2,946 reputation
1518
bio website
location United States
age
visits member for 2 years, 6 months
seen 50 mins ago

Feb
7
comment Collecting entropy from a stream to a file
Does the stream have essentially unlimited length? $\:$ Can you use significantly more space than the file's size?
Feb
7
reviewed Reviewed Collecting entropy from a stream to a file
Feb
7
reviewed Approve suggested edit on Generating Diffie-Hellman parameters efficiently
Feb
7
comment Computationaly hard detokenization algorithm for credit card numbers
The PKE should be fast so that more effort can be spent on scrypt. $\hspace{2.55 in}$ (I would suggest $\:\operatorname{length}(N\hspace{.02 in}) = 1280\:$ and $\:e=3\;$.) $\;\;\;$
Feb
7
comment Encrypting a payload for transmission over HTTP. AES256 with PBKDF2
That should work. $\;$
Feb
7
answered Encrypting a payload for transmission over HTTP. AES256 with PBKDF2
Feb
6
comment Encrypting a payload for transmission over HTTP. AES256 with PBKDF2
You should use authenticated encryption. $\:$ If 256 bytes is a hard limit and you would like to handle $\hspace{.3 in}$ messages that are very close to being that long, then there are more complicated things you can do. $\hspace{.59 in}$
Feb
6
comment One-way permutation over a small interval?
I think that whether or not $g$ should be a generator depends on whether $\hspace{1.86 in}$ index calculus or generic attacks are faster. $\:$
Feb
6
comment One-way permutation over a small interval?
(You obviously figured this part out, but my previous comment should say "exactly $q$" instead of "exactly $p$".)
Feb
6
comment Why do authors execute a leakage resilient election protocol inside a leak-free phase?
I don't see your confusion. $\:$ They want to be able to show that their protocol can tolerate leakage in the online phases, so since the election protocol has not been shown to be leakage resistant, they put the election protocol in the pre-processing phase. $\;\;\;\;$
Feb
6
comment One-way permutation over a small interval?
You can get one for $\;\; p \: = \: (2\hspace{-0.03 in}\cdot \hspace{-0.03 in}s)+3 \;\;$ by using the elements of order exactly $p$. $\hspace{1.7 in}$ (The main trick is $\: x\mapsto \operatorname{min}(x,p\hspace{-0.04 in}-\hspace{-0.04 in}x) \;$.) $\;\;\;\;\;\;\;\;$
Feb
5
comment Securely send public key from client to server in RSA?
@Ekris : $\:$ No, passwords would suffice. $\;\;\;\;$
Feb
5
comment Securely send public key from client to server in RSA?
For your initial suggestion, you would need a way for the client to confirm to the server that the client got the right secret back. $\:$ Hashes would only help either as part of the padding to make the encryption CCA-secure, or as having the server's public key be a signature verification key instead of a public encryption key. $\;\;\;\;$
Feb
5
comment Why do authors execute a leakage resilient election protocol inside a leak-free phase?
errr... that just says the resulting MPC will be weakly leakage-resilient, not that the election protocol is leakage resilient. $\:$ I doubt it, since the authors probably put the election inside the pre-proc box because the election is not leakage-resilient. $\;\;\;\;$
Feb
5
comment Going Blind, Group or Ring?
In that case, you can use PKI with an explicit list of root signature verification keys. $\:$ (You would pretty much need to reveal an upper bound on the length of the two certificate chains, and each party's work would need to scale linearly in that bound, although you could make those parts trivial by having each non-root signed directly by a root.) $\;\;\;$
Feb
4
comment Why do authors execute a leakage resilient election protocol inside a leak-free phase?
If it's leakage-resilient, then the leakage-resilience that it has is probably not enough for leakage-resistance. $\:$ However, I do not see any claim by the authors that the election protocol is leakage-resilient. $\hspace{1.07 in}$
Feb
4
comment Going Blind, Group or Ring?
I thought it was just that Carol cannot learn Bob's identity. $\:$ If you cannot embed Bob's identity (which is a stronger restriction), then the only thing I can think of is to assume that during setup, each allowed party can broadcast a (list of) signature verification key(s) in a way that guarantees that only allowed parties can broadcast and that even those parties can only broadcast once. $\;\;\;$
Feb
3
comment Reason for difference in assumptions for practical private-key and public-key crypto
Making "big jumbles of bits" is sufficient for signatures; namely, hash-based signatures. $\hspace{1.04 in}$
Feb
3
comment Is 80 bits of key size considered safe against brute force attacks?
Where did you get that this is for RFID tags? $\;$
Feb
3
comment Going Blind, Group or Ring?
@Maeher : $\:$ The fact that the problem would otherwise become provably impossible to solve is what stops Alice from knowing a key for a different identity. $\;\;\;\;$