1,263 reputation
417
bio website
location Saarbrücken, Germany
age 26
visits member for 2 years, 6 months
seen 8 hours ago

19h
comment What is a 'secret key factory'? What precisely is it doing?
This question appears to be off-topic because it is about the inner workings of a particular java library. But to answer your question: What you are seeing is the Object ID being printed because you tried to print an object to the standard output. Check the documentation docs.oracle.com/javase/7/docs/api/javax/crypto/spec/… what you are looking for is probably the output of the getEncoded() method.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu This is getting way too long for the comments. But you have some basic misunderstanding about the proof technique here. IF the construction from the proof WOULD work against $f$, THEN the proof would lead to the conclusion that F'' is a PRF. But it does not.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu The reasoning (which while correct is missing a crucial argument about the distribution of sums of uniformly and independently distributed values) simply does not apply to your example. The reasoning goes as follows: To simulate the oracle for a dist. against $F$ we simply follow the construction of $F$, but use the oracle (containing either $f$ or a random function) instead of $f$. Now the following holds: (1) If the oracle is $f$, then we perfectly simulate $F$. (2) If the oracle is a random function then we perfectly simulate a random function. The second part fails for $F''$.
Mar
14
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu Yes, the proof sketch is missing the argument, why it is that the reduction perfectly simulates a random function in the case that it itself is given access to a random function. But my point is that the proof does NOT need " profound change" besides that. The reduction trivially fails for the examples you give, because the distribution of outputs is incorrect for the random case. In particular your distinguisher would always output the same bit when run as a subroutine of the reduction, because the condition you check would hold in both cases.
Mar
13
comment Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)
@fgrieu I don't see how the same argument would work for your examples. If we assume an analogous simulation of the oracle for $F'$, it is easy to see that the simulation of the random case simply fails. That is, in both cases (PRF and random function) the simulated oracle exhibits the bias you mention. The hard part in proving such PRF constructions secure is always to argue why the simulation does not fail in the random case. Here, such an argument can be made for the original function, but not for your examples.
Feb
21
comment Prove that two MACs with incremendal PRF application are not secure
Well, to show that they are not secure, you have to present an adversary that is able to forge them. For the first one, think about how, given a message and a tag, you can find another message for which the same tag will verify. For the second one, think about how you might be able to compute a tag for a longer message without knowing the key.
Feb
17
comment Proving that a function is not a OWF (One-way-function)
That information is exactly what your definition is missing. But in general when it comes to crypto we are interested in average-case one-way functions. Which means the probability is taken over the choice of x and therefore it is fine if the function is easy to invert for some inputs, as long as it is hard on average.
Feb
10
comment Signature based on public key cryptography and forgery
It depends on what you mean. If the secret key is necessary to find the second document, then it is fine. If you know the secret key, you can already sign anything you want. However, if it is possible to find the second document given only the original message, signature and public key, then the scheme is trivially forgeable.
Feb
9
comment RSA assumption and cryptography
This sounds a lot like homework. But it sounds like you might want to check out random self-reducibility.
Feb
3
comment Going Blind, Group or Ring?
I still don't see how Alice would prove that she does NOT know the secret key. There is nothing stopping Alice from knowing a key for a different identity.
Feb
2
comment Going Blind, Group or Ring?
Basically, Alice would have to prove that she does NOT know the secret key used for signing. And unless I'm missing something, that should be impossible, because the instance of Alice that knows the key can always simulate an instance of Alice that has less knowledge.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
To be clear, I'm not aware of any non-deterministic MAC construction actually used anywhere in practice. As with any simple primitive, for a general definition I would refer to "Introduction to Modern Cryptography" by Katz/Lindell. In particular Definition 4.1 on page 114. books.google.de/…
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
"for it is just as easy to verify a truncated MAC as is it to verify the original" this is of course only true for deterministic MACs with canonical verification. In general the definition of a MAC does not guarantee that that's the case.
Jan
31
comment Is it ok to send part of digital signature if we have bandwidth constraints?
Also, the digital signature scheme would have to be deterministic for the "recreate and check if equal" to work. Which is of course not the case for all signature schemes.
Jan
29
comment Authentication and deniability
You may want to check out this question crypto.stackexchange.com/questions/5676/…
Dec
2
comment What is the difference between, and security of $Z_p$ and $F_p$?
If $p$ is prime (and not 2 or 3), then $p-1$ is even and not equals to 2 and therefore cannot be prime.
Nov
22
comment Creating a secure key
In general, hashing (i.e. applying a collision resistant hash-function) is of course not a secure way to generate a key. However, our practical hash-functions are often assumed to be suitable for such tasks.
Nov
15
comment order between adversaries and type of resources given
From my experience CCA definitions that do not allow encryption queries are extremely uncommon. So a better way of putting that might be "Yes, unless you are using an uncommon definition of CCA that does not allow encryption queries."
Nov
10
comment Why don't we use MACs to store passwords?
I would like to add, that of course a MAC is generally no well suited for this task, because its common security definitions in no way guarantee any confidentiality. I.e. a MAC can be secure but leak the message, which makes this entire thing pointless. So for this to even make sense you would have require more than just a secure MAC. Some specific common MACs, such as HMAC, however would probably work.
Sep
23
comment How to decode an OTP message?
The question states, that it's encoded as 8-bit ascii, so no it cannot be a=1...