5,405 reputation
11123
bio website people.scs.carleton.ca/~clark
location Ottawa, Canada
age 33
visits member for 3 years, 1 month
seen Jan 5 at 22:55

Postdoctoral fellow interested in authentication and cryptographic voting.


Mar
13
comment Division in paillier cryptosystem
@user996522 It depends on how you define "makes sense." If $a/b = c$, then $c \cdot b=a$. It is the same thing here. If you compute $a/b$ under encryption, you will get the encryption of the value $c$ such that $c \cdot b \bmod{n} = a$. You can think of it as "discrete division" akin to a discrete logarithm.
Mar
13
revised Division in paillier cryptosystem
added 78 characters in body
Mar
13
revised Division in paillier cryptosystem
added 797 characters in body
Mar
13
answered Division in paillier cryptosystem
Mar
9
comment Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
Duplicate on Security SE: security.stackexchange.com/questions/1886/…
Mar
8
answered Does security under ROM imply exactly what?
Mar
8
comment RSA-OAEP versus RSA with Fujisaki-Okamoto construction
In terms of your RSA construction, it is hard to say without trying to find a reduction. These things are very tricky. It does have a larger ciphertext than RSA-OAEP which is a drawback. (Also, "easier" isn't typically a design parameter. Unless if you mean more efficient or a more direct reduction to a known intractable problem. But easier to implement, to understand, etc., get trumped by efficiency.).
Mar
8
comment RSA-OAEP versus RSA with Fujisaki-Okamoto construction
(That was in reply to your previous comment).
Mar
8
comment RSA-OAEP versus RSA with Fujisaki-Okamoto construction
There seem be a hundred CCA-secure variants of Elgamal. It generally comes down to efficiency, ciphertext size, and your appetite for non-standard assumptions (random oracles, weird DH variants, etc). There is a good relatively recent paper that proposes a Elgamal variant (based on a new "twin DH" assumption) that does a nice job comparing to Elgamal, hashed Elgamal, FO Elgamal & Cramer-Shoup: iacr.org/archive/eurocrypt2008/49650126/49650126.pdf That is just scratching the surface: there is Naor-Young and a bunch of key encapsulation mechanisms (KEM)
Mar
7
answered RSA-OAEP versus RSA with Fujisaki-Okamoto construction
Feb
22
revised Threshold Signatures for RSA and DSA
added 220 characters in body
Feb
15
revised Is there some way to generate a non-predictable random number in a decentralised network?
added 17 characters in body
Feb
15
answered Is there some way to generate a non-predictable random number in a decentralised network?
Feb
14
comment Threshold Signatures for RSA and DSA
Thanks. I am thinking of an offline/infrequent signing scenario like issuing SSL/TLS certificates, transaction signing in Bitcoin, code signing in Android, etc.
Feb
14
comment Threshold Signatures for RSA and DSA
Thanks. That gives the secret sharing / reconstruction portion. I think the challenge with RSA is more in distributively generating a proper $n$ and $\phi{n}$ without anyone learning $p$ and $q$.
Feb
13
asked Threshold Signatures for RSA and DSA
Feb
3
comment What type of hash functions provides non-malleability of hash digests?
I think so. It is sort of a deterministic version of $\mathcal{H}(r\|\mathcal{H}(m))$ or $\mathcal{H}(r_2\|\mathcal{H}(r_1\|m))$ which have been studied in designing message authentication codes. Once again, it isn't provably non-malleable, but in practice should eliminate the length-extension attack.
Feb
3
comment Why RSA encryption key is based on modulo $\varphi(n)$ rather than modulo $n$
Thanks. I see why it was incorrect before.
Feb
2
revised commitments wiki description
added 658 characters in body
Feb
2
suggested suggested edit on commitments tag wiki excerpt