Reputation
5,905
Next tag badge:
134/100 score
18/20 answers
Badges
1 14 28
Newest
 Nice Answer
Impact
~120k people reached

Feb
15
answered Is there some way to generate a non-predictable random number in a decentralised network?
Feb
14
comment Threshold Signatures for RSA and DSA
Thanks. I am thinking of an offline/infrequent signing scenario like issuing SSL/TLS certificates, transaction signing in Bitcoin, code signing in Android, etc.
Feb
14
comment Threshold Signatures for RSA and DSA
Thanks. That gives the secret sharing / reconstruction portion. I think the challenge with RSA is more in distributively generating a proper $n$ and $\phi{n}$ without anyone learning $p$ and $q$.
Feb
13
asked Threshold Signatures for RSA and DSA
Feb
3
comment What type of hash functions provides non-malleability of hash digests?
I think so. It is sort of a deterministic version of $\mathcal{H}(r\|\mathcal{H}(m))$ or $\mathcal{H}(r_2\|\mathcal{H}(r_1\|m))$ which have been studied in designing message authentication codes. Once again, it isn't provably non-malleable, but in practice should eliminate the length-extension attack.
Feb
3
comment Why RSA encryption key is based on modulo $\varphi(n)$ rather than modulo $n$
Thanks. I see why it was incorrect before.
Feb
2
revised commitments wiki description
added 658 characters in body
Feb
2
suggested rejected edit on commitments tag wiki excerpt
Feb
2
suggested approved edit on commitments tag wiki
Feb
2
wiki created commitments description
Feb
2
revised Is there a cumulative commitment scheme?
edited tags
Feb
2
revised What type of hash functions provides non-malleability of hash digests?
edited tags
Feb
2
answered What type of hash functions provides non-malleability of hash digests?
Feb
1
answered Why RSA encryption key is based on modulo $\varphi(n)$ rather than modulo $n$
Jan
30
answered Are there two known strings which have the same MD5 hash value?
Jan
30
comment Salts, how does the script know what the salt is?
Thanks @Paulo and @Thomas; good points. I fixed my answer.
Jan
30
revised Salts, how does the script know what the salt is?
added 36 characters in body
Jan
30
comment Proving knowledge of a preimage of a hash without disclosing it?
The hash design needs to be known so both parties can follow the progress through the circuit. I don't think we can always have something real-world practical (it isn't claimed in the talk that we can; only that we can for SHA-1). It depends on how well the function lends itself to certain tricks for speeding up the proof. What he did was as much art as science in converting SHA-1 into a blend of boolean/arithmetic circuitry.
Jan
30
comment Proving knowledge of a preimage of a hash without disclosing it?
An unbounded Alice can always prove. A bounded Alice can only prove when the circuit complexity of the hash has the same bound. A real-life Alice can only prove if she can generate a relatively simple description of the circuit with operations that have efficient zero-knowledge proofs. The latter is the case with SHA-1, but necessarily other hash functions.
Jan
30
answered Salts, how does the script know what the salt is?