31,942 reputation
12566
bio website
location
age
visits member for 3 years, 3 months
seen 52 mins ago

2h
comment Where to store the file extension to retrieve it correctly after decryption
If you don't need to keep the extension secret, the obvious alternative would be to keep that as a part of the filename. For example, you might encrypt the file 'test.pdf' as 'test.pdf.encrypt'.
14h
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
@Vrundapatel: what form of ECC encryption has homomorphic properties. For example, with EC ElGamal, what operation can you do on two encrypted values which results in an encryption of some nontrivial function of the two plaintexts?
1d
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
@Vrundapatel: if you do need the homomorphic properties of Paillier, then why does it matter how much faster ECC is? After all, ECC doesn't meet your requirements; it doesn't matter how much faster it is.
2d
comment Designing hash function in space-efficient identity based encryption
@hanu: I had assumed that you would generate a random looking value; one way would be to feed the id into a random number generator, generate $\log N + 64$ bits, and then take the result modulo $N$. However, as long as you generate values significantly larger than $\sqrt{N}$, it probably doesn't matter a great deal how you do it (as the squaring process is one-way if you don't know the factorization)
2d
comment Designing hash function in space-efficient identity based encryption
@RickyDemer: well, given that the QR decisional problem is hard if you don't know the factorization, I suspect it might not matter if my method would generate only QR values (because someone else would not be able to distinguish anyways). Of course, that would depend a great deal on why you want values with Jacobi 1 in the first place.
Nov
21
comment Python. RSA common modulus attack problem
There are a couple of problems here (and I don't know Python well enough to give you the answers, hence this comment): a) to compute a 'negative power', you need to compute the modular inverse (and then apply the positive power); Python might provide such a utility, or as fgrieu said, you could do it on your own. b) you are using pow to compute the exponents; that is highly unlikely to work, as ME1^a is going to be huge (perhaps one trillion digits long); instead, you need to compute it modulo N (and again, Python might have a built-it to do that)
Nov
21
comment Designing hash function in space-efficient identity based encryption
The obvious (and more efficient) way to come up with a value with a Jacobi of 1 would be to use a hash function to create a value between 1 and $n-1$ (relatively prime to $n$), and then square it (modulo $n$).
Nov
21
comment Hash collision using the leading 40-bits of SHA-1
@user1813580: why should you expect this logic to find a leading-bit collision within $2^{20}$ iterations; until it falls into a loop, it is effectively doing a random walk through bit patterns; and if you test $2^{20}$ random pairs for 40 bit collisions, you have probability about $2^{-20}$ of finding one. Once you run into a loop, then the bit patterns stop acting randomly (actually, independently), however (as above) you are quite unlikely to run into a loop that early.
Nov
20
comment What is the difference between order of base point and curve order in EC?
@Mhsz: close; it turns out that finite Elliptic Curves need not be cyclic; for example, they can have $Z_2 \times Z_2$ as a subgroup; however that turns out to be cryptographically unimportant, and everything else you said is correct.
Nov
20
comment What is the difference between order of base point and curve order in EC?
possible duplicate of Why would anyone use an elliptic curve with a cofactor > 1?
Nov
20
comment Availability of a simple limited PRNG algorithm
A PRNG is always repeatable given the same seed, whether or not it is cryptographic. What cryptographic means that if you don't know the seed, the output is indistinguishable from random (even if you are given the rest of the details of how the PRNG works)
Nov
19
comment homomorphic paillier cryptosystem vs Elliptic curve cryptosystem
Do you need the homomorphic properties? If you do, then using a system that gives you those properties would be indicated. If not, then you probably are better off with a crypto system that isn't malleable.
Nov
18
comment Elliptic curve trapdoor function without modular arithmetic?
The other potential issue would be how real-based elliptic curves behave. If (say) the x-coordinate of $dG$ was approximately $c a^d$ for some values $c, d$, this would imply an efficient way to do logs (I almost wrote 'discrete logs'...)
Nov
18
comment Elliptic curve trapdoor function without modular arithmetic?
Real numbers don't work real well in crypto, because we typically hope to be able to express the values we use, and almost all real numbers cannot be expressed, even with an unbounded number of bits.
Nov
18
comment proving the security of 1 out of 2 oblivious transfer using AND function
Is the question on how to do OT using an AND function, or is it how to construct an AND function using OT? Your second paragraph says the latter; your first paragraph (and the title) says the former (and, BTW: both are possible; constructing AND out of OT is a lot more straight-forward).
Nov
18
comment Malicious DH groups
I can give one partial negative answer: we can show that the values of $g$ of the same order are equivalent, as far as the DLOG and cDH problems; if you can solve either the DLOG or the cDH problems with respect to one $g$, you can solve it for any other $g$ of the same order (with at most a polynomial number of queries). Hence, if there is a way to find a malicious group, the magic is in selecting $p$ and $q$.
Nov
16
comment Checking both Quadratic residuosity and Jacobi symbol simultaneously and efficiently
Yes, our answers are pretty close; we both provide ways to do it, given a little bit of help from the key generator. With you, the help is an example value of $s$; with mine, it's asking him to ensure $p \equiv q \equiv 3 \bmod 4$ (and with that, we can find a value of $s$ ourselves)
Nov
16
comment Why sorting is needed for Meet-in-the-middle attack
@IlmariKaronen: Minor note: we can do rather better than $O(n \log n)$ comparisons (!); the data we're sorting on is uniformly distributed, and for data like that, approaches such as radix sorting have better asymptotic complexity.
Nov
15
comment Complexity to find an preimage of a hash function
Because they said $E_{m_i}()$ denoted the encryption of an ideal block cipher; block ciphers are, by definition, invertable. What MD hashes use in practice is $H_i = H_{i-1} \oplus E_{m_i}(H_{i-1})$; xoring in $H_{i-1}$ prevents invertibility
Nov
14
comment Complexity to find an preimage of a hash function
Yes, that is what I (and the lecturer) are saying.