Reputation
1,661
Top tag
Next privilege 2,000 Rep.
Access moderator tools
Badges
7 20
Newest
 Enlightened
Impact
~40k people reached

Jul
9
comment Why we need ECDSA when we have ECDH?
You recompute the signature in your verification algorithm from public information. Therefore your signature scheme is trivially forgeable.
May
29
comment Winternitz Signature Scheme Verfication
Yes, with poncho's answer, my comment is moot. I did not think of that possible confusion.
May
29
comment Winternitz Signature Scheme Verfication
Could you elaborate on why you think x+1 is a counterexample?
May
21
comment Is it possible to have identical public keys for different ciphers?
No, the answer is off-topic and does not adress the question in any way. The question is whether it is possible to have two unrelated public key encryption schemes that are able to use the same public key. The question has nothing to do with collisions in the key-generation algorithm.
May
21
comment Is it possible to have identical public keys for different ciphers?
This does not attempt to answer the question.
May
17
comment Which of the following hash functions is collision resistant?
All I'm saying is that collision resistance does not follow in general. There can of course be instances of $H$ where $H'$ is collision resistant. It just doesn't follow in general. I.e., the collision resistance of SHA-224 does not follow from the assumption that SHA-256 is collision resistant. However we assume a lot more about SHA-256 than just collision resistance.
May
17
comment Which of the following hash functions is collision resistant?
7 is not collision resistant. Even removing a single bit can cause your function to become non-collision resistant. As an example, let $G$ be a collision resistant hash-function. Then $H(m\Vert b) = G(m)\Vert b$ is also collision resistant, however cutting away the last bit gives a trivial attack. (any pair of messages that differ only in the last bit collide)
Feb
14
comment How much computing resource is required to brute-force RSA?
@dave_thompson_085 "Slightly" by two orders of magnitude. :D Fixed it. (though it's 5.95495, so 5.95)
Feb
9
comment Hash function as secure as one-time pad?
This does not seem to attempt to answer the question.
Feb
8
comment Is $f(x)\oplus x$ a one-way function?
If one-way functions do not exist, then the statement is trivially true, because it is an all quantified statement about the empty set.
Feb
8
comment Is $f(x)\oplus x$ a one-way function?
Thanks, fixed the $x_1$ mixup. About the generality, yes that is true, as long as the length of $x_1$ is superlogarithmic, everything should be fine. But as this is a counter example, I think it's fine to be more specific.
Feb
2
comment Definition of ciphertext security
Where does it state in the screenshot that such a scheme is secure?
Feb
2
comment Definition of ciphertext security
Where do you get the idea from that such a scheme would be CCA secure?
Jan
22
comment Is it an example of bilinear pairing?
The second one is not bilinear: $e(x,y^z) =x^{(y^z)} \neq (x^{yz})} = e(x,y)^z$. For the first one I don't see the problem with bilinearity at the moment, but the group is pretty useless for crypto since discrete log is trivial.
Jan
2
comment Why is proof-by-reduction needed (for Elgamal proof of security, for example)?
@curious I'm only showing that the distribution is not uniform, not that it can be efficiently distinguished from a uniform distribution.
Nov
16
comment plaintext distribution ,perfect secrecy cryptosystem
I'm not sure that the claim actually holds. Are you sure that there are no additional constraints on the "specific plaintext distribution"? Unless I'm confused, any encryption scheme (or even the identityfunction) offers perfect secrecy for the distribution that has probability 0 for all but one plaintext. But obviously this does not imply perfect secrecy for other distributions.
Jul
13
comment pairing-based schemes
Well scalar multiplication does not have bilinearity, a pairing does.
Jun
24
comment Is there a way to compress multiple signatures of the same data?
Aggregate Signatures are more general than that, but might offer you what you want.
May
22
comment One-time pad, zero key and Shannon
By "using Shannon" you mean applying Shannon's theorem? Sure, you can define your key-generation algorithm to pick the all zero key with probability 0 and all others with probability $1/(|\mathcal{M}|-1)$. That's exactly your encryption scheme. Then apply the theorem which states that the scheme is perfectly secret if and only if two condition hold. One of those conditions is that every key is chosen with the same probability, which obviously does not hold.
May
22
comment One-time pad, zero key and Shannon
@CGFoX Well, we are talking about the OTP here (except that the all zero key is not allowed), so by definition, $\mathcal{M}=\mathcal{C}=\{0,1\}^n$. But even if they are some other sets. If the set of keys has an element less that the messages, then for any ciphertext $c$, there exists at least one message $m$ that cannot possibly result in $c$ no matter which key is chosen.