Reputation
2,092
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
2 15
Newest
 Caucus
Impact
~44k people reached

  • 0 posts edited
  • 0 helpful flags
  • 59 votes cast
Jul
25
comment Secure ElGamal with OAEP
I've briefly considered the hashed ElGamal case, and I can't immediately see a security proof. For certain groups, there are CCA2 attacks, but for other groups, I can't find good attacks.
Jul
25
comment Secure ElGamal with OAEP
Your argument is fine, but only for CCA2 security. (For CCA1, you don't have a decryption oracle after you get the challenge ciphertext.) Also, there are no good CCA1 attacks against ElGamal on its own, and the padding doesn't change that.
Jun
24
awarded  Caucus
Jun
24
awarded  Constituent
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
That seems like it might work, cygnusv. You need to verify that, given the distribution of the input tuple, the distribution of the tuple you produce is the same as the solver expects. When T is random, your Q should be random. When T is real, so should Q be.
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
This answer is incorrect. To see why, consider a solver that simply computes the requisite d.logs. and then trivially decides the correct answer. Now modify the solver so that if its third and fourth inputs are identical, it instead flips a coin to determine its answer. Since they are almost never identical, this is still a good solver. Apply your reduction to this modified solver. This results in an algorithm that flips a coin, which is not a good solver for 2-wBDHI. Ergo, your reduction does not work. Perhaps it can be fixed.
Apr
23
reviewed Reviewed Why does second pre-image resistance imply pre-image resistance
Apr
23
reviewed Close what is number of invertible matrix m*m on$ z_n$?
Apr
23
reviewed Approve Proving the existence of a pseudorandom function
Apr
23
reviewed Approve Why use randomness in digital signature algorithms?
Apr
23
reviewed No Action Needed Swap $x$ and $k$ in GGM construction
Apr
23
reviewed No Action Needed Common Modulus Attack in RSA
Apr
23
reviewed No Action Needed Determine encryption method with input and output
Apr
22
reviewed Reviewed Elliptic curve cryptography G*G
Apr
22
reviewed No Action Needed Protocols with deliberate errors
Apr
22
reviewed No Action Needed Super-simple encryption of short strings
Apr
22
reviewed Reviewed Verification of Pinocchio (verifiable computation)
Apr
22
comment Verification of Pinocchio (verifiable computation)
You should probably add a link to the paper and make it easier for readers to find this $y$ and the verification procedure in the paper.
Apr
20
reviewed Leave Closed Multiple AES/ECB encryptions of different data with same key all end with same pattern
Apr
20
reviewed Close why are both ipad and opad required for HMAC?