meta user
network profile
| bio | website | vyznev.net |
|---|---|---|
| location | Helsinki, Finland | |
| age | ||
| visits | member for | 1 year, 9 months |
| seen | May 12 at 7:27 | |
| stats | profile views | 90 |
I'm not really a cryptographer, I just play one on the internet.
Seriously, I'm just a programmer and mathematician interested in puzzles and information security. I don't have any kind of formal crypto training, but I've picked up a few things here and there over the years. Topics I'm particularly interested in include protocol design and analysis, classical ciphers and information-theoretically secure crypto techniques such as one time pads and secret sharing schemes.
Please consider any (original) code I post to Stack Overflow (and other Stack Exchange sites) to be released under CC-Zero unless stated otherwise. You may do whatever you want with it and don't have to credit me in any way, although of course that would be nice.
|
Feb 27 |
comment |
Why do we need to hash both the message and the $h$ value in ElGamal signature? I tried to clean up your question a bit, but there were some places where I wasn't really sure what you meant. Could you please check that I didn't introduce any mistakes, and maybe try to clarify your question further. |
|
Feb 27 |
revised |
Why do we need to hash both the message and the $h$ value in ElGamal signature? added 52 characters in body; edited tags; edited title |
|
Feb 27 |
wiki | created elgamal-signature description |
|
Feb 27 |
wiki | created elgamal-signature excerpt |
|
Feb 27 |
comment |
Same Size Crypto Algorithm? -1, this question is so vague and poorly written that, even with the "clarifying" comments, it's hard for me to tell what's really being asked. Sorry, but it really is. Considering voting to close as "not a real question". |
|
Feb 25 |
comment |
How to generate a random polynomial of degree $m$? @Dilip: Good suggestion. I left the $\mathbb Z_q$'s unchanged, since that was the notation used in the quoted paper, and changing it mid-answer seemed needlessly confusing to me. I did, however add a (hopefully) clarifying note at the end. As for your scenario, the whole point is that, if the shareholders have no prior reason to assume that $c_k=0$, then assuming that and observing that it implies a particular value of the secret (e.g. "Attack at dawn"), however likely a priori, gives them no new information (in a sense that can be formalized and proven) about the actual secret. |
|
Feb 25 |
revised |
How to generate a random polynomial of degree $m$? added 917 characters in body |
|
Feb 25 |
comment |
How to generate a random polynomial of degree $m$? @Dilip: Anyway, any given participant's share will be equal to the secret with probability $1/q$ anyway, simply because the underlying field only has $q$ elements to choose from. This doesn't matter, since such coincidences are completely random and provide no information about the secret. If the idea still bothers you, you could always work in, say, $GF(2^{256})$, where any of this would be astronomically unlikely to happen. |
|
Feb 25 |
comment |
How to generate a random polynomial of degree $m$? @Dilip: While $k-1$ shareholders could indeed reconstruct the secret if $c_k=0$, they won't know that's the case unless they find a $k$-th shareholder to confirm it. Indeed, as far as they know, their chance of successfully doing that is the same ($1/q$) as of recovering the secret simply by randomly guessing some other participant's share. In fact, by the information-theoretical security of Shamir's scheme, it can be shown that knowing any $k-1$ shares provides no information about the secret, as long as all the non-constant coefficients of the polynomial are chosen uniformly at random. |
|
Feb 24 |
answered | How to generate a random polynomial of degree $m$? |
|
Feb 24 |
revised |
How to generate a random polynomial of degree $m$? texify, edit tags |
|
Feb 13 |
revised |
Selective format-compliant JPEG encryption? add link to paper |
|
Feb 12 |
reviewed | Approve suggested edit on Why does the SRP6 calculation of B included a multiplier k = 3? |
|
Feb 11 |
comment |
Can the hash of one message be used to make it easier to find the hash of a very similar message? There's certainly some personal variation involved here, but you might be surprised by how easy passphrases like these really are to memorize. Try it: can you recall the xkcd passphrase without looking at the comic? Try spending a minute or so coming up with a similar mnemonic for the one above (or just thinking about it, or retyping and erasing it, or whatever works best for you) and see if you can still remember it tomorrow. |
|
Feb 11 |
revised |
Can we replace the XOR operation in DES with some other operation? edited tags, copyedit |
|
Feb 11 |
comment |
Can the hash of one message be used to make it easier to find the hash of a very similar message? Nitpick: The passphrase jog doom motto gripe carat (which I just generated with Diceware) is fairly easy to remember, but your password cracker is going take a while looking for it, even if it's hashed with plain SHA-256. See also the obligatory xkcd reference. |
|
Feb 10 |
wiki | created sha-3 description |
|
Feb 10 |
wiki | created sha-3 excerpt |
|
Feb 8 |
reviewed | Satisfactory Future-Proof Versioning and Validation |
|
Feb 8 |
reviewed | Satisfactory Two step encryption |
