1,363 reputation
518
bio website
location Saarbrücken, Germany
age 27
visits member for 3 years
seen 3 hours ago

Jul
13
comment pairing-based schemes
Well scalar multiplication does not have bilinearity, a pairing does.
Jun
24
comment Is there a way to compress multiple signatures of the same data?
Aggregate Signatures are more general than that, but might offer you what you want.
May
22
comment One-time pad, zero key and Shannon
By "using Shannon" you mean applying Shannon's theorem? Sure, you can define your key-generation algorithm to pick the all zero key with probability 0 and all others with probability $1/(|\mathcal{M}|-1)$. That's exactly your encryption scheme. Then apply the theorem which states that the scheme is perfectly secret if and only if two condition hold. One of those conditions is that every key is chosen with the same probability, which obviously does not hold.
May
22
comment One-time pad, zero key and Shannon
@CGFoX Well, we are talking about the OTP here (except that the all zero key is not allowed), so by definition, $\mathcal{M}=\mathcal{C}=\{0,1\}^n$. But even if they are some other sets. If the set of keys has an element less that the messages, then for any ciphertext $c$, there exists at least one message $m$ that cannot possibly result in $c$ no matter which key is chosen.
May
21
comment Which concrete applications benefit from Oblivious RAM constructions?
@e-sushi I don't quite get what your comment is trying to convey. He is NOT asking about attacks on ORAM (this is indeed a much used abbreviation). He is asking about the attacks on non oblivious encrypted data-structures that are the motivation to develop ORAM construction (be that Hash based or whatever)
May
21
comment Prefix property for variable length pseudo-random generators
$m_0$ and $m_1$ certainly still have to have the same length. Check Definition 3.8. With messages of different length, the security definition becomes meaningless.
May
11
comment The advantages of Merkle Signature and One time Signature
Of course it does: Only a single message can ever be securely signed under the public key of an OTS. In contrast, many messages can be signed under the public key of the Merkle scheme without compromising security.
May
6
comment Is G is a secure PRG?
You should specify what F is (I assume a pseudorandom function) and where k comes from.
May
4
comment Block cipher encryption of decryption with the same key
It depends on what you mean by "encrypt with a blockcipher". If you mean using a blockcipher in a secure mode of operation, then no, the probability of this happening will be negligible.
May
3
comment PRF and hash functions
No, hash functions are only modeled as random oracles for proofs in the random oracle model. If we work in the standard model, a hash function is only assumed to be collision resistant. The key of a hash function stems from a technicality of defining collision resistance. The problem is that it is (almost) impossible to define collision resistance for a single function. Therefore collision resistance is defined for a function family, and the key is required to select a member of that family.
Apr
15
comment What is a 'secret key factory'? What precisely is it doing?
This question appears to be off-topic because it is about the inner workings of a particular java library. But to answer your question: What you are seeing is the Object ID being printed because you tried to print an object to the standard output. Check the documentation docs.oracle.com/javase/7/docs/api/javax/crypto/spec/… what you are looking for is probably the output of the getEncoded() method.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu This is getting way too long for the comments. But you have some basic misunderstanding about the proof technique here. IF the construction from the proof WOULD work against $f$, THEN the proof would lead to the conclusion that F'' is a PRF. But it does not.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu The reasoning (which while correct is missing a crucial argument about the distribution of sums of uniformly and independently distributed values) simply does not apply to your example. The reasoning goes as follows: To simulate the oracle for a dist. against $F$ we simply follow the construction of $F$, but use the oracle (containing either $f$ or a random function) instead of $f$. Now the following holds: (1) If the oracle is $f$, then we perfectly simulate $F$. (2) If the oracle is a random function then we perfectly simulate a random function. The second part fails for $F''$.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu Yes, the proof sketch is missing the argument, why it is that the reduction perfectly simulates a random function in the case that it itself is given access to a random function. But my point is that the proof does NOT need " profound change" besides that. The reduction trivially fails for the examples you give, because the distribution of outputs is incorrect for the random case. In particular your distinguisher would always output the same bit when run as a subroutine of the reduction, because the condition you check would hold in both cases.
Mar
13
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu I don't see how the same argument would work for your examples. If we assume an analogous simulation of the oracle for $F'$, it is easy to see that the simulation of the random case simply fails. That is, in both cases (PRF and random function) the simulated oracle exhibits the bias you mention. The hard part in proving such PRF constructions secure is always to argue why the simulation does not fail in the random case. Here, such an argument can be made for the original function, but not for your examples.
Feb
21
comment Prove that two MACs with incremendal PRF application are not secure
Well, to show that they are not secure, you have to present an adversary that is able to forge them. For the first one, think about how, given a message and a tag, you can find another message for which the same tag will verify. For the second one, think about how you might be able to compute a tag for a longer message without knowing the key.
Feb
17
comment Proving that a function is not a OWF (One-way-function)
That information is exactly what your definition is missing. But in general when it comes to crypto we are interested in average-case one-way functions. Which means the probability is taken over the choice of x and therefore it is fine if the function is easy to invert for some inputs, as long as it is hard on average.
Feb
10
comment Signature based on public key cryptography and forgery
It depends on what you mean. If the secret key is necessary to find the second document, then it is fine. If you know the secret key, you can already sign anything you want. However, if it is possible to find the second document given only the original message, signature and public key, then the scheme is trivially forgeable.
Feb
9
comment RSA assumption and cryptography
This sounds a lot like homework. But it sounds like you might want to check out random self-reducibility.
Feb
3
comment Going Blind, Group or Ring?
I still don't see how Alice would prove that she does NOT know the secret key. There is nothing stopping Alice from knowing a key for a different identity.