2,926 reputation
1518
bio website
location United States
age
visits member for 2 years, 5 months
seen 7 mins ago

Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
In Diffie-Hellman, we usually want to encrypt data that doesn't fit in a single group element. $\hspace{.86 in}$
Mar
6
comment why inverse in diffie-hellman protocol will not give same value?
g^{{ab}^b}^-1 $\:$ is not canceling the value of $b$. $\;\;\;\;$
Mar
6
comment Secure Broadcast Channel
andrew.cmu.edu/course/15-749/READINGS/required/resilience/… $\;$
Mar
6
comment What key exchange protocols give Forward-Secrecy resisting future progress?
@DrLecter : $\:$ Should "future" be replaced with "past"? $\;\;\;\;$
Mar
6
comment Unpredictability vs randomness
The phrase "randomness extraction" is better and also used, such as in this answer's key derivation link. $\:$ Also, one could potentially implement a strong extractor that is not a polynomial hash. $\hspace{1.42 in}$
Mar
5
comment encrypted file sharing protocol
It looks to me like the paper only indicates that he would "need the message for which the signature should be valid with the second key" in order to use their method. $\:$ The more important question is whether or not a feasible method to do that exists. $\:$ Even if there isn't such a method, there would still be the issue of an attacker claiming to have the same signature verification key. $\:$ Also, since the signature is sent unencrypted, your protocol draft does not preserve sender anonymity, and one needs to worry about whether or not the masterkey is actually "out of reach". $\;\;\;$
Mar
5
answered Why is “multiplying” $g^x$ and $g^y$ not possible?
Mar
5
answered What key exchange protocols give Forward-Secrecy resisting future progress?
Mar
5
comment encrypted file sharing protocol
Oh, I'd though signature was over what came after it, rather than what was above "hash, sign". $\:$ In that case, your protocol draft does not provide non-repudiation, and I'd have to think more about whether or not it provides authenticity. $\:$ There is a need for a sender identifier because otherwise an attacker could find a different verification key that will cause the signature to check out or claim to have the same signature verification key as the real sender. $\;\;\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
Yes, however, the ephemeral private keys are $a$symmetric. $\;$
Mar
5
comment encrypted file sharing protocol
You have "recipient" in the wrong place and are missing "sender"; "recipient" should be put $\hspace{.95 in}$ into what is covered by the signature and "sender" should be put where "recipient" was. $\hspace{1.09 in}$ What purpose is "hash, sign" supposed to serve? $\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
"an attack against a key-establishment protocol with forward secrecy can" be performed after $\hspace{.62 in}$ the intercept, by searching for the/either ephemeral private key. $\;$
Mar
5
comment Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse
The answer is, the kind described by the first 12 characters of this question's tag. $\;$
Mar
5
comment Convincing “someone” on the (in)validity of DH tuple without revealing $u,v$
Would you be interesting in non-interactive ZK proofs for this? $\;$
Mar
4
answered Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
Mar
4
revised Is it meaningful to consider the leakage of master key of KGC?
completely changed answer
Mar
3
revised How does TLS generate the shared secret?
fixed grammar and pluralization, improved formatting, and removed secret-sharing tag
Mar
3
comment Is it meaningful to consider the leakage of master key of KGC?
(continued ...) $\:$ completeness without reading the KGC's memory ability is exponentially small. $\:$ The KGC can start doing that at any time (it doesn't need to decide when it generates the master key-pair), and as long as completeness remains unbroken, whether or not the KGC is doing that will be transparent to the users. $\:$ However, the "full-storage approach" does and the "reduced-storage approach" does not, guarantee that if completeness is broken then the KGC can prove that the setup string was bad. $\hspace{.58 in}$
Mar
3
comment Is it meaningful to consider the leakage of master key of KGC?
I now realize that in order to use the "special setup string" as I described, the KGC would need to store the relevant IDs themselves in addition to the amount that grows linearly with the number of IDs of forgotten keys. $\:$ The KGC could avoid that additional storage at the cost these two loses in completeness: it is only computationally infeasible (reducible to finding a hash collision) for an adversary that can read the KGC's memory to break completeness, and the probability of breaking $\:$ (continued ...) $\hspace{1.62 in}$
Mar
3
comment Is it meaningful to consider the leakage of master key of KGC?
(Most prime-order groups allow the conversion of an arbitrary discrete logarithm instance into such a hash family for which the secret is the solution to the discrete logarithm instance.) $\:$