Reputation
5,840
Next tag badge:
132/100 score
18/20 answers
Badges
1 14 27
Newest
 Enlightened
Impact
~117k people reached

Jul
16
answered Is it possible to ensure security with zero pre-shared information?
Jul
12
awarded  Yearling
Jul
11
comment Feedback on rolling my own entropy gatherer
Hash functions cannot be shown to be good extractors. There is a theory-practice gap on this point, but given that there are very simple constructions that can be shown to be good extractors, one should use them. See Section 1 of this paper: iacr.org/archive/crypto2004/31520493/clean.pdf
Jul
11
awarded  Sportsmanship
Jul
10
reviewed Approve Untraceable communication protocol
Jul
10
answered Do Quantum Key Distribution and Physical Unclonable Functions combine, and how?
Jul
10
answered Untraceable communication protocol
Jun
30
comment Using bad generator in ElGamal Encryption
Your first point is semantics, but all modern crypto textbooks do not consider the secure version (order q instead of p-1) a variant. Elgamal with order p-1 leaks Legrange, not Jacobi, but it is true both Elgamal and RSA leak a bit. Padding is necessary for RSA to have CPA (and likely CCA) security, but Elgamal is CPA secure in prime order subgroups without padding. Padding is essentially never used with Elgamal, either because you want the homomorphic properties or you use a hybrid variant (e.g., hash Elgamal).
Jun
29
comment Using bad generator in ElGamal Encryption
Typo: should be "not generally (always) be hard". Also FWIW, if you try and encrypt an $M$ that is not in the group generated by $g$, then you can end up with a different set of problems.
Jun
29
comment Using bad generator in ElGamal Encryption
If $g$ generates a prime-ordered group that is small (e.g., less than 160 bits), then discrete logs become feasible. If $g$ has composite order, the discrete log will not generally (always) not be hard (there are ways to setup composite groups that are). If $g$ has large prime order, then it is secure even if it is not the order that was intended (but you may have trouble encoding $M$ into $\mathbb{G}_q$).
Jun
29
revised Using bad generator in ElGamal Encryption
added 14 characters in body
Jun
29
revised Using bad generator in ElGamal Encryption
added 88 characters in body; added 120 characters in body; added 14 characters in body
Jun
29
answered Using bad generator in ElGamal Encryption
Jun
18
answered Are there any differences between PIR, oblivious transfer and differential privacy?
May
7
comment RSA reencryption scheme
Section 4.3 of this paper has an example for RSA but it is unidirectional: www.isoc.org/isoc/conferences/ndss/03/proceedings/papers/14.pdf
May
7
comment RSA reencryption scheme
This is called proxy re-encryption and there are a lot of ways of doing it: en.wikipedia.org/wiki/Proxy_re-encryption
Apr
30
awarded  Enlightened
Apr
30
awarded  Nice Answer
Apr
13
answered What are advantages of using a HMAC over RSA with SHA-1 hashes?
Apr
13
answered Blind signature with openssl