meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 9 months |
| seen | Apr 24 at 2:36 | |
| stats | profile views | 29 |
|
Sep 4 |
comment |
Is modern encryption needlessly complicated? Modern crypto is needlessly complicated; but not because of the (simple) primitives like RSA, DES, and AES. It's universality composability and ZKPs that are the problem. |
|
Sep 2 |
comment |
What is the sign bit for in Feige-Fiat-Shamir? In HAC, 10.26 step b (p. 410) the authors claim that the sign is required to avoid leaking information. I can only guess that this information is the fact that $I_j$ is a square, which seems to not really be very useful (after all, you can't take the square root!). A simulator could produce this same distribution, right? Just generate a random square. |
|
Sep 2 |
comment |
What is the sign bit for in Feige-Fiat-Shamir? Hm, I'd never heard of "unrestricted input" ZK before. But in the excerpt you quoted above, FFS say that we must have our $I_j$ range over all Jacobi symbol +1 values for ZKPs of knowledge. They don't mention "unrestricted input" (perhaps they have some definition of ZK that requires it I guess). |
|
Sep 2 |
comment |
What is the sign bit for in Feige-Fiat-Shamir? It's more than this. The FFS scheme equiprobably multiplies each $1/S_i^2$ by -1 or 1. Since -1 is a non-square with Jacobi symbol 1 (because $n$ is a Blum integer), this preserves the Jacobi symbol while expanding the range of values produced. I don't know why they do this (and the wikipedia version doesn't do it at all). |
|
Sep 1 |
comment |
What is the sign bit for in Feige-Fiat-Shamir? The section you cite seems to be a (slightly) different scheme from the one cited in wikipedia (the wikipedia entry doesn't even contain the $I_j$'s; I wonder if it's correct?!) |
|
Sep 1 |
comment |
Should we MAC-then-encrypt or encrypt-then-MAC? Also see the unpublished paper at citeseerx.ist.psu.edu/viewdoc/… |
|
Aug 28 |
comment |
How does asymmetric encryption work? Agreed regarding your specific constant, but perfect squares are easy to factor and there an infinite set of them. The fact that semiprime n=pq is vulnerable for certain values of p and q has led to the recommendation that p and q be "strong primes" in some RSA standards. (en.wikipedia.org/wiki/Strong_prime). |
|
Aug 27 |
comment |
How does asymmetric encryption work? Ah, like a semiprime then (en.wikipedia.org/wiki/Semiprime). These are not always hard to factor (perfect squares being the obvious example) but usually are, yes. |
|
Aug 27 |
comment |
How does asymmetric encryption work? 2^{243112609} is a very large number near a prime (it's one more than a prime). And I can factor it in my head. |
|
Aug 27 |
comment |
How does asymmetric encryption work? I would be careful to avoid saying that factorization is "extremely hard" but instead say that "no one knows how to do it efficiently." (And the truly correct statement is that "no one in the public community knows how to do it efficiently.") |
|
Aug 25 |
comment |
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize? Thanks. Do you have any familiarity with the Morris, Rogaway, Stegers construction that uses Thorpe shuffles? (cs.ucdavis.edu/~rogaway/papers/thorp.pdf) |
|
Aug 24 |
comment |
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize? Thanks Jack. I had never heard of FPE, but it's exactly what I was looking for. |
