Reputation
5,962
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 22
Newest
 Informed
Impact
~66k people reached

Jan
27
answered In interactive proofs, do we assume that the prover can always solve the problem?
Jan
27
answered Function with no fast path and with fast proof
Jan
26
comment Forward Secrecy when using non-ephemeral DH
Ephemerality does not refer to a new session key being made each time a new session is set up", it refers to both parties' private exponents (and group elements) being freshly chosen. ​ ​
Jan
25
comment help with cryptanalysis of a sponge permutation
Where does the "byte" to the right of "Generate a psuedorandom byte" come from? ​ ​
Jan
24
comment How to change the master password in a password manager
In particular, "the user's password would" usually not "be the Key Encrypting Key". ​ ​
Jan
24
comment How to change the master password in a password manager
The Key Encrypting Key should instead be securely derived from the user's master password. ​ ​
Jan
23
comment Encryption that could have multiple decryption key
Is the number of administrators few enough that the ciphertext length can be linear in that number? ​ Would it be a problem if a malicious encryptor could make it so that some pairs of administrators will get the data and others will discover that the ciphertext was ill-formed? ​ ​ ​ ​
Jan
21
comment Why are obfuscators generally defined to be probabilistic algorithms, rather than deterministic ones?
Obfuscating "all functionally equivalent circuits" "to the same circuit" is in fact NP-hard. ​ (Just compare the obfuscation of an arbitrary circuit with the obfuscation of a circuit that always outputs False.) ​ ​ ​ ​
Jan
18
comment Encryption scheme like RSA where encryption is the inverse of decryption
The things you're asking about are called trapdoor permutations. ​ ​
Jan
12
comment What is the canonical way of creating merkle tree branches?
Given the rest of that information, the verifier can compute the alleged Merkle root on its own. ​ ​
Jan
12
comment Can I shorten the large ECDSA public key output file from OpenSSL?
(... continued) ​ ​ ​ use the same key-pairs for encryption and signing, although there are separate reasons why you might want to avoid that anyway. ​ It should be possible to reduce the key size by 1 more bit by dropping the y coordinate. ​ ​ ​ ​
Jan
12
comment Can I shorten the large ECDSA public key output file from OpenSSL?
(These 2 comments don't help answer your question, but may be useful in your environment.) ​ This paper shows how to get short key encapsulation. ​ It may be possible to modify that and/or the signature algorithm to let you ​ ​ ​ (continued ...) ​ ​ ​ ​ ​ ​ ​
Jan
11
comment Homomorphic encryption diagram and trouble about a paper
1) ​ ​ ​ I'm not sure what you mean by that, but I think the answer is no. ​ The list q is chosen during the key generation process. ​ ​ ​ ​ ​ ​ 2) ​ ​ ​ Adding 2r is the end of the encryption process. ​ Yes. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​
Jan
11
answered Homomorphic encryption diagram and trouble about a paper
Jan
11
comment Collision free one way function
It looks like the empty string collides with 0. ​ ​
Jan
9
comment Why can’t the public key exponent in RSA be negative?
No, strictly speaking he should write $\;\;\; m^{\hspace{.02 in}-3}\hspace{-0.04 in} \equiv 1000^{\hspace{.03 in}-1} \: \pmod{55} \:\:\:\:$. $\;\;\;\;\;\;\;\;\;$
Jan
6
comment Protocol to identify zone of potential agreement without revealing reservation prices and having to trust third parties?
This would actually be multi-party computation, rather than just zero-knowledge proofs. ​ ​
Jan
6
comment Zero knowledge proof of shared secret
Um, if the adversary can find more than one element of X then that's not secure against a malicious Party 2, even "if an oblivious transfer protocols that is secure for malicious adversaries is used." ​ (Party 2 can just output 1 even "if the sum of the values it received" doesn't equal A.) ​ ​ ​ ​
Jan
6
answered Why is it allowed to Generate Keys inside the game?
Jan
5
comment Zero knowledge proof of shared secret
@Niklas : ​ ​ ​ Even when "|X| is sufficiently large", Just exchanging hashes and comparing is not secure. ​ In that case, even a passive adversary could try hashing lots of guesses at the other party's secret. ​ ​ ​ ​ ​ ​ ​ ​