2,926 reputation
1518
bio website
location United States
age
visits member for 2 years, 5 months
seen 14 mins ago

Mar
28
comment Cryptographic system with double keys with reversible order
One could use OAEP+ instead of OEAP. $\;$
Mar
28
comment Is Encryption without knowing the input directly possible at all?
One could do that with generic multi-party computation. $\:$ I don't know of any more efficient solution. $\hspace{.33 in}$
Mar
28
comment Generating shared secret random permutation
(... continued) $\:$ only needs to be universal (not necessarily pairwise independent), so one can let Extract(value,seed) be a truncation of left_half_of_value + (right_half_of_value * seed) where + and * are over a finite field. $\;\;\;\;$
Mar
28
comment Generating shared secret random permutation
In my opinion, it's not, since part of the point is that the hiding property should be unconditional. $\:$ By following this proof of the Leftover Hash Lemma, one can see the (non necessarily cryptographic) hash family $\:$ (continued ...) $\;\;\;\;$
Mar
28
comment What might be assumed about a PRF if the key has been chosen?
The answers to your last and your first two questions are "no". $\hspace{2.64 in}$ I don't know the answer to your other question. $\;$
Mar
28
comment What might be assumed about a PRF if the key has been chosen?
That could not necessarily be turned into a distinguisher for $\hspace{.04 in}f$, since such an $\hspace{.04 in}f$ could be created by modifying any PRF with a large-enough key space on an exponentially-small fraction of its key space. $\hspace{.36 in}$
Mar
28
comment What might be assumed about a PRF if the key has been chosen?
securee $\mapsto$ secure $\;$
Mar
28
answered Generating shared secret random permutation
Mar
26
comment m ∈ Zn \Z*n, RSA works but not secure
Also, you have the wrong value for $\phi(p)$. $\;$
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
@CodesInChaos : $\:$ Both the paper and the overview also use public keys where $\hspace{1.46 in}$ they should be using identities instead. $\;\;\;\;$
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
As far as I can see, the PKAE paper simply ignores the issue that I mentioned. $\:$
Mar
26
comment Defending hybrid encryption schemes against padding oracle attacks
I don't know if that paper's scheme is "accepted as" secure, but it's not secure, since anyone who $\hspace{.23 in}$ learns the sender's private key can trivially find the plaintexts for any ciphertext created by the sender. $\hspace{.24 in}$
Mar
26
revised Security proof of FO(Fujisaki-Okamoto) hybrid encryption
spelling and grammar
Mar
25
comment Challenge–response authentication which can be done in head?
pdf.aminer.org/000/320/472/… $\;$
Mar
25
comment Distributed authentication in low trust environment
Either [[the authority's key pair has a very special form] and [the authority gives each of those entities a secret in a confidential manner] and [it's not a problem that the authority can have itself be authenticated as any of those users]] or [[the $n$ entities each generate a key-pair for public-key authentication] and [the $n$ entities each give their public key to the authority in an authentic manner] and [the authority signs the list of $\: \langle $identity , public_key$\rangle \:$ instead of $L\hspace{.02 in}$]]. $\;\;\;$
Mar
24
comment Is a random oracle controled by the challenger?
Even in those other scenarios, "the two parties do not learn anything about what the other has asked the oracle". $\:$ Those scenarios usually allow the reduction to know what the adversary asks the oracle, and sometimes allow the reduction to provide the responses instead of the oracle. $\;\;\;\;$
Mar
24
comment Is a random oracle controled by the challenger?
There are lots of instances in which the reduction "decides about ... oracle query". $\:$ However, I've never seen an instance in which the challenger "decides about ... oracle query". $\;\;\;\;$
Mar
21
comment Ensuring that an operation takes a relatively specific amount of time, but easily verify the result
Note that the eprint paper does not appear to claim that solutions to its puzzles are anything like unique. $\:$ If they're not close enough to unique, then giving a solution is not necessarily "proof that this operation was done". $\;\;\;\;$
Mar
21
comment Ensuring that an operation takes a relatively specific amount of time, but easily verify the result
eprint.iacr.org/2011/553.pdf $\;$
Mar
21
comment Ensuring that an operation takes a relatively specific amount of time, but easily verify the result
crypto.stackexchange.com/q/9327/991 $\;$