264 reputation
17
bio website
location
age
visits member for 1 year, 9 months
seen Jan 28 at 21:20

Jan
27
comment Why do we use 1024 / 160 bit primes in DSA?
Thanks a lot!!!
Jan
14
comment Possible to check if $a \in \mathrm{QR}_n$?
Thank you for your good explanation!
Oct
2
comment Non-interactive proof that an element is in a subgroup
Thx for your comment. I appreciate it, but what I don't get is why we need rewinding to proof the ZK property? I have done some further research. Can you please look at my edits above? In the paper they don't give a proof, they just say like "this is a standard procedure".
Sep
30
comment Non-interactive proof that an element is in a subgroup
yes, but the question which ruins my sleep is why the zero-knowledge property is not fulfilled using a large challenge? ;)
Sep
30
comment Non-interactive proof that an element is in a subgroup
I mean instead of running the zero-knowledge protocol 160 times with challenge $\in_R \{0,1\}$ for proper security level run it only once with challenge $\in_R \{2^{159}, \ldots, 2^{160}-1\}$
Sep
10
comment Question about Fermat's little theorem
Thanks Alex!!!!
May
8
comment What does $(\mathbb{Z}_n^*)^2$ mean?
@HenrickHellström: I have looked a little bit around. The theorem was copied from another paper. In the original paper they have never used quadratic residues but Cartesian products. It makes all sense now! Thanks a lot for your help!
May
8
comment What does $(\mathbb{Z}_n^*)^2$ mean?
Thanks for your answer. I have inserted the theorem which contains $\mathbb{Z}_n^*$. I think what they really mean is $(g, h) \in (\mathbb{Z}_n^∗)^2$, or?
Apr
28
comment Question about proof of knowledge defintion?
thanks for your answer, but I don't get why the number of trials is important. The term says that $K$ returns the secret in polynomial time ($|x|^c$), right? Do you know, why the factor $1/..$ is important (why not write just $|x|^c$)?
Apr
14
comment Comprehension question on a signature protocol based on the RSA assumption
your answer really, really helps! Thanks a lot!!! The paper is about the CL-protocol (tor-svn.freehaven.net/anonbib/cache/camenisch2002ssep.pdf). They choose $n$ as a safe prime product, so you are right in general. What I still don't get is why they say, that the exponent (in the paper they call it $e$ instead of $x$) must be prime.
Mar
8
comment Zero-knowledge proof that a group element is a quadratic residue?
A signature of knowledge means to use the Fiat-Shamir heuristic to make a ZK proof protocol non-interactive. It uses the output of a hash function as the challenge. Security is then also based on the random oracle model.
Mar
8
comment How difficult is it to check if a group element is in a sub group?
Thanks, this helps!
Mar
8
comment How difficult is it to check if a group element is in a sub group?
It was just a general question. I didn't have a specific group in my mind.
Mar
8
comment Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?
cool, this helps... Thanks!
Jan
24
comment How to find an element of high-order in an RSA group?
Thanks for your answer. Maybe I am thinking to complicated but how can I find such elements and how can I be sure that they have maximum order?
Jan
21
comment Why work in a subgroup QR(n) of an RSA group $Z^*_n$?
thanks a lot, this helps...