2,926 reputation
1518
bio website
location United States
age
visits member for 2 years, 6 months
seen 24 mins ago

Apr
13
answered Sequence of Encrypting RSA like Chaum Blinding scheme
Apr
13
answered How do they implement MAC in TLS?
Apr
13
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
Usefully, the change you describe would also stop a hash collision from immediately yielding $\hspace{.9 in}$ a way to violate unforgeability for every public key. $\;$
Apr
12
awarded  Strunk & White
Apr
12
revised Why does HMAC need a fixed length padding?
improved grammar
Apr
12
comment Why should a signature use PSS padding in RSA?
In addition to issues related to RSA, what your first paragraph describes is analogous to encrypt-and-MAC.
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
I thought that would be about the chaining variable's length, rather than the MAC's length. $\hspace{.95 in}$
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
@DrLecter : $\:$ How will the birthday attack "allow to produce such a forgery"? $\hspace{1.76 in}$
Apr
12
revised security in the standard model → random oracle model?
expanded a little bit
Apr
12
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
related $\;$
Apr
11
revised security in the standard model → random oracle model?
inserted a "constant-round" that I had forgotten
Apr
11
answered security in the standard model → random oracle model?
Apr
11
revised implementing a cryptographic hash with a block cipher
changed a little bit of everything
Apr
11
revised Open SSL signatures - merkle ecdsa rsa
improved grammar, changed spacing, and deleted incorrect tags
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$
Apr
11
revised How do I express each element in a field F as a power of a primitive element?
improved grammar and changed spacing
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$
Apr
10
comment After heartbleed, how can you safely distribute new certs?
Wouldn't it be "possible that even the root level private keys were compromised" even without heartbleed? $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
The obvious thing you mention is outside of the OP's setting, and the surreptitious thing $\hspace{.98 in}$ you mention would hopefully break the protocol. $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
@StephenTouset : $\:$ Things independent of what has been mentioned so far, which is why atzz is only assuming that one of the implementations is malicious. $\;\;\;\;$