1,744 reputation
8
bio website
location
age
visits member for 11 months
seen 16 hours ago

1d
comment RSA with modulus n=p²q
The Okamoto–Uchiyama cryptosystem uses a modulus $p^2 q$ to good effect. It is a precursor to Paillier's cryptosystem, which has proven fantastically useful.
Jul
15
comment Does CCA security imply authenticated encryption?
Ah, I see. Malleable was indeed the wrong word. Sorry.
Jul
15
comment Does CCA security imply authenticated encryption?
Please note that AE is not the same as NM-CCA (which is equivalent to IND-CCA). AE usually requires some form of integrity, ie. it should be hard for an adversary to come up with a ciphertext that decrypts correctly.
Jul
14
comment Does CCA security imply authenticated encryption?
CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.)
Jun
5
comment Modulo properties of two prime numbers
Recall the definition for when two numbers are congruent modulo some number. Then prove for yourself that if two numbers are congruent modulo some product, they are also congruent modulo the factors of the product. Then prove for yourself that if two numbers are congruent modulo two different moduli, then they are congruent modulo the least common multiple of the moduli. Then apply these results, and you are done.
May
30
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
If you use $IV=1$ for the first encryption and $IV=2$ for the second encryption, you will probably evaluate the block cipher twice at the value $2$. That would be bad. So you have to be careful not only to have unique IVs, but also make sure there won't be any overlap in the evaluation. It is usually easy to ensure this, but it may require some thinking.
May
29
comment What's the advantage of using OFB/CFB/CTR modes over a stream cipher
Side Note #3: CTR mode is extremely sensitive to how you choose the IV.
Apr
24
comment Generalize the Merkle-Damgard construction for any compression function
Let $m = m_1 m_2 \dots m_n$. Suppose $y_0$ is fixed and let $y_i = f(y_{i-1}, m_i)$, $h(m) = y_n$. This is the basic Merkle-Damgård construction, but some extra tricks are needed. You first need to understand why these tricks are needed. Study how you recover a collision for $f(\cdot)$ from a collision in $h(\cdot)$. Then come up with a suitable trick. Hint: expansion.
Apr
20
comment Diffusion in Shamir's secret sharing scheme
Based on your description, it serves no purpose.
Apr
11
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
If you allow $x>p-1$ it is easy. Can you do it with $0 < x < p-1$?
Mar
27
comment Security proof of FO(Fujisaki-Okamoto) hybrid encryption
Note that this only works because the decryption algorithm recreates $C_1$ after recovering $\sigma$. Modern schemes do without recreating $C_1$.
Mar
19
comment Which of following new (2013) ECC curves is the most secure or efficient?
arxiv.org/abs/quant-ph/0301141
Mar
19
comment Which of following new (2013) ECC curves is the most secure or efficient?
Quantum computers can compute d.logs. on all of these curves. "Post-quantum" they have no security.
Mar
19
comment Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$
This is reasonably correct. One quibble: Can $h_1g_1^{-1}$ and $h_2 g_2^{-1}$ be different?
Mar
18
comment Which of following new (2013) ECC curves is the most secure or efficient?
"post-quantum"?
Mar
16
comment Elliptic Curves of different forms
The emphasis placed on "easy" is justified. People have an amazing ability to screw things up. Making it easier not to screw up is worthwhile. This is why we now have AEAD schemes instead of just encryption+MAC, etc., etc.
Mar
16
comment Elliptic Curves of different forms
Both. Modern curves are easier to implement correctly, and implementations are faster. No, I have no idea about implementations. Dan Bernstein probably has something sensible, but it may not be suitable for you.
Mar
16
comment How can I create an RSA modulus for which no one knows the factors?
A good place to start may be: Carmit Hazay, Gert Læssøe Mikkelsen, Tal Rabin, Tomas Toft: Efficient RSA Key Generation and Threshold Paillier in the Two-Party Setting. CT-RSA 2012: 313-331.
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
Quantum computers suitable for running Shor's algorithm are still stuck at six qubits or so. Post-quantum cryptography is certainly interesting as a research topic, but compared to all the real threats you face today you should give it low priority.
Mar
4
comment GCM vs CTR+HMAC tradeoffs
Polynomial evaluation can be computed in parallel.