3,700 reputation
1621
bio website
location United States
age
visits member for 3 years
seen 4 hours ago

Aug
27
comment Possible CPA or CCA attack when using AES-CBC mode under the following situation?
imaging $\mapsto$ imagine $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
site.uottawa.ca/~lucia/courses/4105-10/CIRCUITSATisNPhard.pdf $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
Real executions use Binding keys and the Simulator uses Hiding keys. $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
They show that violating the zero-knowledge property is at least as hard as $\hspace{1.67 in}$ violating those hardness assumptions. $\:$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
You could try BB signatures, even though knowing a large number of signatures reduces the time needed to recover the signing key. $\:$ (Notice the top paragraph on page 12.) $\;\;\;\;$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
"IC" $\:$ =?= $\:$ "integrated circuit" $\;\;\;$ ? $\;\;\;\;\;\;\;$
Aug
20
comment IND-CCA2 secure schemes without Plaintext Awareness?
iacr.org/archive/pkc2009/54430381/54430381.pdf $\;$
Aug
20
comment A patched SHA1 attempt for password verification
or even basE91 $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
It makes the resulting protocol be such that, as far as I can see, there does not necessarily exist a fast classical two-for-one guessing attack on a large $N$ that can handle arbitrary pairs of candidate passwords. $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$
Aug
19
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using k = 3 + H(N,g,A) would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$
Aug
19
comment SRP-6 vulnerabilities when N is small
If "someone ... B - kv" then succeeding at finding those logs would give candidate S values. $\hspace{.54 in}$ Probably not, since those logs will almost always exist. $\;$
Aug
19
revised SRP-6 vulnerabilities when N is small
fixed math error
Aug
19
revised Entropy Loss of KDFs
fixed typos and separated questions
Aug
19
comment SRP-6 vulnerabilities when N is small
The attacker that you say "is in the same position as one who breaks into the server and steals $v = g^x$, but isn't able to break the DL". $\;$
Aug
19
comment SRP-6 vulnerabilities when N is small
How would that attacker impersonate the server without finding the password via 3&4? $\hspace{1.23 in}$
Aug
19
revised SRP-6 vulnerabilities when N is small
fixed error
Aug
18
answered SRP-6 vulnerabilities when N is small
Aug
18
comment Is my id obfuscation algorithm secure?
What programming language is that? $\:$ Will the lengths of x.low ever be different for the same key? $\:$ What about the lengths of x.high? $\;\;\;\;$
Aug
18
comment Is my id obfuscation algorithm secure?
I don't see why it should be at all likely "that next hash will have the same chip as the owner". $\hspace{.75 in}$