Reputation
2,424
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
3 18
Newest
 Explainer
Impact
~55k people reached

Jan
19
comment Encryption scheme like RSA where encryption is the inverse of decryption
I've added a link.
Jan
10
comment Plain text size limits for AES-GCM mode just 64GB?
To use this better solution, you will probably need to deviate from the standard. If you just use an 88 bit nonce with a random implementation, it will hash that nonce into a 96 bit nonce and still use a 32-bit counter, which does not solve the problem.
Jan
5
comment Proof of RSA security dependent on public key exponent
Like I said, I am not entirely convinced. So I agree with your disagreement. It's complicated.
Jan
5
comment Proof of RSA security dependent on public key exponent
I have been told that large exponents (like 65537) reduce the consequences of certain implementation mistakes. One can therefore argue that a standard with exponent 3 will - on average - have weaker implementations than a standard with larger exponent. I am not entirely convinced...
Dec
25
comment Construct IND-CPA secure encryption scheme by combining two given schemes
Except that there is no inner scheme. I've added a proof sketch.
Dec
24
comment Construct IND-CPA secure encryption scheme by combining two given schemes
So you understand how the construction works. Do you know how security proofs work in general?
Dec
23
comment Construct IND-CPA secure encryption scheme by combining two given schemes
I have added some text to the answer. Is it clear now?
Dec
12
comment How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)
Maybe you could mention where you are reading this?
Dec
9
comment NMaster key from n secret key
I would not expect information theoretical security to be possible.
Oct
2
comment Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?
You can also use a modulus slightly larger than $2^{2048}$, and if your ciphertext is larger than $2^{2048}$, just choose some new randomness and encrypt again. This gives you uniform randomness.
Sep
27
comment RSA: special parameters construction
Note that e has to be large for this to make sense. Suppose e is larger than p. What is q congruent to modulo e? What is then N congruent to modulo e?
Sep
27
comment Determine if a public key point y is negative or positive, odd or even?
Unlike the ordinary integers, there's no notion of "positive" or "negative" points on an elliptic curve. So asking which of (x,y) and (x,-y) is the negative point is not relevant. The same for even and odd.
Jul
25
comment Secure ElGamal with OAEP
I've briefly considered the hashed ElGamal case, and I can't immediately see a security proof. For certain groups, there are CCA2 attacks, but for other groups, I can't find good attacks.
Jul
25
comment Secure ElGamal with OAEP
Your argument is fine, but only for CCA2 security. (For CCA1, you don't have a decryption oracle after you get the challenge ciphertext.) Also, there are no good CCA1 attacks against ElGamal on its own, and the padding doesn't change that.
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
That seems like it might work, cygnusv. You need to verify that, given the distribution of the input tuple, the distribution of the tuple you produce is the same as the solver expects. When T is random, your Q should be random. When T is real, so should Q be.
May
21
comment Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
This answer is incorrect. To see why, consider a solver that simply computes the requisite d.logs. and then trivially decides the correct answer. Now modify the solver so that if its third and fourth inputs are identical, it instead flips a coin to determine its answer. Since they are almost never identical, this is still a good solver. Apply your reduction to this modified solver. This results in an algorithm that flips a coin, which is not a good solver for 2-wBDHI. Ergo, your reduction does not work. Perhaps it can be fixed.
Apr
22
comment Verification of Pinocchio (verifiable computation)
You should probably add a link to the paper and make it easier for readers to find this $y$ and the verification procedure in the paper.
Mar
18
comment Concatenation of two strong hashes may have striking weakness
If $H_0$ and $H_1$ are independent hashes, the intuitive result holds in ROM, I guess.
Mar
18
comment Concatenation of two strong hashes may have striking weakness
Preimage resistance is indeed much more difficult to define than most basic texts pretend. Many natural definitions are defective in that obviously insecure constructions are secure according to the definition (e.g. choose an element at random from the co-domain: the preimage-finder must find a preimage of that element). I think a plausible definition is: the adversary chooses a suitable plaintext distribution, you sample from the distribution and compute the hash value, finally the adversary recovers any preimage. Under this definition, concatenation is not preimage-resistance-preserving.
Jan
13
comment Key derivation of public key without knowledge of private key
Yep. ten letters