Reputation
5,490
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 8 21
Newest
 Pundit
Impact
~58k people reached

Oct
15
comment Proving the security of a one-way function with partially known input
An OWF needs one non-parameter input (the x in wikipedia's incorrect definition). $\:$ With parameters, one will need to distinguish between "one-way for whatever parameters [are / will be] used", one-way for some specific distribution of parameters, and "one-way even when the adversary chooses the parameters". $\hspace{.27 in}$
Oct
15
comment Proving the security of a one-way function with partially known input
Is "the question" the one we're commenting on right now, or one of the two you linked to? $\;$
Oct
15
comment Proving the security of a one-way function with partially known input
I mean, give two efficient procedures such that one of them will transform any OWF f into an OWF h for which the other has a noticeable probability of recovering TXT from H1,H2,...,Hn. $\;$
Oct
15
comment Proving the security of a one-way function with partially known input
One wouldn't "go about prooving" that. $\:$ One would instead give a counterexample. $\hspace{1.44 in}$
Oct
13
comment Scale-Invariant DGHV Scheme - Decryption
... You're apparently implementing ​ mod 2 ​ wrong, since that should output a non-negative number. ​ ​ ​ ​
Oct
13
comment Very short signatures? (eg: 48bits?)
@HenrykPlotz : $\:$ Can those specifically target short signatures, rather than just going after the private key?
Oct
13
comment Very short signatures? (eg: 48bits?)
@user152408 : $\;\;\;$ (I noticed an assumption I was making, that I should check.) $\:$ Do you specifically want short signatures or just want the length of the signed_message object to not be much longer than the length of the message? $\:$ If the latter, then there's a much better approach. $\;\;\;\;\;\;\;\;$
Oct
13
comment Very short signatures? (eg: 48bits?)
@user152408 : $\:$ Make sure you read the paragraph I gave the title to, rather than just other parts of the paper that paragraph is in. $\;\;\;\;$
Oct
12
comment Very short signatures? (eg: 48bits?)
I think Ultra Short Weakly Secure Signatures are the closest thing known to what you're asking about. $\;\;\;\;\;\;$
Oct
12
comment Does a padding oracle have the encryption key? Where in real life do I see such an oracle?
Usually, such vulnerabilities are in the SSL/TLS part, since in most cases, the only $\hspace{1.45 in}$ other cryptography they do is password hashing. $\;$
Oct
11
comment Weakness of SRP after server compromise
@SEJPM : $\:$ I don't see any mention of HMAC in the question. $\;\;\;\;$
Oct
11
comment Inverting RSA function
@EVELYN : $\:$ k is a positive integer, and in this case that's all it is. $\;\;\;\;$
Oct
6
comment SHA-256 “almost unique”?
No. $\:$ Yes; there's no publicly known method that seems likely to find a collision in $\hspace{1.46 in}$ SHA-256 with significantly less than $2^{128}$ work. $\;\;\;\;$
Oct
5
answered Probabalistic Polynomial-time Algorithms & One-way functions
Oct
5
comment Generating unbiased numbers with a biased six sided die?
To get a bounded number of throws per output-or-lack-thereof, the "until it gives other than 1" step can be moved to the beginning and then have its number of repeats limited. $\:$ (In fact, even without the "repeats limited" part, that would also stop timing attacks.) $\;\;\;\;$
Oct
5
comment RSA 1024 bit forge a new matching signature from a chosen message
The message is chosen by the forging procedure itself, not the person who's using that procedure. $\hspace{.4 in}$
Oct
4
comment Bcrypt input length vs collisions
(Also, bcrypt does not encrypt.) ​ ​
Oct
2
comment Is this distributed OTP scheme secure?
en.wikipedia.org/wiki/Stream_cipher $\:$ en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CTR $\hspace{.53 in}$
Oct
2
comment Is it possible to create “non overlapping” RNGs?
If R1 and R2 must be independent, then this becomes equivalent to [non-interactive commitment such that commitments are pseudorandom]. $\;$
Sep
29
reviewed Reviewed Encrypting or HMACing password digests