1,864 reputation
18
bio website
location
age
visits member for 1 year, 4 months
seen 12 hours ago

12h
answered Protecting a short password
12h
answered Which multiplicatively homomorphic encryption scheme supports encryption of 0?
12h
comment Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?
This isn't actually unconditionally secure unless you have state. Without a state, you may end up reusing key material.
Nov
9
reviewed Approve How do public key rings work in cryptographic applications?
Oct
20
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
ECIES. RSA-KEM.
Sep
11
comment Proof for composed signatures
If $\epsilon_3$ is smaller than all three of $\epsilon$, $\epsilon'$ and $\epsilon''$, it will be smaller than the minimum, not the maximum...
Sep
9
answered How do you create a large PRP from a small one?
Sep
7
reviewed Approve How does one calculate the scalar multiplication on elliptic curves?
Sep
4
comment Proof for composed signatures
You have $\epsilon_3 \leq \epsilon$, $\epsilon_3 \leq \epsilon'$ and $\epsilon_3 \leq \epsilon''$. Can you find a smaller bound?
Aug
30
comment Proof for composed signatures
Recall that a scheme is $\epsilon$-secure if any adversary has advantage at most $\epsilon$. For any $\epsilon_3$-forger (adversary with advantage $\epsilon_3$) against the composed system, we get an $\epsilon_3$-forger against any of the three systems. Now we apply the definition of secure.
Aug
28
answered Proof for composed signatures
Aug
2
awarded  Yearling
Jul
31
comment Rainbow table for DES with all-zero plaintext?
No, $L$ chains of length $k$; checking if we are in a chain requires computing $k$ sequences of average length $k/2$.
Jul
31
revised Rainbow table for DES with all-zero plaintext?
The first version explained a random time-memory-data trade-off, not rainbow tables.
Jul
25
reviewed Approve AES mixcolumn stage
Jul
24
answered Rainbow table for DES with all-zero plaintext?
Jul
22
comment RSA with modulus n=p²q
The Okamoto–Uchiyama cryptosystem uses a modulus $p^2 q$ to good effect. It is a precursor to Paillier's cryptosystem, which has proven fantastically useful.
Jul
15
comment Does CCA security imply authenticated encryption?
Ah, I see. Malleable was indeed the wrong word. Sorry.
Jul
15
comment Does CCA security imply authenticated encryption?
Please note that AE is not the same as NM-CCA (which is equivalent to IND-CCA). AE usually requires some form of integrity, ie. it should be hard for an adversary to come up with a ciphertext that decrypts correctly.
Jul
14
comment Does CCA security imply authenticated encryption?
CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.)