1,644 reputation
8
bio website
location
age
visits member for 8 months
seen yesterday

Feb
7
answered One-way permutation over a small interval?
Feb
6
answered Computationaly hard detokenization algorithm for credit card numbers
Feb
5
comment Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?
The Wikipedia page on cryptographically secure pseudo-random generators isn't a good reference, because it requires "backtracking resistance", which is non-standard. Also, the best definition of pseudo-random generator uses indistinguishability, not next-bit-unpredictability. The two notions are equivalent, of course, but the indistinguishability definition is best.
Feb
5
answered Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?
Feb
4
revised Perfect Secrecy -> One Time Semantic Security -> Secure PRG
added 501 characters in body
Feb
4
comment Perfect Secrecy -> One Time Semantic Security -> Secure PRG
Supposedly: Andrew C. Yao. Theory and Applications of Trapdoor Functions. In Proceedings of the 23rd IEEE Symposium on Foundations of Computer Science, pages 80– 91. IEEE Computer Society, 1982.
Feb
4
comment On the Definition of a PRG and a CSPRG
fgrieu's comment above is a good answer to the question.
Feb
4
revised Perfect Secrecy -> One Time Semantic Security -> Secure PRG
added 240 characters in body
Feb
4
answered Perfect Secrecy -> One Time Semantic Security -> Secure PRG
Jan
30
answered Derive both MAC and AES keys from same PBKDF2?
Jan
12
revised Difference between CBC-MAC and CMAC
added 110 characters in body
Jan
12
answered Difference between CBC-MAC and CMAC
Jan
9
answered Why does DSS have such formulas?
Jan
6
awarded  Custodian
Jan
6
reviewed Approve suggested edit on How does Clifford Cocks 'Non-Secret Encryption' work?
Dec
27
comment EC ElGamal versus static+ephemeral ECDH
ElGamal is a DH key exchange where the recipient has a fixed DH message (the public key), and the key is used to encrypt the message using a one-time shift cipher. ECIES is a DH key exchange where the recipient has a fixed DH message (the public key), and the key is used to encrypt the message using a secure one-time symmetric cryptosystem.
Dec
19
comment Are those two distributions indistinguishable?
It's Decision composite residuosity problem. And it's not about deciding if a square root exists, but if an $N$th root exists.
Dec
18
comment Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
Just to add to the above comment: This means you don't have to verify that strings represent group elements, which is typically costly. Protocols that omit this step without other countermeasures have been broken.
Dec
12
awarded  Student
Dec
11
comment Pohlig-Hellman exponentiation block cipher
There are many possible ways to define CTR mode. But the "moral" idea is that the successor function should be easy to compute relative to the cost of computing the block cipher. Given $rg^{i-1}$, it is easy to compute $rg^i$. Given $g^{r^{i-1}}$, it is expensive to compute $g^{r^i}$. Also, this alternative is insecure, since it is easy to decide if an element is an $r$th power of some other element when you know $r$.