Ricky Demer
Reputation
4,060
46/100 score
 Feb7 comment Boneh-Boyen like signature scheme BLS $\;$ Feb7 comment Misunderstanding Broadcast Encryption @hackartist : $\:$ The admin can use a digital signature scheme, for each message, encrypt the message-key separately for each approved user. $\;\;\;\;$ Feb7 comment Misunderstanding Broadcast Encryption I'm just alluding to the fact that in that case, anyone could unlock anything by $\hspace{1.49 in}$ locking on and then removing their own lock. $\:$ Feb6 comment Misunderstanding Broadcast Encryption The combination of encrypt(message, key1) -> code1 with encrypt(code1, key2) -> code2 and decrypt(code2, key2) -> message make me wonder how this is related to cryptography. $\;$ Feb6 comment Can you exchange a shared key without any hardness assumptions? (... continued) $\:$ outputting $\perp$ if more than $L$ bits of randomness would've been used or either of them would've reported failure, and outputting the resulting transcript otherwise. $\:$ If Alice and Bob together use at most $L$ random bits and succeed, then a preimage of the transcript under that function yields the agreed-on key. $\:$ If there might be undetected failure, then one would have to read Clint's comments to his answer on the page I linked to in the other comment thread. $\;\;\;\;\;\;\;$ Feb6 comment Can you exchange a shared key without any hardness assumptions? @Ike : $\;\;\;$ Not quite; his proof implies that the attacker can make their failure probability an arbitrarily small inverse-polynomial function of the security parameter. $\:$ Choose some length $L$, and consider the function from strings of length $L$ to the union of $\{\hspace{-0.02 in}\perp\}$ with the set of transcripts which is given by trying to run Alice and Bob using the input string as the random bits, $\:$ (continued ...) $\;\;\;\;\;\;\;$ Feb6 comment Can you exchange a shared key without any hardness assumptions? "also sending the hash of the plain text" ... would reveal "the hash of the plain text". $\hspace{1.35 in}$ Feb6 comment Can you exchange a shared key without any hardness assumptions? That's right. $\:$ One can additionally consider the case in which Alice and Bob don't have the same "CA"s. $\:$ However, "sending random bits in it to each other" isn't good enough, since it doesn't have a high-enough probability of detecting a small difference. $\;\;\;\;$ Feb6 comment Stream cipher key length to send Well, a steam cipher's key usually has a different length from "the length of the message". $\hspace{1.01 in}$ (Of course, nothing stops one from using it to send a message with the same length as the key.) $\hspace{.71 in}$ Feb6 comment Can you exchange a shared key without any hardness assumptions? @ike : $\:$ If "many possible inputs would result in the same transcript", then one needs to read Clint's comments to his answer on the page I linked to. $\;\;\;\;$ Feb6 comment Can you exchange a shared key without any hardness assumptions? Feb3 comment PRF based on the GGM construction "dynamic search symmetric scheme" $\: \mapsto \:$ "dynamic searchable symmetric encryption" $\;\;\;$ ? $\hspace{.81 in}$ Feb3 comment Python implementation of a blind signature scheme which doesn't involve RSA @CodesInChaos : $\:$ Another pitfall is that you should make sure that the public key defines a permutation. $\;\;\;\;$ Feb3 comment PRF based on the GGM construction @MaartenBodewes : $\:$ He may have had GCM in the title, but he wasn't the one who put that there. $\hspace{.41 in}$ Feb3 answered PRF based on the GGM construction Feb2 comment Non-repudiation and digital signature of a dishonest participant Regardless of which way you go, you may wish to look at the relevant parts for both Alice's and Bob's laws, and explicitly reference them in the contract or what Alice says, as the case may be. $\hspace{.96 in}$ Feb2 comment Multiple encryption of part of block ... with what mode? $\;$ Feb2 comment Definition of ciphertext security ... and D'(k,empty_string)=0. $\;$ Feb2 comment Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$ Oh, I see that my comment would only have been right if the keys were the same and the expression was supposed to work for all $R$. $\;$ Feb2 comment Definition of ciphertext security No, I mean for all encryption schemes (E,D), there is an encryption scheme (E',D') such that [[for all keys k, D'(k,0)=0] and [if (E,D) is IND-CPA then (E',D') is IND-CPA] and [if (E,D) is CCA secure then (E',D') is CCA secure]]. $\;$