3,700 reputation
1621
bio website
location United States
age
visits member for 3 years
seen 31 secs ago

May
12
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
That is correct and relevant. $\:$ I was alluding to the fact that their approach does not just use exhaustive search of the input space, which is the only thing I thought of when I saw "exhaustive search". $\hspace{.71 in}$
May
11
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
"exhaustive search" $\: \mapsto \:$ "[generic collision search](http://people.scs.carleton.ca/~paulv/papers/JoC97.pdf)" $\hspace{1.8 in}$
May
11
reviewed Edit How does the energy consumption of the SHA-3 finalists compare?
May
11
revised How does the energy consumption of the SHA-3 finalists compare?
fixed typo
May
11
reviewed Reviewed RSA, finding p,q
May
11
revised RSA, finding p,q
fixed typo
May
11
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
Even if so, the paper I linked to gives a method that I think doesn't use any metric as you described. $\hspace{.36 in}$
May
11
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
I think the generic attack doesn't involve that. $\;$
May
11
comment The advantages of Merkle Signature and One time Signature
Perhaps I should expand on my previous comment: Merkle signatures can securely be used on more than one message. $\:$ Although one-time key-pairs can be used more than once, such use usually allows easy forgeries. $\;\;\;\;$
May
11
comment The advantages of Merkle Signature and One time Signature
Merkle signatures are not limited to being one-time. $\;$
May
11
comment Key exchange if forward secrecy is not an issue
Even if "Man-In-The-Middle attacks are not an issue," impersonation might still be an issue. $\hspace{.88 in}$
May
10
comment Group Signature Scheme without Opening but with Revocation
(... continued) $\:$ There is only a "signature on the OTS key by the GM" insofar as there is a signature on the OTS key with the identity-based signature scheme for which the GM knows the master private key; the GM is not involved in the generation of the OTS key and has never before seen that key. $\:$ V does not directly verify the users' signatures on the OTS keys; V verifies the arguments of knowledge of such signatures. $\;\;\;\;$
May
10
comment DH key exchange with only one end authenticated
If the unauthenticated end's group element does not go into the signature then explicit authentication certainly fails and there could conceivably be an attack based on what DH value the server gets after the adversary has submitted a different group element. $\:$ If the group and generator are not known a-priori and they do not go into the signature then there could conceivably be an attack based on creating a detectable correlation between the DH values. $\;\;\;\;$
May
10
comment Cryptographically secure keyed rolling hash function
@D.W. $\;\;\;$ "If $E$ is a PRP" with large domain "then $E$ is a PRF". $\:$ Also, does (almost-)2-universality help more than (almost-)universality for this use? $\;\;\;\;\;\;$
May
10
comment Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing
What is the point of such a long keyfile? $\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
(... continued) $\:$ If that privacy reduction is not acceptable, then I mean the largest identity on the list that's less than the user's identity and the smallest identity on the list that's greater than the user's identity, similarly to what is described in section 3.3 on this page‌​. $\:$ (continued ...) $\;\;\;\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
If what I mentioned in my previous sentence is an acceptable price, then you should look up ring signatures, especially because the GM might be able to provide a common reference string. $\:$ (For that strategy, the GM would generate the ring signature key-pairs on its own and issue them and regularly give out a signed list of issued-but-not-revoked ring signature verification keys along with their expiration times.) $\:$ (continued ...) $\;\;\;\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
I was blindly assuming that there were at least as many revoked identities as issued-but-not-revoked identities; although I now notice that your paragraph about expiration implies otherwise. $\:$ On the other hand, basing a construction resembling mine on the list of issued-but-not-revoked identities comes with a reduction in anonymity: if someone signs something between the GM issuing for a new user and the signing user learning that fact, then everyone can tell that the signature was not created by the new user. $\:$ $\;\;\;\;$
May
9
comment FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?
Right, they do not claim that their scheme is post-quantum. $\;$
May
9
asked FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?