1,844 reputation
18
bio website
location
age
visits member for 1 year, 2 months
seen 1 hour ago

Oct
20
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
ECIES. RSA-KEM.
Sep
11
comment Proof for composed signatures
If $\epsilon_3$ is smaller than all three of $\epsilon$, $\epsilon'$ and $\epsilon''$, it will be smaller than the minimum, not the maximum...
Sep
9
answered How do you create a large PRP from a small one?
Sep
7
reviewed Approve suggested edit on How does one calculate the scalar multiplication on elliptic curves?
Sep
4
comment Proof for composed signatures
You have $\epsilon_3 \leq \epsilon$, $\epsilon_3 \leq \epsilon'$ and $\epsilon_3 \leq \epsilon''$. Can you find a smaller bound?
Aug
30
comment Proof for composed signatures
Recall that a scheme is $\epsilon$-secure if any adversary has advantage at most $\epsilon$. For any $\epsilon_3$-forger (adversary with advantage $\epsilon_3$) against the composed system, we get an $\epsilon_3$-forger against any of the three systems. Now we apply the definition of secure.
Aug
28
answered Proof for composed signatures
Aug
2
awarded  Yearling
Jul
31
comment Rainbow table for DES with all-zero plaintext?
No, $L$ chains of length $k$; checking if we are in a chain requires computing $k$ sequences of average length $k/2$.
Jul
31
revised Rainbow table for DES with all-zero plaintext?
The first version explained a random time-memory-data trade-off, not rainbow tables.
Jul
25
reviewed Approve suggested edit on AES mixcolumn stage
Jul
24
answered Rainbow table for DES with all-zero plaintext?
Jul
22
comment RSA with modulus n=p²q
The Okamoto–Uchiyama cryptosystem uses a modulus $p^2 q$ to good effect. It is a precursor to Paillier's cryptosystem, which has proven fantastically useful.
Jul
15
comment Does CCA security imply authenticated encryption?
Ah, I see. Malleable was indeed the wrong word. Sorry.
Jul
15
comment Does CCA security imply authenticated encryption?
Please note that AE is not the same as NM-CCA (which is equivalent to IND-CCA). AE usually requires some form of integrity, ie. it should be hard for an adversary to come up with a ciphertext that decrypts correctly.
Jul
14
comment Does CCA security imply authenticated encryption?
CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.)
Jun
5
comment Modulo properties of two prime numbers
Recall the definition for when two numbers are congruent modulo some number. Then prove for yourself that if two numbers are congruent modulo some product, they are also congruent modulo the factors of the product. Then prove for yourself that if two numbers are congruent modulo two different moduli, then they are congruent modulo the least common multiple of the moduli. Then apply these results, and you are done.
Jun
5
reviewed Approve suggested edit on Can I create a fixed length output from a fixed length input?
May
30
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
If you use $IV=1$ for the first encryption and $IV=2$ for the second encryption, you will probably evaluate the block cipher twice at the value $2$. That would be bad. So you have to be careful not only to have unique IVs, but also make sure there won't be any overlap in the evaluation. It is usually easy to ensure this, but it may require some thinking.
May
29
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
Side Note #3: CTR mode is extremely sensitive to how you choose the IV.