3,785 reputation
1621
bio website
location United States
age
visits member for 3 years, 1 month
seen 13 mins ago

1d
comment Attacker in a key exchange
@Bimal : $\:$ What do A and B output as their keys? $\;\;\;\;$
1d
comment Attacker in a key exchange
@GuutBoy : $\;\;\;$ The arrows mean sends to. $\:$ X(A) means the adversary while pretending to be A. $\hspace{.58 in}$
Dec
16
comment Extending pseudorandom generator by one bit using exclusive-or of previous bits
Alternatively, $\;\;\;$ "$z$'s first $m$ bits" $\: \mapsto \:$ "$z$" $\;\;$ and $\;\;$ "the last bit of $z$" $\: \mapsto \:$ "$0$" $\;\;$. $\;\;\;\;\;\;\;$
Dec
13
revised Verifiable random function basic example
fixed grammar and removed "functional-encryption" tag
Dec
13
comment Is it safe to AES-CBC and AES-CMAC both using the same key?
Having said that, I'm now wondering if maybe your approach is more secure than the usual one. $\hspace{.6 in}$
Dec
13
comment Is it safe to AES-CBC and AES-CMAC both using the same key?
... Just concatenate the IV with the rest of the ciphertext. $\;$
Dec
12
comment Is it safe to AES-CBC and AES-CMAC both using the same key?
Why does IV go into the plaintext? $\;$
Dec
12
comment PRG variant as a commitment scheme
(... continued) $\:$ there are no trusted parties and no trusted strings, the parties are limited to sending bits and qubits to each other (as opposed to, for example, sending tamper-evident seals or physical uncloneable functions or other hardware), and clocks are inaccurate (generally, they can only be used to detect that absence of an expected message). $\;\;\;\;$
Dec
12
comment PRG variant as a commitment scheme
@GuutBoy : $\;\;\;$ That does not "mean we are no longer in the plain model". $\:$ The "plain model" means that all computational limitations are soft (in particular, can't use timed commitments or the bounded storage model), the adversary's only limitations on working with qubits are computational and physical (so no noisy-storage model), $\:$ (continued ...) $\;\;\;\;\;\;\;$
Dec
12
comment PRG variant as a commitment scheme
(... continued) $\:$ Lemma 1 on page 6 of that paper says "If there is a distribution ally one-way function then there is a one-way function.", and by amplification and the search-to-decision reduction, if there is a one-way function then $\: \operatorname{RP} \neq \operatorname{NP} \;$$\;$. $\;\;\;\;$
Dec
11
comment PRG variant as a commitment scheme
@GuutBoy : $\;\;\;$ There are really no "schemes in the plain model" that are "proven to provide the commitment properties". $\:$ In particular, if a scheme provides the commitment properties then it is secure, the theorem on page 10 of this paper says that "Any secure bit commitment protocol can be used to construct a distributionally one-way function.", $\:$ (continued ...) $\;\;\;\;\;\;\;$
Dec
11
comment PRG variant as a commitment scheme
By "plain model", I mean without stuff like sufficiently-fair noisy channels, physical unclonable functions, tamper-evident seals, or assuming that there's sufficient noise in the receiver's quantum storage. $\hspace{.55 in}$
Dec
11
comment PRG variant as a commitment scheme
There does not "exist a variant of a PRG that is proven to provide the commitment properties", since $\hspace{.13 in}$ there does not exist any plain-model protocol "that is proven to provide the commitment properties". $\hspace{.32 in}$
Dec
11
revised PRG variant as a commitment scheme
improved grammar
Dec
11
comment PRG variant as a commitment scheme
en.wikipedia.org/wiki/… $\;$
Dec
10
reviewed Approve Looking For Additively Homomorphic Encryption
Dec
10
comment Statistical properties of hash functions when calculating modulo
@Chris : $\:$ Will a secret key be involved? $\;\;\;\;$
Dec
10
comment Statistical properties of hash functions when calculating modulo
Yes. ${}{}{}\;$
Dec
9
comment Statistical properties of hash functions when calculating modulo
$\operatorname{mod} \hspace{.04 in} 2^{80} \:$ will just give you the left or right 80 bits, depending on whether you use big or little endianness. $\;\;\;$
Dec
9
comment Looking For Additively Homomorphic Encryption
I wouldn't mind. $\;$