3,690 reputation
1521
bio website
location United States
age
visits member for 3 years
seen 40 mins ago

May
11
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
Even if so, the paper I linked to gives a method that I think doesn't use any metric as you described. $\hspace{.36 in}$
May
11
comment Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$
I think the generic attack doesn't involve that. $\;$
May
11
comment The advantages of Merkle Signature and One time Signature
Perhaps I should expand on my previous comment: Merkle signatures can securely be used on more than one message. $\:$ Although one-time key-pairs can be used more than once, such use usually allows easy forgeries. $\;\;\;\;$
May
11
comment The advantages of Merkle Signature and One time Signature
Merkle signatures are not limited to being one-time. $\;$
May
11
comment Key exchange if forward secrecy is not an issue
Even if "Man-In-The-Middle attacks are not an issue," impersonation might still be an issue. $\hspace{.88 in}$
May
10
comment Group Signature Scheme without Opening but with Revocation
(... continued) $\:$ There is only a "signature on the OTS key by the GM" insofar as there is a signature on the OTS key with the identity-based signature scheme for which the GM knows the master private key; the GM is not involved in the generation of the OTS key and has never before seen that key. $\:$ V does not directly verify the users' signatures on the OTS keys; V verifies the arguments of knowledge of such signatures. $\;\;\;\;$
May
10
comment DH key exchange with only one end authenticated
If the unauthenticated end's group element does not go into the signature then explicit authentication certainly fails and there could conceivably be an attack based on what DH value the server gets after the adversary has submitted a different group element. $\:$ If the group and generator are not known a-priori and they do not go into the signature then there could conceivably be an attack based on creating a detectable correlation between the DH values. $\;\;\;\;$
May
10
comment Cryptographically secure keyed rolling hash function
@D.W. $\;\;\;$ "If $E$ is a PRP" with large domain "then $E$ is a PRF". $\:$ Also, does (almost-)2-universality help more than (almost-)universality for this use? $\;\;\;\;\;\;$
May
10
comment Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing
What is the point of such a long keyfile? $\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
(... continued) $\:$ If that privacy reduction is not acceptable, then I mean the largest identity on the list that's less than the user's identity and the smallest identity on the list that's greater than the user's identity, similarly to what is described in section 3.3 on this page‌​. $\:$ (continued ...) $\;\;\;\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
If what I mentioned in my previous sentence is an acceptable price, then you should look up ring signatures, especially because the GM might be able to provide a common reference string. $\:$ (For that strategy, the GM would generate the ring signature key-pairs on its own and issue them and regularly give out a signed list of issued-but-not-revoked ring signature verification keys along with their expiration times.) $\:$ (continued ...) $\;\;\;\;$
May
10
comment Group Signature Scheme without Opening but with Revocation
I was blindly assuming that there were at least as many revoked identities as issued-but-not-revoked identities; although I now notice that your paragraph about expiration implies otherwise. $\:$ On the other hand, basing a construction resembling mine on the list of issued-but-not-revoked identities comes with a reduction in anonymity: if someone signs something between the GM issuing for a new user and the signing user learning that fact, then everyone can tell that the signature was not created by the new user. $\:$ $\;\;\;\;$
May
9
comment FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?
Right, they do not claim that their scheme is post-quantum. $\;$
May
9
asked FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?
May
9
comment Group Signature Scheme without Opening but with Revocation
(That took a lot longer than I'd thought it would, mostly because I was typing up a lot of stuff that became useless when I realized that Merkle Trees made things much more efficient.) $\:$ I have no idea what efficiency these options would achieve. $\;\;\;\;$
May
9
revised Group Signature Scheme without Opening but with Revocation
elaborated on NIWI options
May
8
comment Group Signature Scheme without Opening but with Revocation
(err, by "later today", I mean "probably less than 2 hours from now".) $\;$
May
8
comment Group Signature Scheme without Opening but with Revocation
I just made some corrections to my answer which make me realize that there may be significantly more efficient, though largely similar, methods. $\:$ I'll write up something about those later today. $\;\;\;\;$
May
8
revised Group Signature Scheme without Opening but with Revocation
corrected some errors
May
8
comment Group Signature Scheme without Opening but with Revocation
Are you having difficulty parsing that? $\:$ It should be parsed as "the GM [issues for the GSS] by [issuing for the identity-based signature scheme]". $\:$ Alternatively, perhaps I should include a link that describes identity-based signature schemes. $\:$ I don't see anything else that might might be unclear about that bullet point. $\;\;\;\;$