2,926 reputation
1518
bio website
location United States
age
visits member for 2 years, 5 months
seen 1 hour ago

Mar
20
comment Soundness idea of basic zero knowledge prood
However, zero knowledge proofs by default do insist that the verifier has at most a $\hspace{1.14 in}$ negligible probability of accepting a false statement. $\;$
Mar
20
answered Soundness idea of basic zero knowledge prood
Mar
20
revised In Needham Schroeder key distribution what happens if responder's part is not encrypted in step 2 with Kbs but encrypted instead by Kab in step 3
inserted line-breaks
Mar
19
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
I don't think length extension is relevant here. $\;$
Mar
18
comment Is this a secure (and correct) sign-then-encrypt technique for transferring messages?
The signatures should use RMX, so that they don't need full collision-resistance. $\:$ The symmetric encryption part should use authenticated encryption. $\:$ Also, your technique should be modified so that it will still work and be secure when there are multiple users, there is no "expected sender", and each user only has one encryption key and one signing key. $\;\;\;\;$
Mar
16
comment What functions allow for practical indistinguishability obfuscation?
More powerfully (and illustratively), one can "trivially" achieve virtual black-box obfuscation of functions for which each output bit syntactically depends on at most logarithmically many input bits, since a nice-enough representation of such functions can be learned by querying sufficiently many random pairs of inputs that differ on exactly one bit, where "nice-enough" means someone with the original circuit can efficiently-and-deterministically test whether or not the representation computes the same function. $\;$
Mar
16
comment What functions allow for practical indistinguishability obfuscation?
Note that "iO of BDDs" is not known to imply iO of circuits that are implementable as small BDDs. $\hspace{.42 in}$ The log is of the amount of work that the obfuscator is allowed to do. $\;$
Mar
16
comment RSA problem if i choose two specific small prime numbers?
One should also have $\: 0\leq m \;$. $\;\;\;\;$
Mar
16
revised Why do we apply the concept of circuit in homomorphic encryption schemes?
improved grammar
Mar
16
comment How can I create an RSA modulus for which no one knows the factors?
One of them specified a non-interactive technique, and the answers to the other one's answers did $\hspace{.36 in}$ not go into detail on the multi-party options since that was not explicitly mentioned in the question. $\hspace{.44 in}$
Mar
15
comment Traitor-tracing PRF
Is "them" the PRFs? $\:$ I don't know of any puncturable PRFs that allow more efficient indistinguishability obfuscation than just following that paper's construction. $\:$ (Also, my reasoning for the sentence about NC$^{\alpha}$ in the previous version of this comment was incorrect and I no longer have any reason to believe that the conclusion I reached there holds.) $\;\;\;\;$
Mar
14
comment Traitor-tracing PRF
Note the "Fully Homomorphic Encryption" bullet on that paper's title page. $\:$ I don't know of any stronger argument for indistinguishability obfuscation of general circuits. $\:$ However, any ttPRF scheme with exact equality would need to attack attempts at indistinguishability obfuscation, without knowing what the attempting-indistinguishability-obfuscation algorithm is. $\;\;\;\;$
Mar
14
answered Traitor-tracing PRF
Mar
14
comment Group membership with unique anonymous claims
That would work. $\:$ The perfectly binding commitment would ensure that if all parties are honest $\hspace{.55 in}$ then there is zero probability of a(n incorrect) rejection. $\;\;\;\;$
Mar
14
answered Group membership with unique anonymous claims
Mar
13
comment Traitor-tracing PRF
(... continued) $\:$ compute $x$ values such that querying on them should reveal what key the adversary got. $\:$ (I'm not aware of any candidate constructions for that.) $\:$ Alternatively, one could hope for a scheme in which a semi-honest key generator cannot find an $x$ value for which different keys give different outputs, but that such values nonetheless exist. $\;\;\;\;$
Mar
13
comment Traitor-tracing PRF
I was referring to the fact that it would be quite hard to show that your assumptions about $F$ suffice for traitor tracing, not that such traitor tracing is implausible. $\:$ There may be a way to achieve black-box traitor tracing, which involves having the key generation process output extra info that allows a tracer to (possibly adaptively) $\:$ (continued ...) $\;\;\;\;$
Mar
13
comment Traitor-tracing PRF
If that would allow traitor tracing then indistinguishability obfuscation is impossible. $\hspace{1.61 in}$
Mar
13
comment How does the key size per data bit influence the security?
What Maraste may be thinking of is how most modes of operation can be broken with $2^64$ blocks. $\hspace{.46 in}$
Mar
12
comment Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?
Do you mean Rijndael? $\:$ (AES's block size is 128 bits.) $\;\;\;\;$