Reputation
992
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
4 18
Newest
 Yearling
Impact
~13k people reached

2d
comment When all shares of a secret are given to adversary as a permuted matrix
You have to be aware that you do not get perfect secrecy anymore when using this scheme but only computational security. Now you can increase security increasing the number of dummies. However, in the end you will probably not be more secure than using for example AES... in both cases the attacker just has to guess the key for a permutation.
Feb
3
comment When all shares of a secret are given to adversary as a permuted matrix
Well, but you could simply sample the dummy values from the same distribution. E.g., if we continue the Twitter + Shamir case you could simply produce shares for dummy Twitter messages. In general, you should be able to generate the same distribution by sharing messages that follow the same distribution as your real message. The only issue is that you end up with enormous storage requirements...
Jan
25
answered Is there any more information on this RSA backdoor?
Jan
15
comment Proof of non-membership on a merkle tree
Agreed, that's not nice. However, I guess you do not get more efficient than the two proposed solutions sticking with Merkle trees. Simply because the trees themselves are not aware of the universe the data set lives in.
Jan
15
comment Proof of non-membership on a merkle tree
Indeed... The problem is that Merkle tree's are only designed for proofs of membership, not for proofs of non-membership. Perhaps you choose the wrong tool? You might want to have a look at cryptographic accumulators (e.g. eprint.iacr.org/2008/538.pdf).
Jan
14
answered Instantiating a random oracle
Jan
14
answered Proof of non-membership on a merkle tree
Jan
13
answered Choice of the one-way function (OWF) for Lamport signatures
Jan
6
answered Question about lower bound and upper bound key collision
Jan
6
answered Why Generate Keys are inside game
Dec
10
answered Fast Forward Hash Signatures
Dec
9
comment Fast Forward Hash Signatures
You might want to add at least a security "argument" if not a proof to the concept. Writing this might already tell you possibly existing problems (I do not claim that there are problems).
Nov
16
reviewed No Action Needed Trivium example
Nov
16
reviewed Close Grouping in BGN
Nov
11
awarded  Yearling
Oct
26
comment How is “post-quantum security” proven/shown?
@YehudaLindell At least more confident than in something for which we know that Shor's algorithm works. But indeed it is a problem that there is only little work on quantum cryptanalysis. Most works so far barely apply Grover's search algorithm to some intermediate search step in the classical algorithms.
Oct
26
comment Small Quantum Signatures - Reality check needed
@poncho: "resumably the PRNG has some magic way to fast forward n steps in Poly(logn) steps (which isn't a "backdoor", as presumably anyone can do it)." That's exactly what I point out to be necessary. Regarding the collision resistance: You can get away with weaker requirements not vulnerable to birthday attacks when using randomized hashing. That's why I was talking about exhaustive search...
Oct
23
comment Small Quantum Signatures - Reality check needed
@poncho: Regarding (2): How does one verify in reasonable time / (taking $n$ as security parameter) how does one verify in polynomial time? And why do you need a 256 bit hash :-) (You can get away without collision resistance / birthday attacks, but exhaustive search always allows to find a second-preimage...)
Oct
22
answered Small Quantum Signatures - Reality check needed
Oct
18
reviewed No Action Needed How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?