Reputation
Next tag badge:
50/100 score
29/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~45k people reached

4h
comment ssh-keygen DH Primality Testing
I don't know whether-or-not they use Miller-Rabin, but if so, then this paper $\hspace{1.84 in}$ gives upper bounds on that probability. $\;$
10h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Associated data authentication might work, but in general one should just use a(n efficiently-invertible) pairing function (that is efficiently computable), such as $\:$ prefixfree(x) || y $\:$ or if ​ length(y) < length(x) ​ then ​ 1 || prefixfree(y) || x ​ else ​ 0 || prefixfree(x) || y. $\hspace{.54 in}$
10h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
In general, $\;\;\; (x,\hspace{-0.03 in}y) \: = \: x\hspace{.04 in}||\hspace{.03 in}y \;\;\;$ does not work, since $\;\;\; 1\hspace{.03 in}||\hspace{.03 in}11 \: = \: 111 \: = \: 11\hspace{.03 in}||\hspace{.03 in}1 \hspace{1.68 in}$ but one would need $\;\;\; (1,\hspace{-0.04 in}11) \neq (11,\hspace{-0.04 in}1) \:\:\:\:$. $\;\;\;\;\;\;\;\;\;$
10h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Is it also "assumed that any party can correctly decomposit" $\:$ c || ciphertext $\:$ "and thereby recover the length of $c$"? $\;\;\;$ (After all, if $c$ is just being prepended, then that's what would need to be decomposed.) $\;\;\;\;\;\;\;\;$
11h
comment Signature Verification: High level
It's neither of those things. $\:$ See this answer. $\;\;\;\;$
11h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
The OP fixed that issue well before you posted this answer. $\;$
11h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Also, is it assumed that the private-key holder can recover length(c) from $\hspace{1.79 in}$ length(c) + length(the_ciphertext) $\:$ ? $\;\;\;\;$
12h
comment How to correctly convert TAG value to the right format so that to Verify HMAC?
What programming language is that? $\;$
13h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
By the syntax above your post's grey line, $\: \operatorname{Range}(\hspace{.05 in}f_K) \subseteq \mathcal{C} \:$, $\:$ so the left part of the disjunction can be removed. $\;\;\;$ (Also, I've now convinced myself that without the assumption I mentioned, even the integrated scheme could be malleable, rather than just the KEM.) $\;\;\;\;\;\;\;\;$
13h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
That is reasonable, it's just something to make sure of, since otherwise the KEM can be malleable. $\hspace{.48 in}$
13h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
No, since you wrote $\mathcal{C}$ instead of $\operatorname{Range}(\hspace{.05 in}f_K)$ and wrote $\hspace{.04 in}f_K$ instead of $\hspace{.04 in}f_K^{-1}$. $\;$
15h
comment Is constructing IND-CCA2 public key encryption schemes particularly easy with the KEM/DEM approach?
Is $\hspace{.04 in}f_K^{-1}$ assumed to not output an element of $\operatorname{Dom}(\hspace{.05 in}f_K)$ whenever $\hspace{.04 in}f_K^{-1}$'s $\hspace{1.93 in}$ input is not an element of $\operatorname{Range}(\hspace{.05 in}f_K)$? $\;$
2d
comment Cryptanalysis on two time pad ciphers?
crypto.stackexchange.com/q/2249/991 $\;$
2d
comment Prove that certain amount of data was stored
eprint.iacr.org/2013/805.pdf $\;$
2d
comment Present an attack for the combination of OTP and textbook RSA
@Ruggero : $\;\;\;$ Presumably, he means ​ length(r) = length(m) . $\;\;\;\;\;\;\;\;$
2d
comment Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?
That depends entirely on the rest of $G$'s description. $\;$
2d
comment Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?
One can "know that in advance" by choosing $G$. $\:$ "this doesn't say you nothing about the possible output," which is why the answer to your title is "Maybe". $\;\;\;\;$
2d
answered Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?
Jul
29
comment Attack on Double Encryption Scheme
Is the PKE scheme assumed to be CCA-secure? $\;$
Jul
29
comment Signature and hash function properties
@YehudaLindell : ​ I mean you're pointlessly making a stronger assumption. ​ ​ ​ ​