K.G.
Reputation
2,424
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
 Jan 19 comment Encryption scheme like RSA where encryption is the inverse of decryption I've added a link. Jan 10 comment Plain text size limits for AES-GCM mode just 64GB? To use this better solution, you will probably need to deviate from the standard. If you just use an 88 bit nonce with a random implementation, it will hash that nonce into a 96 bit nonce and still use a 32-bit counter, which does not solve the problem. Jan 5 comment Proof of RSA security dependent on public key exponent Like I said, I am not entirely convinced. So I agree with your disagreement. It's complicated. Jan 5 comment Proof of RSA security dependent on public key exponent I have been told that large exponents (like 65537) reduce the consequences of certain implementation mistakes. One can therefore argue that a standard with exponent 3 will - on average - have weaker implementations than a standard with larger exponent. I am not entirely convinced... Dec 25 comment Construct IND-CPA secure encryption scheme by combining two given schemes Except that there is no inner scheme. I've added a proof sketch. Dec 24 comment Construct IND-CPA secure encryption scheme by combining two given schemes So you understand how the construction works. Do you know how security proofs work in general? Dec 23 comment Construct IND-CPA secure encryption scheme by combining two given schemes I have added some text to the answer. Is it clear now? Dec 12 comment How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE) Maybe you could mention where you are reading this? Dec 9 comment NMaster key from n secret key I would not expect information theoretical security to be possible. Oct 2 comment Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)? You can also use a modulus slightly larger than $2^{2048}$, and if your ciphertext is larger than $2^{2048}$, just choose some new randomness and encrypt again. This gives you uniform randomness. Sep 27 comment RSA: special parameters construction Note that e has to be large for this to make sense. Suppose e is larger than p. What is q congruent to modulo e? What is then N congruent to modulo e? Sep 27 comment Determine if a public key point y is negative or positive, odd or even? Unlike the ordinary integers, there's no notion of "positive" or "negative" points on an elliptic curve. So asking which of (x,y) and (x,-y) is the negative point is not relevant. The same for even and odd. Jul 25 comment Secure ElGamal with OAEP I've briefly considered the hashed ElGamal case, and I can't immediately see a security proof. For certain groups, there are CCA2 attacks, but for other groups, I can't find good attacks. Jul 25 comment Secure ElGamal with OAEP Your argument is fine, but only for CCA2 security. (For CCA1, you don't have a decryption oracle after you get the challenge ciphertext.) Also, there are no good CCA1 attacks against ElGamal on its own, and the padding doesn't change that. May 21 comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value? That seems like it might work, cygnusv. You need to verify that, given the distribution of the input tuple, the distribution of the tuple you produce is the same as the solver expects. When T is random, your Q should be random. When T is real, so should Q be. May 21 comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value? This answer is incorrect. To see why, consider a solver that simply computes the requisite d.logs. and then trivially decides the correct answer. Now modify the solver so that if its third and fourth inputs are identical, it instead flips a coin to determine its answer. Since they are almost never identical, this is still a good solver. Apply your reduction to this modified solver. This results in an algorithm that flips a coin, which is not a good solver for 2-wBDHI. Ergo, your reduction does not work. Perhaps it can be fixed. Apr 22 comment Verification of Pinocchio (verifiable computation) You should probably add a link to the paper and make it easier for readers to find this $y$ and the verification procedure in the paper. Mar 18 comment Concatenation of two strong hashes may have striking weakness If $H_0$ and $H_1$ are independent hashes, the intuitive result holds in ROM, I guess. Mar 18 comment Concatenation of two strong hashes may have striking weakness Preimage resistance is indeed much more difficult to define than most basic texts pretend. Many natural definitions are defective in that obviously insecure constructions are secure according to the definition (e.g. choose an element at random from the co-domain: the preimage-finder must find a preimage of that element). I think a plausible definition is: the adversary chooses a suitable plaintext distribution, you sample from the distribution and compute the hash value, finally the adversary recovers any preimage. Under this definition, concatenation is not preimage-resistance-preserving. Jan 13 comment Key derivation of public key without knowledge of private key Yep. ten letters