1,262 reputation
417
bio website
location Saarbrücken, Germany
age 26
visits member for 2 years, 6 months
seen 2 days ago

Feb
20
reviewed Leave Closed Why does a one-time-pad key have to be at least as long as a message?
Feb
20
reviewed Close Finding if exponent share is present in dlog instance
Feb
20
reviewed Leave Open Signature based on public key cryptography and forgery
Feb
20
reviewed Approve suggested edit on What makes LSBit steganography detectable? And what would help in concealing it?
Feb
17
comment Proving that a function is not a OWF (One-way-function)
That information is exactly what your definition is missing. But in general when it comes to crypto we are interested in average-case one-way functions. Which means the probability is taken over the choice of x and therefore it is fine if the function is easy to invert for some inputs, as long as it is hard on average.
Feb
13
awarded  Civic Duty
Feb
10
comment Signature based on public key cryptography and forgery
It depends on what you mean. If the secret key is necessary to find the second document, then it is fine. If you know the secret key, you can already sign anything you want. However, if it is possible to find the second document given only the original message, signature and public key, then the scheme is trivially forgeable.
Feb
9
comment RSA assumption and cryptography
This sounds a lot like homework. But it sounds like you might want to check out random self-reducibility.
Feb
3
comment Going Blind, Group or Ring?
I still don't see how Alice would prove that she does NOT know the secret key. There is nothing stopping Alice from knowing a key for a different identity.
Feb
2
comment Going Blind, Group or Ring?
Basically, Alice would have to prove that she does NOT know the secret key used for signing. And unless I'm missing something, that should be impossible, because the instance of Alice that knows the key can always simulate an instance of Alice that has less knowledge.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
To be clear, I'm not aware of any non-deterministic MAC construction actually used anywhere in practice. As with any simple primitive, for a general definition I would refer to "Introduction to Modern Cryptography" by Katz/Lindell. In particular Definition 4.1 on page 114. books.google.de/…
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
"for it is just as easy to verify a truncated MAC as is it to verify the original" this is of course only true for deterministic MACs with canonical verification. In general the definition of a MAC does not guarantee that that's the case.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
Also, the digital signature scheme would have to be deterministic for the "recreate and check if equal" to work. Which is of course not the case for all signature schemes.
Jan
29
reviewed Approve suggested edit on Efficient Robust Private Set Intersection Additive ElGamal
Jan
29
comment Authentication and deniability
You may want to check out this question crypto.stackexchange.com/questions/5676/…
Jan
28
reviewed Close One-way function and uninvertible function
Jan
28
reviewed Close Are the protocols DH-EKE, B-SPEKE, A-EKE, and SRP are considered challenge-response authenticaion mechanisms?
Jan
28
reviewed Leave Open Question about SHA-2 (and potentially similar hashing algorithms)
Jan
28
reviewed Close Efficiently computing the neutral element in a ring isomorphic to Z/NZ?
Jan
15
reviewed Close Many time pad attack