Reputation
26,584
Next tag badge:
419/400 score
79/80 answers
Badges
2 37 112
Newest
 Benefactor
Impact
~411k people reached

Jun
23
answered Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Jun
23
revised Functions that are only second-preimage resistant?
Polish
Jun
23
comment Functions that are only second-preimage resistant?
@otus: yes, $H′(0)=H′(1)$ imply $H'$ isn't collision resistant; that's because from the definition of $H'$ we know a particular $(a,b)$ [that is, $(0,1)$] such that $a\ne b$ and $F(a)=F(b)$. We assume the adversary knows this definition too, and is at least as smart as we are.
Jun
23
revised Functions that are only second-preimage resistant?
Polish
Jun
23
revised Functions that are only second-preimage resistant?
Polish
Jun
23
revised Functions that are only second-preimage resistant?
Make the input domain finite. Give definitions.
Jun
22
comment Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
Can you restrict to ISO/IEC 9796-2 scheme 1, both message and modulus of size multiple of 8 bits, and implicit use of SHA-1 as the hash (as in the linked paper, and EMV)? If yes, is there anything not clear after reading EMV 4.3, Book 2, Annex A2.1?
Jun
22
answered Functions that are only second-preimage resistant?
Jun
18
revised Trial divisions before Miller-Rabin checks?
added 1 character in body
Jun
18
comment Length-preserving all-or-nothing transform
@D.W.: The construction that you describe requires 6 hashes, and can at most operate on twice the hash size. In the context I was considering, of formatting the message representative for a 2048-bit RSA signature, and SHA-256, it does not cut it. It is easy to make a 1024-bit wide hash from SHA-256, but the resulting 2047-bit AoNT has 6 rounds, 4 hashes per round, 3 compression functions per hash, for 72 compression functions total. That's non-trivial overhead. And things are worse with AES as a building block. I still think we lack simple and efficient AoNT for wide (>1000 bit) blocks.
Jun
18
comment Length-preserving all-or-nothing transform
Yes; but your answer does not explicitly construct a public random permutation of arbitrary size, from fixed-size primitives. For large size it is not trivial, as shown by the comment proposing a construction using CBC (which is not AoN). $\;$ In fact, a AoNT would be an ideal building block in RSA signature schemes (especially those with message recovery and deterministic), but ISO/IEC 9796-2 scheme 3 seems to uses something lesser, perhaps because a simple yet efficient AoNT is not so easy to build.
Jun
18
comment Length-preserving all-or-nothing transform
@StephenTouset: your construction is not AoN. For example, we can recover $m_0$ from the last two blocks of cihertext.
Jun
18
revised Authenticated encryption without padding
simple reformulation of FPE in the context
Jun
18
comment Trial divisions before Miller-Rabin checks?
@noloader: You are right that $\lg$ is used for base-2 logarithm, I (hopefully) fixed the update section in my answer. It remains that ceil( (log(k)/log(2))/2 ) is faulty, and errs quite on the unsafe side below 250 bits, at least compared to table 4.4. I should be ceil( (k/log(2))/2 ) if you want the bound that the HAC derives, and discusses on page 165. $\;$ I'm glad I wrote it is notoriously hard to validate primality-testing code before finding that issue in the question's formula, and you found the (lesser) one in my update pointing it!
Jun
18
revised Trial divisions before Miller-Rabin checks?
Clarify
Jun
18
revised Trial divisions before Miller-Rabin checks?
Fix what $\lg$ is in the HAC
Jun
18
awarded  Necromancer
Jun
17
comment Functions that are only second-preimage resistant?
Hint: assume a compressing function that satisfies all three properties; tweak it by changing the image of a single element to break collision resistance.
Jun
17
comment Functions that are only second-preimage resistant?
@CodesInChaos: you are right that proving collision resistance implies second-preimage resistance won't help.
Jun
17
revised Trial divisions before Miller-Rabin checks?
Polish