3,865 reputation
1621
bio website
location United States
age
visits member for 3 years, 2 months
seen 2 hours ago

Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
Note that there are subtleties involved in that. $\;$
Sep
13
comment Does NTRU provide Perfect Forward Secrecy?
What is "the long term channel"? $\;$
Sep
13
answered Why are we advising PKI if we know that quantum computers will break them?
Sep
12
comment Equal length of primes in paillier cryptosystem
One could compute $q$ as 1 more than [something-coprime-to-$p$ times something-smaller-than-$p$]. $\hspace{.48 in}$
Sep
12
revised Can we use numbers as a pad in the Vernam cipher - why or why not?
fixed grammar and capitalization
Sep
11
comment Regarding Key Strength with DES and Blowfish
This paper gives an attack whose heuristic expected runtime is $O(2^{91-(m/2)})$ for $\: 10\leq m \;$. $\hspace{1.03 in}$
Sep
11
comment How can AES be considered secure when encrypting large files?
en.wikipedia.org/wiki/Block_cipher_mode_of_operation $\;$
Sep
11
comment Quantum key exchange skepticism/confusion
It looks to me like intercept-and-resend only gives the upper bound $\: u = 25\% \:$ when the receiver might measure what was resent almost completely correctly. $\:$ Is there some way to show the 25% upper bound even if one assumes a lower bound on the error in that situation? $\;\;\;\;$
Sep
11
comment How can I know when a file was signed?
"Sending it to a 'secure' time and location server (assuming that exists).", would what? I believe most systems "just take Computer time".
Sep
11
comment How can I know when a file was signed?
Even sending your "signature to a 'trusted' time server, which timestamps" your "signature and signs it" would not necessarily be enough, since after learning your private key, it might be easy for the thief to find a new message for which that signature is valid. One could use forward-secure signatures.
Sep
10
comment Quantum key exchange skepticism/confusion
@FrédéricGrosshans : $\:$ I have no idea how physically plausible such an assumption is, but would a noticeable lower bound on the error rate for measuring adversarially produced quanta break the proof of the 25% upper bound? $\;\;\;\;$
Sep
10
comment Quantum key exchange skepticism/confusion
Also, after reading Frédéric's answer, I now believe that instead of using fuzzy extractors, it would be better to use one or more (the same number each) secure sketches, universal hashes, and strong extractors‌​. $\:$ (The strong extractors do not need to be based on the leftover hash lemma.) $\;\;\;\;$
Sep
10
comment Quantum key exchange skepticism/confusion
It is at least a bit unpractical. $\:$ Anything that suffices for "traditional" two-way authentication and integrity, can be used as described in this paper. $\;\;\;\;$
Sep
10
comment Quantum key exchange skepticism/confusion
I believe there are more efficient methods than parity checking, although the only thing I know of that I think is more efficient is fuzzy extractors, which could be used to but do not automatically estimate an upper bound on who much Eve could have seen. $\;$
Sep
10
comment Quantum key exchange skepticism/confusion
I believe the parts of the process can be conducted in parallel (i.e., the parties don't have to do any checking in-between using the quantum channel), but otherwise "you keep exchanging the key over and over until Eve most likely hasn't seen too much of it" sounds basically correct. $\;$
Sep
10
comment Quantum key exchange skepticism/confusion
"if t>n/2 then doesn't" what "not make sense"? $\:$ If you answer is "the whole article", then my response is, "No, it doesn't not make sense, even when t>n/2.". $\:$ Pretty much. $\;\;\;\;$
Sep
10
comment Quantum key exchange skepticism/confusion
No. $\:$ My understanding is that if Eve measures a significant fraction of the quanta, then the parties will detect that with overwhelming probability. $\:$ Even if Eve knew most of the key, the leftover hash lemma would still work in this context. $\:$ You may have heard of the half threshold in the context of non-malleable extractors or general privacy amplification. $\;\;\;\;$
Sep
10
comment How can I map arbitrary group elements to unique integers without using Hash functions?
You would use bit padding so that padded group elements all have the same length, let $p$ be bigger than 2 to that length, and map each group element to the integer represented by the result of padding the group element. $\;$
Sep
10
comment How can I map arbitrary group elements to unique integers without using Hash functions?
@Holmes.Sherlock : $\:$ Yes, since it would let $p$ be bigger than all of the group elements. $\;\;\;\;$
Sep
10
comment How can I map arbitrary group elements to unique integers without using Hash functions?
Why does the ring's ($Z_p$'s) size need to be the same as $G$'s? $\;$