300 reputation
18
bio website
location
age
visits member for 1 year, 4 months
seen Oct 10 at 7:36

Jun
17
comment curve25519 weak points for contributory behaviour
@CodesInChaos: Very interesting application… Regarding the discussion there: I'm torn between arguing that this property is not at all a weakness of the implementation and that relying on such notion would be the fault of the protocol (similarly as I would see non-malleability as an unreasonable requirement of a signature scheme). And on the other hand I see the length extension property of the SHA2 family as a weakness and struggle to justify why this property is any different to it and why signature schemes shouldn't also be build as strongly as possible.
Jun
16
comment Safe and computationally efficient way to verify a curve25519 identity?
Why don't you establish an authenticated and encrypted connection between the server and the client (that is end-to-end encrypted/authenticated between the server and the client) and forward the client-to-client encrypted/authenticated message over this channel? This kills two birds with one stone, as the server can be sure to talk to the correct recipient and a listening party has more difficulties to find out the meta information of who talks with whom.
Jun
15
revised curve25519 weak points for contributory behaviour
Fixes embarassing typo in the title.
Jun
15
comment curve25519 weak points for contributory behaviour
Thx. Quite interestingly (0,…) stands out from the others, because the specification defines $X(Q)$ - which normally is the x-coordinate of $Q$ - as zero for $Q=\infty$. Still (0,0) is a valid point on the curve, so the image "0" of $X$ that is listed on the website refers to both $\infty$ and (0,0). Furthermore there is no $y\neq 0$ with (0,$y$) being an element on curve. So while the other dots refer to multiple y-coordinates for the same x-coordinate, the dots in (0,…) refer to the special case of the $X$ map.
Jun
15
accepted curve25519 weak points for contributory behaviour
Jun
14
revised curve25519 weak points for contributory behaviour
Add explanation why only the subgroups of order 8 and 4 should be interesting.
Jun
14
asked curve25519 weak points for contributory behaviour
Jun
13
awarded  Yearling
May
14
revised Problems with using AES Key as IV in CBC-Mode
added 140 characters in body
May
14
answered Problems with using AES Key as IV in CBC-Mode
Apr
7
awarded  Critic
Apr
6
awarded  Editor
Apr
6
answered Difference between collision resistance and target collision resistance
Feb
12
awarded  Student
Feb
12
awarded  Scholar
Feb
12
accepted Pseudo random permutation for arbitrary size domains
Feb
11
asked Pseudo random permutation for arbitrary size domains
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Great, that was the missing step :). So the argument goes like this: For $r=\log_g(t)$ and $x=\log_g(x)$ we have $g^s = t^c y \Rightarrow g^s=g^{rc} g^x \Rightarrow s=rc+x \Rightarrow sc^{-1}=(rc+x)c^{-1}=r+xc^{-1}$. Now suppose $V'$ (the original Schnorr protocol verifier) challenges $A$ with $c'$ then $A$ challenges $P$ with $c'^{-1}$ who returns $s$. $A$ now answers $V'$ with $sc^{-1}=r+xc^{-1}=r+xc'$ which will convince $V'$. Yes, that proof is also nice :D. Thanks for the discussion.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
You also assume $s=rc+x$ in the calculation "$sc^{-1} = (rc + x)c^{-1} = r + xc^{-1}$". My argumentation is not about $A$ knowing $r$ or $x$, but that $s\neq rc+x$ might be the case.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Okay, I'll phrase it differently. Suppose there was some way for $P$ to cheat $V$, i.e. supply a $t$ and $s$ that fulfil $g^s = t^c y$ without knowing $x$. Since $P$ does not know $x$ there is no reason to assume $t=g^r$ and $s=r+cx$. Since we don't know that, there is also no reason to assume that $A$ is successful to impersonate $P'$ participating in the original Schnorr protocol. Everything we deduce has to be an implication of the identity $V$ actually checks, i.e. $g^s = t^c y$.