1,644 reputation
8
bio website
location
age
visits member for 8 months
seen 2 days ago

Dec
11
asked Pohlig-Hellman exponentiation block cipher
Dec
10
comment Slow one-way pseudo-random permutation?
Not a typo, just a mistake. Maybe six times a prime works...
Dec
10
comment Slow one-way pseudo-random permutation?
The d.log. problem on the curve reduces to the d.log. problem in $GF(p^2). Inverting the map is probably more expensive than computing it in the first place, but I don't know by how much. And doing many inversions is much cheaper per inversion than doing one inversion. It may not work better than just using a finite field with appropriate maps.
Dec
10
comment Slow one-way pseudo-random permutation?
Supersingular curves map into a finite field of twice the size, so in principle you could do index calculus in that field. But I wouldn't know how fast index calculus in that field would be compared to baby-step giant-step or Pollard $\rho$ in the subgroup.
Dec
10
comment Slow one-way pseudo-random permutation?
Let $p$ be a prime such that $p+1$ is twice a prime, $p-1$ is not divisible by $3$ and $-1$ is not a square. Consider the supersingular elliptic curve $Y^2 = X^3+1$ that has $p+1$ points. Fix some sign function $sg$ on the finite field. We can map any non-zero point $(x,y)$ to $sg(y)(x^3+1)$. Compose this map with the map $a \mapsto (a+1)P$ for some generator $P$, and you are done.
Dec
9
revised How well does breaking multiple DH key exchanges over the same group scale?
added 407 characters in body
Dec
9
comment Slow one-way pseudo-random permutation?
Maybe you could use supersingular curves to get something very close to a bijection? And perhaps you could use many such curves to make inversion more expensive?
Dec
8
answered How well does breaking multiple DH key exchanges over the same group scale?
Dec
6
comment Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
If you want non-malleable encryption, there are constructions for doing so (e.g. EME). But be aware that those schemes are only useful in very special cases. In general, they are inappropriate. Also, don't design or tamper with cryptosystems unless you know what you are doing.
Dec
6
comment Is there any analysis of freebsd's “geli” encrypted geometry provider?
I seem to remember some discussion prior to development on sci.crypt. Last time I looked, the design of geli was perfectly standard, but I never carefully looked at it.
Dec
5
comment The real-life meaning of proving over a group that doesn't support the oracle?
An adversary against the GDH problem is an algorithm that solves the CDH problem given oracle access to a DDH oracle. A reduction from CDH to DDH is an algorithm that solves the CDH problem given oracle access to a DDH oracle. Up to some details I ignore, they're much the same, no?
Dec
4
comment The real-life meaning of proving over a group that doesn't support the oracle?
Obviously not. It may help if you explain what exactly you don't understand. Do you know what a reduction is? What it means for two problems to be equivalent?
Dec
4
comment The real-life meaning of proving over a group that doesn't support the oracle?
Presence or absence of the oracle is irrelevant for the security of the scheme. If the security of your scheme is equivalent to a certain reduction not existing, then if that reduction exists, your scheme will be broken because the legitimate user acts as the relevant oracle.
Dec
4
comment Why doesn't this dummy mutual authentication protocol provide mutual authentication?
What's different about a message that Alice intends for Bob, and a message Alice intends for Trudy?
Dec
4
comment The real-life meaning of proving over a group that doesn't support the oracle?
It means that you have a reduction from CDH to DDH, that is, the two problems are equivalent in that group.
Dec
4
answered The real-life meaning of proving over a group that doesn't support the oracle?
Dec
4
comment Why doesn't this dummy mutual authentication protocol provide mutual authentication?
What you sketch cannot reasonably be interpreted as an attack because authentication schemes have very limited scope. But suppose Alice thinks she is authenticating to Trudy, not Bob. Can Trudy make Bob believe Alice authenticated to him?
Dec
3
comment $\phi$ function in Dual_EC_DRBG
The standard has a precise description of how to convert a field element to an integer. The field element can be (essentially) a positive integer or (essentially) a polynomial. In a scientific paper, it would be too much, but in a standard you have to be this precise to get a verifiable implementation.
Dec
3
comment $\phi$ function in Dual_EC_DRBG
On p. 65: "$\phi(x)$ maps field elements to non-negative integers, taking the bit vector representation of a field element and interpreting it as the binary expansion of an integer." You should explain what's wrong with that explanation.
Nov
27
comment Is it possible to attack RSA with a WalkSat derivative?
@CristianDumitrescu: If you have two bit strings with Hamming distance one and you flip a randomly chosen bit in one string, what is the probability that the Hamming distance decreases?