3,587 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 5 hours ago

Mar
16
comment How can I create an RSA modulus for which no one knows the factors?
One of them specified a non-interactive technique, and the answers to the other one's answers did $\hspace{.36 in}$ not go into detail on the multi-party options since that was not explicitly mentioned in the question. $\hspace{.44 in}$
Mar
15
comment Traitor-tracing PRF
Is "them" the PRFs? $\:$ I don't know of any puncturable PRFs that allow more efficient indistinguishability obfuscation than just following that paper's construction. $\:$ (Also, my reasoning for the sentence about NC$^{\alpha}$ in the previous version of this comment was incorrect and I no longer have any reason to believe that the conclusion I reached there holds.) $\;\;\;\;$
Mar
14
comment Traitor-tracing PRF
Note the "Fully Homomorphic Encryption" bullet on that paper's title page. $\:$ I don't know of any stronger argument for indistinguishability obfuscation of general circuits. $\:$ However, any ttPRF scheme with exact equality would need to attack attempts at indistinguishability obfuscation, without knowing what the attempting-indistinguishability-obfuscation algorithm is. $\;\;\;\;$
Mar
14
answered Traitor-tracing PRF
Mar
14
comment Group membership with unique anonymous claims
That would work. $\:$ The perfectly binding commitment would ensure that if all parties are honest $\hspace{.55 in}$ then there is zero probability of a(n incorrect) rejection. $\;\;\;\;$
Mar
14
answered Group membership with unique anonymous claims
Mar
13
comment Traitor-tracing PRF
(... continued) $\:$ compute $x$ values such that querying on them should reveal what key the adversary got. $\:$ (I'm not aware of any candidate constructions for that.) $\:$ Alternatively, one could hope for a scheme in which a semi-honest key generator cannot find an $x$ value for which different keys give different outputs, but that such values nonetheless exist. $\;\;\;\;$
Mar
13
comment Traitor-tracing PRF
I was referring to the fact that it would be quite hard to show that your assumptions about $F$ suffice for traitor tracing, not that such traitor tracing is implausible. $\:$ There may be a way to achieve black-box traitor tracing, which involves having the key generation process output extra info that allows a tracer to (possibly adaptively) $\:$ (continued ...) $\;\;\;\;$
Mar
13
comment Traitor-tracing PRF
If that would allow traitor tracing then indistinguishability obfuscation is impossible. $\hspace{1.61 in}$
Mar
13
comment How does the key size per data bit influence the security?
What Maraste may be thinking of is how most modes of operation can be broken with $2^64$ blocks. $\hspace{.46 in}$
Mar
12
comment Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?
Do you mean Rijndael? $\:$ (AES's block size is 128 bits.) $\;\;\;\;$
Mar
12
comment Terminology: What is the word describing a hash key, a crypto key, and a certificate?
Another way is to verify a MAC (which is not necessarily part of an authenticating cipher mode). $\hspace{.89 in}$
Mar
12
comment How can I show that the DDH problem is self-reducible?
I thought you were doing CDH to make the OP do a little thinking on his own, because of suspicion that this question is homework. $\;$
Mar
12
comment How is a public key actually used to encrypt something?
en.wikipedia.org/wiki/Hybrid_cryptosystem $\;$
Mar
12
comment Do any one-key-of-many cryptographic schemes exist?
That makes it impossible because otherwise a passive eavesdropper could decrypt by just using a random key. $\:$ (Never mind about me typing up an answer now; I don't have as much to say as I thought I did.) $\:$ The main possibility that I'm aware of for getting the ciphertext to scale sublinearly with n (even if one doesn't worry a malicious sender) is broadcast encryption. $\:$ Perhaps multicast encryption (in that page's see also) might work too, but the article doesn't go into much detail. $\;\;\;$
Mar
12
comment Do any one-key-of-many cryptographic schemes exist?
It's trivially impossible as it stands, since the sender could just use random strings of the appropriate lengths instead of the actual keys for a subset of the recipients. $\;$
Mar
12
comment Do any one-key-of-many cryptographic schemes exist?
The only way I can see to make your shared-key question non-trivial is if either each shared key has a public “encapsulation” or [$\hspace{.02 in}$you do _not_ care about ensuring that each recipient gets the same message and you want the ciphertext length to scale sublinearly with n]. $\;$
Mar
11
comment Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?
google.com/#q=encryption+multi-user+setting $\;$
Mar
11
comment I need a 64-bit cryptographic hash for 96 bits of data
You could make it so that pairs whose I value has at most seven 1s will never collide with each other, at the cost of making their hashes slightly harder to compute. $\:$ You could make it so that those pairs will never collide with anything, at the cost of increasing the collision probability for pairs whose I values have more than seven 1s. $\:$ The fact that I includes "a little slice of" G probably allows a similar tradeoff to the previous sentences; do you have a good idea of how long and where in I the slice should be? $\hspace{.69 in}$
Mar
11
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
McEliece and hash-based signatures are other such algorithms. $\;$