Reputation
5,952
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 22
Newest
 Informed
Impact
~66k people reached

Mar
7
comment Prove that the given scheme is CPA secure or not
PRPs with small domain are not PRFs. ​ ​ ​ I think the flag bad should be set if and only if the random function is called more than once on ​ r || challenge_plaintext . ​ ​ ​ ​ ​ ​ ​ ​
Mar
7
comment Prove that the given scheme is CPA secure or not
Oh, yeah, I missed that part. ​ I think the idea will be showing that PRPs with large domain are also PRFs. ​ ​ ​ ​
Mar
6
answered Merkle signature scheme
Mar
6
comment Why haven't we proven many things computationally secure yet?
Since two people have brought up the quoting issue, I suppose I can be clear: ​ In my previous comment here, "in our algorithms" was quoted from the OP. ​ ​ ​ ​
Mar
6
comment Why haven't we proven many things computationally secure yet?
For "in our algorithms", are you just referring to protocols, or also non-interactive algorithms? ​ (eg. Kerberos/SSH/SSL vs. MD5/SHA1/SFLASH) ​ ​ ​ ​
Mar
5
comment Why is this homomorphic encryption correct?
Why can the bit b "be obtained easily performing a modulo 2 operation for a ciphertext"? ​ It looks like the parity of (2g/f)s would be unknown. ​ ​ ​ ​
Mar
5
comment Why is not there any ideal S-Box?
I thought the whole point of DES's choice of S-Box was that "a random S-Box" is unlikely to have zero "bias of input and output bits". ​ ​
Mar
2
revised The security of Hidden Field Equations - sentence
improved grammar
Mar
2
comment Fixed-prefix IV in CBC mode
@otus : ​ ​ ​ Although my reasoning was wrong, since I was thinking of something else, I believe my conclusion is nonetheless correct. ​ Encrypting a merely-unique value with the same key would not suffice, although encrypting a not-adversarially-controllable unique value would suffice. ​ ​ ​ ​
Mar
2
comment Fixed-prefix IV in CBC mode
This might be helpful if your devices have enough memory. ​ ​
Mar
2
comment Fixed-prefix IV in CBC mode
@CodesInChaos : ​ In that case, it would be important to use a computationally independent key, since using the same key would reveal when the plaintext starts with a full 0-block. ​ ​ ​ ​
Mar
2
comment Does SIV mode work for asymmetric crypto?
Doing so reveals the hash of the plaintext. ​ (That lets someone test guesses at the plaintext.) ​ ​ ​ ​
Mar
1
comment Does SIV mode work for asymmetric crypto?
That's certainly possible, but doing so is not secure. ​ ​
Feb
29
comment Is the complexity of Pollard rho for discrete logartihm really the modulus?
That section doesn't say n is the modulus. ​ ​
Feb
29
comment When we turn Random shuffle to Pseudorandom Shuffle
@GeoffroyCouteau : ​ That can't produce anything larger than 1/9. ​ ​ ​ ​
Feb
29
comment When we turn Random shuffle to Pseudorandom Shuffle
We can do it the same way we can do it with a truly random function. ​ ​ (pseudorandomness is completely irrelevant to that.) ​ ​ ​ ​
Feb
29
comment When we turn Random shuffle to Pseudorandom Shuffle
We can do that the exact same way we can do it with a truly random integer. ​ ​
Feb
29
revised When we turn Random shuffle to Pseudorandom Shuffle
improved grammar and linkified
Feb
28
comment Is the complexity of Pollard rho for discrete logartihm really the modulus?
Have you seen anyone still use $n$ for [the modulus from which one takes the multiplicative group] when they wrote $\hspace{.02 in}O\hspace{-0.04 in}\left(\hspace{-0.04 in}\sqrt{n}\hspace{-0.02 in}\right)\hspace{.02 in}$? $\;$
Feb
28
comment Can a list of hashes with property $X_{n+1} = \operatorname{SHA-256}(X_n)$ loop?
It looks like you misquoted the OP. ​ ​