5,445 reputation
11123
bio website people.scs.carleton.ca/~clark
location Ottawa, Canada
age 33
visits member for 3 years, 3 months
seen Jan 5 at 22:55

Postdoctoral fellow interested in authentication and cryptographic voting.


Jun
30
comment Using bad generator in ElGamal Encryption
Your first point is semantics, but all modern crypto textbooks do not consider the secure version (order q instead of p-1) a variant. Elgamal with order p-1 leaks Legrange, not Jacobi, but it is true both Elgamal and RSA leak a bit. Padding is necessary for RSA to have CPA (and likely CCA) security, but Elgamal is CPA secure in prime order subgroups without padding. Padding is essentially never used with Elgamal, either because you want the homomorphic properties or you use a hybrid variant (e.g., hash Elgamal).
Jun
29
comment Using bad generator in ElGamal Encryption
Typo: should be "not generally (always) be hard". Also FWIW, if you try and encrypt an $M$ that is not in the group generated by $g$, then you can end up with a different set of problems.
Jun
29
comment Using bad generator in ElGamal Encryption
If $g$ generates a prime-ordered group that is small (e.g., less than 160 bits), then discrete logs become feasible. If $g$ has composite order, the discrete log will not generally (always) not be hard (there are ways to setup composite groups that are). If $g$ has large prime order, then it is secure even if it is not the order that was intended (but you may have trouble encoding $M$ into $\mathbb{G}_q$).
Jun
29
revised Using bad generator in ElGamal Encryption
added 14 characters in body
Jun
29
revised Using bad generator in ElGamal Encryption
added 88 characters in body; added 120 characters in body; added 14 characters in body
Jun
29
answered Using bad generator in ElGamal Encryption
Jun
18
answered Are there any differences between PIR, oblivious transfer and differential privacy?
May
7
comment RSA reencryption scheme
Section 4.3 of this paper has an example for RSA but it is unidirectional: www.isoc.org/isoc/conferences/ndss/03/proceedings/papers/14.pdf
May
7
comment RSA reencryption scheme
This is called proxy re-encryption and there are a lot of ways of doing it: en.wikipedia.org/wiki/Proxy_re-encryption
Apr
30
awarded  Enlightened
Apr
30
awarded  Nice Answer
Apr
13
answered What are advantages of using a HMAC over RSA with SHA-1 hashes?
Apr
13
answered Blind signature with openssl
Apr
7
awarded  Critic
Mar
30
comment What challenge should I use in a challenge-response proof-of-work?
Good point about multiple connections. You are right, in DoS prevention, I guess parallalization doesn't matter much. Yeah, scrypt is a nice way to meter based on processing power and memory accesses.
Mar
30
answered What challenge should I use in a challenge-response proof-of-work?
Mar
27
comment ZKIP for Paillier public key correctness
Yes, the proof is very complicated. I would consider using the exponential version of Elgamal ($\mathsf{Enc}(g^m)$ instead of $\mathsf{Enc}(m)$, see tinyurl.com/CGS1997) instead of Paillier if possible.
Mar
26
answered ZKIP for Paillier public key correctness
Mar
26
revised Division in paillier cryptosystem
edited tags
Mar
20
answered Order Preserving Encryption for Numeric Data Values