Reputation
Next privilege 125 Rep.
Vote down
Badges
7
Newest
 Commentator
Impact
~1k people reached

  • 0 posts edited
  • 0 helpful flags
  • 11 votes cast
Jun
12
accepted Definition of indistinguishable schemes
Jun
12
revised Definition of indistinguishable schemes
edited title
Jun
12
comment Definition of indistinguishable schemes
@cygnusv: Maybe you are right. I've updated the title.
Jun
12
asked Definition of indistinguishable schemes
Jun
12
revised What's the principle to design the functionality under UC framework?
added 1 character in body
Jun
12
revised What's the principle to design the functionality under UC framework?
added 105 characters in body
Jun
12
revised What's the principle to design the functionality under UC framework?
deleted 105 characters in body
Jun
11
comment Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
So it means if we use a group that can compute $g^{ab}$ without leaking $g^a$ (as poncho said, a group with an unfactorizable composite order ), then we may under the risk of cracking?
Jun
11
comment Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
@poncho: Would you explain it a bit more? In my opinion, as fkraiem said, we only need $b^{-1} \mod N$. Even if $N=pq$ as in RSA, $gcd(b,N)$ basically equals 1.
Jun
11
revised What's the principle to design the functionality under UC framework?
fix grammar
Jun
11
revised What's the principle to design the functionality under UC framework?
fixed grammar
Jun
11
asked What's the principle to design the functionality under UC framework?
Jun
10
accepted Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
Jun
10
revised Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
edited title
Jun
10
comment Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
Sorry, I updated the question.
Jun
10
asked Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other?
Jun
10
comment How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?
In my assumption, $x = h(p) \oplus h(p^*) \oplus r$ is the out-of-control thing.
Jun
10
comment How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?
OK, if we try every possible value of $p$ and $p^*$ concurrently, we may find only one pair $(p’,p’^*)$ that makes $h(x \oplus h(p’) \oplus h(p’^*)) = h(r)$. Then we might consider the scene $ x = \mathsf{pad}(p) \oplus \mathsf{pad}(p^*) \oplus r$. In this scene, we may find many pairs $(p’,p’^*)$ that $h(x \oplus \mathsf{pad}(p’) \oplus \mathsf{pad}(p’^*)) = h(r)$ . Am I right?
Jun
10
comment How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?
How to do this brute-force? If we've known $h(p)$, we got $y = x \oplus h(p) = h(p^*) \oplus r$, and could try every possible guess to recover the original $p^*$. Similarly, if we've known $h(p^*)$, we got $y = x \oplus h(p^*) = h(p) \oplus r$, and could try every possible password to recover the original $p$. But we in facts know nothing about $h(p)$ or $h(p^*)$ directly.
Jun
10
comment How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?
Consider a system that records every login request, but for security it never stores the guess $h(p^*)$ directly? In my opinion it's common to send $h(p^*)$ instead of $p^*$ in a authentication system... Or do I misunderstand something?