Reputation
5,952
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 22
Newest
 Informed
Impact
~66k people reached

Apr
22
answered On the security definition of password-authenticated key exchange
Apr
22
comment Can I always derive a key pair from password+salt with libsodium?
Public Key key generation algorithms are not designed to not allow shortcuts, and it seems to me that for RSA, one can test given randomness against a given public key with fairly high accuracy significantly faster than running the key generation algorithm. ​ (Use Baillie–PSW and only generate one of the primes.) ​ ​ ​ ​
Apr
21
comment Parallel file encryption and authentication for large files
@sebi707 : ​ That relation matters because its two sides are the lengths of the inputs to the HMAC in the two cases. ​ ​ ​ ​
Apr
21
comment Parallel file encryption and authentication for large files
(where "number of blocks" refers to "number of blocks in the file", not "total number of blocks you've encrypted") ​ ​
Apr
21
comment Parallel file encryption and authentication for large files
A HMAC of "all previous hashes would suffice" if [[number of blocks] times [length of HMAC]] never equaled your block size. ​ (It might suffice even if they can equal each other; I didn't try to work that out.) ​ ​ ​ ​
Apr
21
comment Can I always derive a key pair from password+salt with libsodium?
"storing an encrypted (random) private key" means you don't need to spend time running the key generation algorithm, which lets the pbkdf's work factor be higher for a given overall runtime. ​ ​
Apr
19
comment How to construct a collision resistant hash function that is not a one-way function?
"negation of one-wayness means that for" the output for randomly chosen input, you have non-negligible probability of finding "a corresponding input. " ​ Thus, the "only way for such a method not to work is to have" [[size of input space] divided by [size of output space]] be non-negligible. ​ (Although, when that quotient is negligible, even second-preimage resistance will imply onewayness.) ​ ​ ​ ​
Apr
19
comment Generating random non-repeating numbers from a small group
Sometimes-Recurse Shuffle "will provide you with" much-closer-to-ideal security. ​ ​
Apr
18
answered State of the art low memory arbitrary-domain PRP?
Apr
18
comment State of the art low memory arbitrary-domain PRP?
If ​ 2^(2^128) < n ​ then encryption just outputs the plaintext and decryption just outputs the ciphertext. ​ ​ ​ If ​ n ≤ 2^(2^128) ​ then sometimes-recurse shuffle with 128 bits of security. ​ ​ ​ ​ ​ ​ ​ ​
Apr
18
comment State of the art low memory arbitrary-domain PRP?
If we take [b being fixed] completely seriously, then O(1) memory suffices - If ​ 2^(2^b) < n ​ then use the identity function on Zn, else use any PRP on Zn. ​ ​ ​ To avoid that, one must assume some relation between n and b. ​ ​ ​ I had initially been assuming log(n) was significantly less than b (making things more difficult), but it now seems like your interested in when log(n) is significantly greater than b. ​ ​ ​ ​ ​ ​ ​ ​
Apr
18
comment State of the art low memory arbitrary-domain PRP?
Oohh, is your space requirement for when log(n) is not significantly less than b? ​ (I was assuming the other way around.) ​ ​ ​ ​
Apr
18
comment State of the art low memory arbitrary-domain PRP?
Does it seem to have a security level significantly above 512 bits? ​ ​
Apr
18
comment Meaning of “random n/2 bit prime length prime p”
Your title has one more "prime" than your post's body. ​ ​
Apr
18
comment State of the art low memory arbitrary-domain PRP?
Is there even a PRF with such low space requirements? ​ ​
Apr
18
comment Is the following obfuscation weak in security or not?
Are {the operations on the line just above those} in {the q-element meadow}? ​ ​
Apr
18
comment Is the following obfuscation weak in security or not?
Is $\leftarrow$ supposed to denote setting the left variable to a random entry of the right tuple? ​ ​
Apr
18
comment Two-party equality computation
crossposted from mathoverflow after less than 5 minutes, without mentioning that on either site ​ ​
Apr
18
comment Differences between OWP and OWF and their IND-CPA security
The paper giving a more efficient construction of PRGs from OWFs is this one. ​ ​
Apr
17
comment How to Perform Computation on AES Encrypted Data
To answer your question: ​ Implement sufficiently homomorphic encryption and provide $\hspace{.8 in}$ [an encryption of the AES key with the homomorphic scheme]. ​ ​ ​ ​