because the secure channel may have significant latency (e.g. require a physical meeting), and you cannot tolerate that latency when sending the actual message; hence OTP may be useful that way. That said, conventional crypto also does the same thing, and generally in a more useful way.
Apr
21
awarded  Necromancer
Apr
17
answered One time pad: why is it useless in practice?
Apr
17
comment Security of permutation cipher
@Thomas: actually, if you can recover $\sigma_1$, you can recover essentially everything. You can compute $\sigma_1^{-1}(Ciphertext)$, and that gives you essentially a simple substitution cipher within each generation; solving a substituion cipher given 256 bytes of encrypted ASCII English is trivial.
Apr
16
comment Security of permutation cipher
@Thomas: if we know $\sigma_1$, we can compute $\sigma^{-1}(C)$ for the entire ciphertext in a generation. Within that generation, we know that $\sigma_2(\sigma_3(...\sigma_n(P))...)$ is a fixed permutation, hence $\sigma_1^{-1}(C_i) = \sigma_1^{-1}(C_j)$ (note: those two $\sigma_1$'s have a known shift in relationship to each other) iff the corresponding plaintext bytes are the same. Does this help???
Apr
16
answered Security of permutation cipher
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, that's the problem: $\mathbb{Z}_{N^2}^*$ is not a cyclic group.
Apr
16
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
I just don't trust the argument "our normal techniques cannot solve this problem, hence this problem cannot be solved". We know that a complex ZK proof is possible; the standard ways to generate a short proof do not work, however I cannot say that there isn't an alternative short way (that we haven't thought of) that would work.
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
Actually, we know that a bijective function cannot exist (even if you omit the element 0 of the field).
Apr
16
comment Existence of a map $\phi:\mathbb{Z}_{N^2}^* \mapsto \mathbb{F} $
@tylo: actually, because he wants the multiplicative operation to be preserved, the appropriate order is $x^a-1$. In any case, we can show that an injective map cannot exist; a surjective map (where surjective is defined to mean "we map to all elements of the field other than 0") does exist, however whether a nontrivial map exists in general is less clear.