3,587 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 6 hours ago

Apr
11
revised implementing a cryptographic hash with a block cipher
changed a little bit of everything
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$
Apr
11
revised How do I express each element in a field F as a power of a primitive element?
improved grammar and changed spacing
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$
Apr
10
comment Leak-proof protocol: is such a thing possible?
The obvious thing you mention is outside of the OP's setting, and the surreptitious thing $\hspace{.98 in}$ you mention would hopefully break the protocol. $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
@StephenTouset : $\:$ Things independent of what has been mentioned so far, which is why atzz is only assuming that one of the implementations is malicious. $\;\;\;\;$
Apr
10
comment Security of this deterministic encryption scheme
Probably, although there might be differences resulting from CBC vs CTR. $\;$
Apr
10
answered Leak-proof protocol: is such a thing possible?
Apr
10
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
@SDL : $\:$ Is the value a actually relevant? $\;\;\;\;$
Apr
9
comment Security of this deterministic encryption scheme
@RichieFrame : $\:$ SIV mode doesn't have a MAC on the ciphertext either. $\;\;\;\;\;$
Apr
9
comment Security of this deterministic encryption scheme
(Also, this scheme does not support associated data.) $\;$
Apr
9
comment Security of this deterministic encryption scheme
The one flaw I see is the one the author pointed out; it uses "the same key for confidentiality and integrity." $\;$
Apr
9
comment How to know private key is computed from specific partial private key?
Are you asking about some specific proposed CT-less scheme? $\:$ Even schemes in which the Key Generation Center can know that don't necessarily let it achieve such knowledge in the same way. $\hspace{.55 in}$
Apr
9
comment Zero-knowledge proof for committing a choice?
Note that the signature proposal would not necessarily hide what the choice is before the string gets published, and publishing the string would not necessarily prove that the person "had decided on that choice by the time" the person "published the signature". $\;$
Apr
8
comment Is it possible to deduce the IV from CBC ciphered data, without knowing the key?
Creating "an IV by, for example, filename⊕Key," would result in applying $\hspace{1.9 in}$ the block cipher to key-dependent data. $\:$
Apr
8
comment Is there a malleable pubkey digital signature scheme?
sort-of. $\:$ Generate s1 at random and then let s2 be the ordered pair whose left entry is s1 and whose right entry is a (standard) signature on the ordered pair (m,s1). $\;\;\;\;$
Apr
8
comment Is there a malleable pubkey digital signature scheme?
Just let s1 always be the bit zero. $\:$ I can't think of any role s1 might play that would make the resulting definition achievable but non-trivial. $\:$ You might be interested in ring signatures. $\;\;\;\;$
Apr
8
comment Is there a malleable pubkey digital signature scheme?
I think something like this could at most give implausible deniability, since unforgeability implies that the probability of another party getting the same signature is negligible. $\;$
Apr
8
comment Is there a malleable pubkey digital signature scheme?
What you're trying to build may be related to multi-signatures‌​. $\;$
Apr
7
comment How could Fully Homomorphic Encryption support power operations?
"XOR and AND" do not "form universal gates", since they can never map an all-false input to true. $\hspace{.4 in}$