poncho
Reputation
42,352
97/100 score
 Nov 2 revised Making Pascal Paillier' output absolute deleted 4 characters in body Nov 2 answered Making Pascal Paillier' output absolute Nov 2 comment Is there a way to optimize a linear scan while preserving anonymity? I disagree that it has a contradiction; I don't care if a third party who has a guess of $A$ can learn whether his guess is correct. What I want is that a third party who doesn't have a plausible guess for $A$ is unable to correlate two different exchanges. The distinction between Bob and the third party is that Bob has the correct value of $A$ in his pile of $B_i$ values; the third party does not. The 'linear scan for a matching $B_i$" actually works; it's just less efficient than I'd like. Nov 2 comment PRF that can be distinguished after $k$ queries? If you are looking for a function that is strong against nonadaptive queries and single adaptive queries (whatever a single adaptive query means), but weak against two adaptive queries, how about a random involulation (that is, a function that is constrained by $F(k, F(k,x)) = x$. For functions that can take $k-1$ adaptive queries, generalize this to a function for which $F^k(x) = x$ (mostly, if $k$ isn't a divisor of the range, we can do this only most of the time) Oct 30 comment A self-decrypting block-cipher You have shown that such a primitive would not meet the standard security definitions of a block cipher; what you haven't shown is whether there would be any security issues if such a primitive were used where we typically use a block cipher, for example, in CBC mode (with an integrity transform) or in a GCM configuration. Oct 29 comment What about using only XOR gates in homomorphic encryption? It occurs to me that if the question "how can we optimize a particular calculation to minimize the number of AND gates", the answer just might depend somewhat on what that particular calculation is. Oct 28 comment Is there a way to optimize a linear scan while preserving anonymity? @SEJPM: actually, within the existing protocol, Bob does respond. However, I don't immediately see how that helps, as Bob will need to know which $B_i$ is the correct value, and Bob can't learn anything additional from his own response, Oct 28 comment Is there a way to optimize a linear scan while preserving anonymity? @SEJPM:including $H(A_1)$ would allow an attacker to deduce under some circumstances that two different exchanges used different values of $A$, if $H(A_1) \ne H(A'_1)$, he could conclude that $A \ne A'$ Oct 28 asked Is there a way to optimize a linear scan while preserving anonymity? Oct 28 comment What about using only XOR gates in homomorphic encryption? Are you asking if we can create an FHE system with only XOR as the homomorphic operation? Or, as you asking if we could optimize an homomorphic calculation by minimizing the number of AND's used (even if it drastically increases the number of XORs used)? If the former, well, XOR is not a complete function (and in particular, you cannot create an AND by using only XORs). Oct 28 comment Discrete logarithms: large prime modulus vs. large semi prime modulus It's not true that the discrete log problem is hard whenever $n$ is a large prime; what other conditions on $n$ are necessary? Also, why do you think that the function $g^x \bmod n$ for prime $n$ is second preimage resistant? Oct 28 answered How to use this homNAND gate? Oct 28 comment ElGamal Generator g problem Actually, it's 2, not 12, and 2 is a primitive root. That being said, El Gamal doesn't require us to select a value which is a primitive root; for security, we do want an element with an order with a large prime factor; in the p=19 case, that's not possible. Oct 28 comment Why is “semantically secure” important for cryptosystems? I would certainly hope that "textbook RSA" is not so widely used... Oct 27 comment How do we solve Shammir 2,3 sharring scheme where arithmetic is modulo? 8 is correct... Oct 26 comment Proving that a node is the only child So, how do you prove that B doesn't have a sibling, that is, you don't have a node E with Hash("This is message E + ab3ed") = 31415 ? Oct 26 comment Having doubt in Rijndael Algorithm- coding for decryption My question was whether you expanded the key separately, or whether you generated the subkeys dynamically while performing the encryption/decryption operation. If you generated the subkeys separately, then it's easy; you just reverse the order. If you generate them on the fly, it's trickier in the decrypt direction; you need to run the key expansion process backwards. This is possible (you start with the final key state, not the initial key, and work backwards), however it is trickier (and since I don't know VHDL, I can't help you with the details) Oct 26 comment Having doubt in Rijndael Algorithm- coding for decryption Actually, you run through the key scheduling backwards (and so the last subkey for the encryption direction is the first subkey for the decryption direction). Or, are you expanding the subkeys at the same time you're performing the encryption? Oct 26 comment Having doubt in Rijndael Algorithm- coding for decryption The ADD_ROUND_KEY step is identical for both encryption and decryption; if you have the coding for the encryption step, just reuse that. Oct 25 revised How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem? added 57 characters in body