4,005 reputation
1621
bio website
location United States
age
visits member for 3 years, 5 months
seen 47 mins ago

Feb
7
comment Misunderstanding Broadcast Encryption
I'm just alluding to the fact that in that case, anyone could unlock anything by $\hspace{1.49 in}$ locking on and then removing their own lock. $\:$
Feb
6
comment Misunderstanding Broadcast Encryption
The combination of encrypt(message, key1) -> code1 with encrypt(code1, key2) -> code2 and decrypt(code2, key2) -> message make me wonder how this is related to cryptography. $\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
(... continued) $\:$ outputting $\perp$ if more than $L$ bits of randomness would've been used or either of them would've reported failure, and outputting the resulting transcript otherwise. $\:$ If Alice and Bob together use at most $L$ random bits and succeed, then a preimage of the transcript under that function yields the agreed-on key. $\:$ If there might be undetected failure, then one would have to read Clint's comments to his answer on the page I linked to in the other comment thread. $\;\;\;\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
@Ike : $\;\;\;$ Not quite; his proof implies that the attacker can make their failure probability an arbitrarily small inverse-polynomial function of the security parameter. $\:$ Choose some length $L$, and consider the function from strings of length $L$ to the union of $\{\hspace{-0.02 in}\perp\}$ with the set of transcripts which is given by trying to run Alice and Bob using the input string as the random bits, $\:$ (continued ...) $\;\;\;\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
"also sending the hash of the plain text" ... would reveal "the hash of the plain text". $\hspace{1.35 in}$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
That's right. $\:$ One can additionally consider the case in which Alice and Bob don't have the same "CA"s. $\:$ However, "sending random bits in it to each other" isn't good enough, since it doesn't have a high-enough probability of detecting a small difference. $\;\;\;\;$
Feb
6
comment Stream cipher key length to send
Well, a steam cipher's key usually has a different length from "the length of the message". $\hspace{1.01 in}$ (Of course, nothing stops one from using it to send a message with the same length as the key.) $\hspace{.71 in}$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
@ike : $\:$ If "many possible inputs would result in the same transcript", then one needs to read Clint's comments to his answer on the page I linked to. $\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
cstheory.stackexchange.com/q/8697/6973 $\;$
Feb
3
comment PRF based on the GGM construction
"dynamic search symmetric scheme" $\: \mapsto \:$ "dynamic searchable symmetric encryption" $\;\;\;$ ? $\hspace{.81 in}$
Feb
3
comment Python implementation of a blind signature scheme which doesn't involve RSA
@CodesInChaos : $\:$ Another pitfall is that you should make sure that the public key defines a permutation. $\;\;\;\;$
Feb
3
comment PRF based on the GGM construction
@MaartenBodewes : $\:$ He may have had GCM in the title, but he wasn't the one who put that there. $\hspace{.41 in}$
Feb
3
answered PRF based on the GGM construction
Feb
2
comment Non-repudiation and digital signature of a dishonest participant
Regardless of which way you go, you may wish to look at the relevant parts for both Alice's and Bob's laws, and explicitly reference them in the contract or what Alice says, as the case may be. $\hspace{.96 in}$
Feb
2
comment Multiple encryption of part of block
... with what mode? $\;$
Feb
2
comment Definition of ciphertext security
... and D'(k,empty_string)=0. $\;$
Feb
2
comment Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$
Oh, I see that my comment would only have been right if the keys were the same and the expression was supposed to work for all $R$. $\;$
Feb
2
comment Definition of ciphertext security
No, I mean for all encryption schemes (E,D), there is an encryption scheme (E',D') such that [[for all keys k, D'(k,0)=0] and [if (E,D) is IND-CPA then (E',D') is IND-CPA] and [if (E,D) is CCA secure then (E',D') is CCA secure]]. $\;$
Feb
2
comment Definition of ciphertext security
That's not suggesting that security follows from D(k,0)=0; it should be interpreted as "Consider a chosen ciphertext secure encryption system (E,D) where" it happens to be the case that for all keys k, D(k,0)=0. $\hspace{.16 in}$
Feb
2
comment Definition of ciphertext security
Such schemes can't provide plaintext integrity (and thus also can't provide ciphertext integrity), but that has very little to do with IND-CPA. $\;$