498 reputation
29
bio website
location
age
visits member for 1 year, 3 months
seen Aug 30 at 12:57

Aug
29
comment Proof for composed signatures
Thanks @K.G. $\epsilon_3$ is bounded by the "sum" of $\epsilon$, $\epsilon'$ and $\epsilon''$ ? Or by the "maximum" of the 3 advantages ? I understand that when I have a forgery fo a composed signature, then I have a forgery for one of the 3 signatures systems...
Aug
26
revised Proof for composed signatures
added 101 characters in body
Aug
26
comment Proof for composed signatures
It's attached, that is, we have the message with its composed signature...
Aug
26
revised Proof for composed signatures
added 36 characters in body
Aug
26
comment Proof for composed signatures
It's about existencial (weak) unforgeability. I update the post.
Aug
26
asked Proof for composed signatures
Aug
26
asked OCB and GCM security
Jul
18
comment Generalized Merkle Signatures, SHA-3 and Sakura
That seems exact from a unforgeability standpoint. My question is useless.
Jul
17
comment Generalized Merkle Signatures, SHA-3 and Sakura
Even if such collision was possible for a GMSS, there was still the problem to retrieve the OTS private keys... Why do you say that this problem doesn't exist for a Merkle signature ?
Jul
15
comment McEliece and cryptanalysis
Thanks @QuadrExAtt What are these attacks complexities ? When you say "no known algorithms on quantum computers that decrease the complexity of attacks", you are speaking about attacks without quantum computer ?
Jul
10
comment McEliece and cryptanalysis
In fact I'm interested in the underlying decoding problem. What do we know about complexity to break it with quantum computers. I've seen that McEliece is resistant to quantum computer but to what bound ?
Jul
9
asked McEliece and cryptanalysis
Jul
3
accepted Does collision resistance imply (or not) second-preimage resistance?
Jul
3
comment Does collision resistance imply (or not) second-preimage resistance?
Thanks @fgrieu. If I completely understood your last paragraph, I'm not happy with the definitions since these implicit things should be explaned in these papers. This is very curious that these details are absent, we are accustomed to read collision-resistance -> second-preimage resistance.
Jul
3
asked Is a keyed PRF a MAC?
Jul
2
awarded  Inquisitive
Jul
2
awarded  Curious
Jul
2
comment Does collision resistance imply (or not) second-preimage resistance?
What I want to say is that It seems that the non classical sense is employed, according to your explanations. The problem is that the paper from P. Rogaway & T. Shrimpton seems to be about the classical version. So, discussion about collision-resistance implying second-preimage-resistance (in the classical sense of that) does not seem to be left to this source of the definitions. So where are the definitions to consider in the paper from E. Andreeva and B. Preneel ?
Jul
2
comment Does collision resistance imply (or not) second-preimage resistance?
@fgrieu It's not me that say that. I understood that from your responses (CodesInChao and fgrieu). In the paper I cite, the use of certain domain extenders lead sometimes to hash functions which are collision resistant but not second preimage resistant. So, we can deduct that if the second-preimage resistance is up to a bound $2^{n/2}$ then this is "not" considered second-preimage resistant, since we know that collision resistance (bound $2^{n/2}$) implies second-preimage resistance (bound $2^{n/2}$) in the classical sense.
Jul
1
comment Types of cryptography
@CodesInChaos That looks interesting. Thank you.