Reputation
5,490
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 21
Newest
 Pundit
Impact
~59k people reached

Jan
28
revised Is this a good communication scheme?
fixed significant omission
Jan
28
comment Single-algorithm authenticated encryption
en.wikipedia.org/wiki/… ​ ​
Jan
28
answered Is this a good communication scheme?
Jan
28
comment Proof of Knowledge/Data Integrity using Hash Function
I don't see "such" pitfalls, but a challenge-response pair allows an eavesdropper to try as many guesses at M as it wants, so that can leak a fairly significant amount of information about M. ​ ​
Jan
27
comment In interactive proofs, do we assume that the prover can always solve the problem?
That doesn't "render the whole thing useless". ​ ​
Jan
27
comment In interactive proofs, do we assume that the prover can always solve the problem?
@derek : ​ ​ ​ No, we just need (1+)2 properties: ({efficient verifier},) {if the verifier's input is a YES instance then the prover can reliably convince the verifier}, and {if the verifier's input is a NO instance then the verifier is overwhelmingly likely to reject (regardless of what the prover does)}. ​ The prover is allowed to say that. ​ ​ ​ ​ ​ ​ ​ ​
Jan
27
comment In interactive proofs, do we assume that the prover can always solve the problem?
I just did that. ​ ​
Jan
27
revised In interactive proofs, do we assume that the prover can always solve the problem?
referred "specifically to the graph isomorphism example in the question"
Jan
27
answered In interactive proofs, do we assume that the prover can always solve the problem?
Jan
27
answered Function with no fast path and with fast proof
Jan
26
comment Forward Secrecy when using non-ephemeral DH
Ephemerality does not refer to a new session key being made each time a new session is set up", it refers to both parties' private exponents (and group elements) being freshly chosen. ​ ​
Jan
25
comment help with cryptanalysis of a sponge permutation
Where does the "byte" to the right of "Generate a psuedorandom byte" come from? ​ ​
Jan
24
comment How to change the master password in a password manager
In particular, "the user's password would" usually not "be the Key Encrypting Key". ​ ​
Jan
24
comment How to change the master password in a password manager
The Key Encrypting Key should instead be securely derived from the user's master password. ​ ​
Jan
23
comment Encryption that could have multiple decryption key
Is the number of administrators few enough that the ciphertext length can be linear in that number? ​ Would it be a problem if a malicious encryptor could make it so that some pairs of administrators will get the data and others will discover that the ciphertext was ill-formed? ​ ​ ​ ​
Jan
21
comment Why are obfuscators generally defined to be probabilistic algorithms, rather than deterministic ones?
Obfuscating "all functionally equivalent circuits" "to the same circuit" is in fact NP-hard. ​ (Just compare the obfuscation of an arbitrary circuit with the obfuscation of a circuit that always outputs False.) ​ ​ ​ ​
Jan
18
comment Encryption scheme like RSA where encryption is the inverse of decryption
The things you're asking about are called trapdoor permutations. ​ ​
Jan
12
comment What is the canonical way of creating merkle tree branches?
Given the rest of that information, the verifier can compute the alleged Merkle root on its own. ​ ​
Jan
12
comment Can I shorten the large ECDSA public key output file from OpenSSL?
(... continued) ​ ​ ​ use the same key-pairs for encryption and signing, although there are separate reasons why you might want to avoid that anyway. ​ It should be possible to reduce the key size by 1 more bit by dropping the y coordinate. ​ ​ ​ ​
Jan
12
comment Can I shorten the large ECDSA public key output file from OpenSSL?
(These 2 comments don't help answer your question, but may be useful in your environment.) ​ This paper shows how to get short key encapsulation. ​ It may be possible to modify that and/or the signature algorithm to let you ​ ​ ​ (continued ...) ​ ​ ​ ​ ​ ​ ​