Reputation
4,861
Next tag badge:
51/100 score
30/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~45k people reached

Jun
3
comment Is it OK to substitute a PRF for a random oracle?
PRFs are "essentially indistinguishable from them" to parties that don't know the key. $\hspace{1.26 in}$
Jun
3
comment Is it OK to substitute a PRF for a random oracle?
In fact, there are "constructions that are secure with a Random Oracle, but not secure with any specific" efficiently-computable function, even if that function is not a PRF. $\;$
Jun
3
comment Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case
scimplified.com/entries/14628/… $\;$
Jun
3
comment Which attacks are possible against raw/textbook elliptic curve?
@SOJPM : $\:$ "raw/textbook" ECDH produces a group element that is hopefully indistinguishable from random, rather than a bit-string that is hopefully indistinguishable from random. $\;\;\;\;$
Jun
3
comment Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case
Yes. $\:$ (The same applies "if a corrupted party provides a" right input, whatever that may mean.) $\hspace{.56 in}$ Huh, I can't seem to find any good books on the model. $\;\;\;\;$
Jun
3
comment Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case
This model captures "the correctness of output that is received by an honest party" by letting the distinguisher "see the honest parties' outputs." $\:$ I can't figure out how to parse the other sentence in your comment. $\;\;\;\;$
Jun
2
answered Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case
Jun
2
comment Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?
Agh, very good point, I just made that change. $\;$
Jun
2
revised Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?
fixed error
Jun
2
answered Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?
Jun
1
comment Shamir secret sharing with field 2^8
You're missing that you can also try to guess the secret. $\:$ What is k? $\;\;\;\;$
Jun
1
comment Why not put MAC in fixed position and cover padding for MAC-then-encrypt?
It seems to pretty clearly be m0 || m1 || m2 || padding || MAC of m0+m1+m2+padding, $\hspace{.17 in}$ where padding is chosen to make the length of that concatenation an integer multiple of the block size. $\hspace{.1 in}$
May
31
comment Why using AES in ECB (Electronic Code Book) mode a bad idea?
On the other hand, that makes your post's title completely different from your post's body. $\;$
May
30
comment Is this adaptation of one-time-pad still secure?
Yes, they can determine $\:$ next_x xor next_y $\:$. $\;\;\;\;$
May
30
comment Is this adaptation of one-time-pad still secure?
Yes, since you would be using y twice. $\;$
May
29
answered Constructing set membership proof for private set
May
29
comment Fast PKI for embedded device
... and the remainders of $n$ modulo those moduli should be included alongside the public key. $\hspace{.74 in}$
May
29
comment Fast PKI for embedded device
One could instead include [the quotients required to perform reduction for the publicly known moduli that will be used to verify $\;\; f\hspace{-0.06 in}\cdot \hspace{-0.04 in}h+n\hspace{-0.04 in}\cdot \hspace{-0.04 in}t \: = \: s^{\hspace{.02 in}2} \;\;$ (see "Verifying signatures" on page 3)] along with (the rest of) the signature. $\;\;\;\;\;$ In that case, those publicly known moduli should be selected to support fast multiplication, rather than fast division, ... $\;\;\;\;\;\;\;\;\;\;$
May
28
comment What is the right notion of security to use for file encryption?
Yes. ${}{}{}\;$
May
28
revised What is the right notion of security to use for file encryption?
provided a more complete reference