5,405 reputation
11123
bio website people.scs.carleton.ca/~clark
location Ottawa, Canada
age 33
visits member for 3 years, 1 month
seen Jan 5 at 22:55

Postdoctoral fellow interested in authentication and cryptographic voting.


Feb
2
suggested suggested edit on commitments tag wiki
Feb
2
wiki created commitments description
Feb
2
revised Is there a cumulative commitment scheme?
edited tags
Feb
2
revised What type of hash functions provides non-malleability of hash digests?
edited tags
Feb
2
answered What type of hash functions provides non-malleability of hash digests?
Feb
1
answered Why RSA encryption key is based on modulo $\varphi(n)$ rather than modulo $n$
Jan
30
answered Are there two known strings which have the same MD5 hash value?
Jan
30
comment Salts, how does the script know what the salt is?
Thanks @Paulo and @Thomas; good points. I fixed my answer.
Jan
30
revised Salts, how does the script know what the salt is?
added 36 characters in body
Jan
30
comment Proving knowledge of a preimage of a hash without disclosing it?
The hash design needs to be known so both parties can follow the progress through the circuit. I don't think we can always have something real-world practical (it isn't claimed in the talk that we can; only that we can for SHA-1). It depends on how well the function lends itself to certain tricks for speeding up the proof. What he did was as much art as science in converting SHA-1 into a blend of boolean/arithmetic circuitry.
Jan
30
comment Proving knowledge of a preimage of a hash without disclosing it?
An unbounded Alice can always prove. A bounded Alice can only prove when the circuit complexity of the hash has the same bound. A real-life Alice can only prove if she can generate a relatively simple description of the circuit with operations that have efficient zero-knowledge proofs. The latter is the case with SHA-1, but necessarily other hash functions.
Jan
30
answered Salts, how does the script know what the salt is?
Jan
30
comment Proving knowledge of a preimage of a hash without disclosing it?
The protocol can allow Bob to distinguish $H$ from a random oracle, but it requires Alice's input. I don't think that contradicts indistinguishability. For example, Elgamal is IND-CPA-secure but also admits proofs of plaintext knowledge. Alice could allow Bob to distinguish ciphertexts he couldn't on his own. In any case, no implemented hash function can act as a random oracle in the real world.
Jan
30
answered Proving knowledge of a preimage of a hash without disclosing it?
Jan
27
revised Provable Encryption
edited tags
Jan
26
answered Provable Encryption
Jan
26
revised How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?
added 159 characters in body
Jan
26
answered How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?
Jan
24
comment How can I avoid calculating with huge numbers when implementing the RSA algorithm
You can do the actual computation with WolframAlpha. e.g., PowerMod[15,53,26] wolframalpha.com/input/?i=PowerMod%5B15%2C53%2C26%5D
Jan
24
answered Helper data authentication in PUFs