Reputation
2,122
Top tag
Next privilege 3,500 Rep.
Protect questions
Badges
3 16
Impact
~45k people reached

  • 0 posts edited
  • 1 helpful flag
  • 64 votes cast
Aug
16
reviewed No Action Needed public key cryptography and authentication for cross-platform network application
Aug
10
reviewed No Action Needed Worst case to average case in Ring LWE
Aug
10
reviewed No Action Needed Understanding a faulty Needam-Schroeder protocol
Aug
9
awarded  Citizen Patrol
Aug
9
reviewed No Action Needed Defining correct secured channel from endpoint to server
Aug
2
awarded  Yearling
Jul
25
comment Secure ElGamal with OAEP
I've briefly considered the hashed ElGamal case, and I can't immediately see a security proof. For certain groups, there are CCA2 attacks, but for other groups, I can't find good attacks.
Jul
25
comment Secure ElGamal with OAEP
Your argument is fine, but only for CCA2 security. (For CCA1, you don't have a decryption oracle after you get the challenge ciphertext.) Also, there are no good CCA1 attacks against ElGamal on its own, and the padding doesn't change that.
Jun
24
awarded  Caucus
Jun
24
awarded  Constituent
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
That seems like it might work, cygnusv. You need to verify that, given the distribution of the input tuple, the distribution of the tuple you produce is the same as the solver expects. When T is random, your Q should be random. When T is real, so should Q be.
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
This answer is incorrect. To see why, consider a solver that simply computes the requisite d.logs. and then trivially decides the correct answer. Now modify the solver so that if its third and fourth inputs are identical, it instead flips a coin to determine its answer. Since they are almost never identical, this is still a good solver. Apply your reduction to this modified solver. This results in an algorithm that flips a coin, which is not a good solver for 2-wBDHI. Ergo, your reduction does not work. Perhaps it can be fixed.
Apr
23
reviewed Reviewed Why does second pre-image resistance imply pre-image resistance
Apr
23
reviewed Close what is number of invertible matrix m*m on$ z_n$?
Apr
23
reviewed Approve Proving the existence of a pseudorandom function
Apr
23
reviewed Approve Why use randomness in digital signature algorithms?
Apr
23
reviewed No Action Needed Swap $x$ and $k$ in GGM construction
Apr
23
reviewed No Action Needed Common Modulus Attack in RSA
Apr
23
reviewed No Action Needed Determine encryption method with input and output
Apr
22
reviewed Reviewed Elliptic curve cryptography G*G