Reputation
4,816
Next tag badge:
50/100 score
29/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~45k people reached

Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
No, forward secrecy also applies to the parties' identities. $\:$ An active adversary can just choose $x$ and then decrypt to get Bob's signature. $\:$ For passive adversaries, distinguishing between candidate parties would require breaking the underlying key exchange (Diffie-Hellman of PK encrypted symmetric key) or the symmetric encryption. $\:$ Even for active attackers, the only other way to do that would require choosing one of the messages for the underlying key exchange, which in turn would require being one of the parties or breaking the signature scheme. $\;\;\;\;$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
The definition is that the adversary's ability to distinguish between different initiators is negligible. $\hspace{.57 in}$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
Why would this scheme be "already broken from identity point of view" if $\hspace{1.87 in}$ "he has a specific subset to choose from"? $\;$
Jul
17
comment Why does encryption in STS protocol protect against identity attacks?
possible duplicate of In the STS Authentication Protocol, why are the signatures encrypted?
Jul
17
answered Is authenticated encryption basically a lockable box?
Jul
17
comment Unconditional authentication
Yes. $\:$ My suggestion (now removed) was worse. $\:$ All strongly universal hash families $\hspace{1.27 in}$ are universal hash families. $\;\;\;\;$
Jul
17
revised Unconditional authentication
changed #1 to hopefully be accurate
Jul
17
comment Deterministic ECDSA signatures?
You already mentioned another way "to create deterministic signatures". $\:$ BLS is another way to create signatures where there is at most one valid signature per message. $\;\;\;\;$
Jul
16
answered Unconditional authentication
Jul
16
comment Correctness of ideal protocol of MPC in presence of malicious adversary
@preethi : $\:$ How does that violate "the correctness property of MPC"? $\;\;\;\;$
Jul
16
comment Explain m-ary functionality in multiparty computation
en.wikipedia.org/wiki/Arity#n-ary $\;$
Jul
15
answered Correctness of ideal protocol of MPC in presence of malicious adversary
Jul
15
revised What is the meaning for a vector mod a matrix in a lattice?
expanded greatly
Jul
15
answered What is the meaning for a vector mod a matrix in a lattice?
Jul
11
comment Given only RSA public key parameters, what security issues might I be able to detect?
One could also run these two algorithms on the modulus. $\;$
Jul
10
revised How does a CA send a digital certificate?
improved grammar
Jul
10
comment One cipher to rule them all?
See my comment here. $\;$
Jul
10
comment ElGamal against chosen ciphertext attacks
I certainly don't think so. $\;$
Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@dannycrane : $\:$ See my previous comment. $\;\;\;\;$
Jul
9
comment RSA with $\lambda(n)$ or $\varphi(n)$
@YehudaLindell : $\;\;\;$ "is usually fine" in the sense of "won't be a problem as long as its relatively prime to phi". $\:$ However, if the primes are chosen randomly (rather than specifically to let e=3 work), then 3 would be relatively prime to phi only about 1/4 of the time. $\:$ (So, in that sense, it's not usually fine.) $\;\;\;\;\;\;\;\;$