Reputation
27,063
Next tag badge:
429/400 score
74/80 answers
Badges
2 41 115
Impact
~429k people reached

8h
comment Can iterated hashing be used to mitigate collision and preimage weaknesses?
@boot4life: your justification is quite different from mine, and just as based on reasonable argument rather than proof. Indeed hashing twice makes twice as many rounds, which can increase security in some contexts; on top of that there is a major irregularity in the middle of the rounds, as we finalize the first hash, pad it, and reenter it as message for the other rounds, which arguably could help preimage security too - at least we have proof that it does not doom it!
9h
revised What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
Referenec to FIPS 186-4 rather than the obsolete -3
10h
comment Can iterated hashing be used to mitigate collision and preimage weaknesses?
@boot4life: see added Handwaving argument
10h
revised Can iterated hashing be used to mitigate collision and preimage weaknesses?
Add handwaving argument
12h
awarded  Good Question
14h
revised Can iterated hashing be used to mitigate collision and preimage weaknesses?
added 31 characters in body
15h
revised Can iterated hashing be used to mitigate collision and preimage weaknesses?
Answer the other aspect of the question
15h
revised Can iterated hashing be used to mitigate collision and preimage weaknesses?
Expand, synthetic answer.
15h
answered Can iterated hashing be used to mitigate collision and preimage weaknesses?
21h
comment Can RSA be securely used for “blind decryption”?
I would say that the protocol works, in the sense that if Sally is able to store $\mathcal E(k)$ and keep it secret, she can get back to $k$, thus $H(k)$, without revealing these, with the help of Charlie; further, verifying what Charlie returns, which is easy, prevents an active adversary from messing with the recovered $k$. $\;$ However I fail to see why the server does not keep $k$ or $H(k)$ rather than $\mathcal E(k)$; if we assume Charlie does its task without any check or limit in time, that seems to achieve the same result, in a much simpler way.
21h
comment Can RSA be securely used for “blind decryption”?
The part about Charlie not revealing "anything equivalent to Ki" does not seem so much of a problem to me: although we do not have a proof of that, it is widely accepted that in textbook RSA, temporary access to a decryption oracle can not allows extraction of a private key, or otherwise help the decryption of random messages drawn after access to the decryption oracle has stopped.
1d
awarded  Enlightened
1d
comment Can RSA be securely used for “blind decryption”?
Some notes: It seems the server must store the client's public key in integrity-trusted storage, and $\mathcal E(k)$ in integrity+confidentiality-trusted storage, despite the last sentence in second bullet. $\;$ The client seems to need to know $H(k)$, and it is not told how; that part of the exchange might interfere with the rest.
1d
awarded  Nice Answer
1d
revised How feasible would it be to generate 300 million public key pairs in 8 hours?
polish
1d
revised How feasible would it be to generate 300 million public key pairs in 8 hours?
Polish
1d
comment How feasible would it be to generate 300 million public key pairs in 8 hours?
@SEJPM: all the benchmarks quoted are purely single core (and single thread); bench.cr.yp.to/supercop.html states: benchmarks on multiple-core CPUs use just one core.
1d
revised How feasible would it be to generate 300 million public key pairs in 8 hours?
Benchmarks quoted are plain single-thread
1d
comment Can RSA be securely used for “blind decryption”?
Two observations: a) the scheme relies on $\mathcal E$ being homomorphic, but standard non-textbook RSA is not; thus the scheme does not allow decryption with standard non-textbook RSA, thus its security is moot; first define the variant of RSA you consider for the security analysis. b) define your security goals and threat model, in particular if an adversary impersonating the server to the client (which seems trivial since the server has no credential), or actively eavesdropping connection between actual client and server, are considered a break.
2d
comment Random Function size
@dave_thompson_085: right; thanks; I hereby replaces my previous comment (now gone) with: Also, the enumeration of the question lists only 4 out of 4!=24 one-one functions onto the set of 2-bit strings to itself.