Reputation
4,060
Next tag badge:
46/100 score
29/20 answers
Badges
1 6 21
Newest
 Yearling
Impact
~38k people reached

Feb
7
comment Boneh-Boyen like signature scheme
BLS $\;$
Feb
7
comment Misunderstanding Broadcast Encryption
@hackartist : $\:$ The admin can use a digital signature scheme, for each message, encrypt the message-key separately for each approved user. $\;\;\;\;$
Feb
7
comment Misunderstanding Broadcast Encryption
I'm just alluding to the fact that in that case, anyone could unlock anything by $\hspace{1.49 in}$ locking on and then removing their own lock. $\:$
Feb
6
comment Misunderstanding Broadcast Encryption
The combination of encrypt(message, key1) -> code1 with encrypt(code1, key2) -> code2 and decrypt(code2, key2) -> message make me wonder how this is related to cryptography. $\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
(... continued) $\:$ outputting $\perp$ if more than $L$ bits of randomness would've been used or either of them would've reported failure, and outputting the resulting transcript otherwise. $\:$ If Alice and Bob together use at most $L$ random bits and succeed, then a preimage of the transcript under that function yields the agreed-on key. $\:$ If there might be undetected failure, then one would have to read Clint's comments to his answer on the page I linked to in the other comment thread. $\;\;\;\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
@Ike : $\;\;\;$ Not quite; his proof implies that the attacker can make their failure probability an arbitrarily small inverse-polynomial function of the security parameter. $\:$ Choose some length $L$, and consider the function from strings of length $L$ to the union of $\{\hspace{-0.02 in}\perp\}$ with the set of transcripts which is given by trying to run Alice and Bob using the input string as the random bits, $\:$ (continued ...) $\;\;\;\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
"also sending the hash of the plain text" ... would reveal "the hash of the plain text". $\hspace{1.35 in}$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
That's right. $\:$ One can additionally consider the case in which Alice and Bob don't have the same "CA"s. $\:$ However, "sending random bits in it to each other" isn't good enough, since it doesn't have a high-enough probability of detecting a small difference. $\;\;\;\;$
Feb
6
comment Stream cipher key length to send
Well, a steam cipher's key usually has a different length from "the length of the message". $\hspace{1.01 in}$ (Of course, nothing stops one from using it to send a message with the same length as the key.) $\hspace{.71 in}$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
@ike : $\:$ If "many possible inputs would result in the same transcript", then one needs to read Clint's comments to his answer on the page I linked to. $\;\;\;\;$
Feb
6
comment Can you exchange a shared key without any hardness assumptions?
cstheory.stackexchange.com/q/8697/6973 $\;$
Feb
3
comment PRF based on the GGM construction
"dynamic search symmetric scheme" $\: \mapsto \:$ "dynamic searchable symmetric encryption" $\;\;\;$ ? $\hspace{.81 in}$
Feb
3
comment Python implementation of a blind signature scheme which doesn't involve RSA
@CodesInChaos : $\:$ Another pitfall is that you should make sure that the public key defines a permutation. $\;\;\;\;$
Feb
3
comment PRF based on the GGM construction
@MaartenBodewes : $\:$ He may have had GCM in the title, but he wasn't the one who put that there. $\hspace{.41 in}$
Feb
3
answered PRF based on the GGM construction
Feb
2
comment Non-repudiation and digital signature of a dishonest participant
Regardless of which way you go, you may wish to look at the relevant parts for both Alice's and Bob's laws, and explicitly reference them in the contract or what Alice says, as the case may be. $\hspace{.96 in}$
Feb
2
comment Multiple encryption of part of block
... with what mode? $\;$
Feb
2
comment Definition of ciphertext security
... and D'(k,empty_string)=0. $\;$
Feb
2
comment Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$
Oh, I see that my comment would only have been right if the keys were the same and the expression was supposed to work for all $R$. $\;$
Feb
2
comment Definition of ciphertext security
No, I mean for all encryption schemes (E,D), there is an encryption scheme (E',D') such that [[for all keys k, D'(k,0)=0] and [if (E,D) is IND-CPA then (E',D') is IND-CPA] and [if (E,D) is CCA secure then (E',D') is CCA secure]]. $\;$