3,336 reputation
1519
bio website
location United States
age
visits member for 2 years, 8 months
seen 11 hours ago

Apr
12
comment Why should a signature use PSS padding in RSA?
In addition to issues related to RSA, what your first paragraph describes is analogous to encrypt-and-MAC.
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
I thought that would be about the chaining variable's length, rather than the MAC's length. $\hspace{.95 in}$
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
@DrLecter : $\:$ How will the birthday attack "allow to produce such a forgery"? $\hspace{1.76 in}$
Apr
12
revised security in the standard model → random oracle model?
expanded a little bit
Apr
12
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
related $\;$
Apr
11
revised security in the standard model → random oracle model?
inserted a "constant-round" that I had forgotten
Apr
11
answered security in the standard model → random oracle model?
Apr
11
revised implementing a cryptographic hash with a block cipher
changed a little bit of everything
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$
Apr
11
revised How do I express each element in a field F as a power of a primitive element?
improved grammar and changed spacing
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$
Apr
10
comment Leak-proof protocol: is such a thing possible?
The obvious thing you mention is outside of the OP's setting, and the surreptitious thing $\hspace{.98 in}$ you mention would hopefully break the protocol. $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
@StephenTouset : $\:$ Things independent of what has been mentioned so far, which is why atzz is only assuming that one of the implementations is malicious. $\;\;\;\;$
Apr
10
comment Security of this deterministic encryption scheme
Probably, although there might be differences resulting from CBC vs CTR. $\;$
Apr
10
answered Leak-proof protocol: is such a thing possible?
Apr
10
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
@SDL : $\:$ Is the value a actually relevant? $\;\;\;\;$
Apr
9
comment Security of this deterministic encryption scheme
@RichieFrame : $\:$ SIV mode doesn't have a MAC on the ciphertext either. $\;\;\;\;\;$
Apr
9
comment Security of this deterministic encryption scheme
(Also, this scheme does not support associated data.) $\;$
Apr
9
comment Security of this deterministic encryption scheme
The one flaw I see is the one the author pointed out; it uses "the same key for confidentiality and integrity." $\;$
Apr
9
comment How to know private key is computed from specific partial private key?
Are you asking about some specific proposed CT-less scheme? $\:$ Even schemes in which the Key Generation Center can know that don't necessarily let it achieve such knowledge in the same way. $\hspace{.55 in}$