3,774 reputation
1621
bio website
location United States
age
visits member for 3 years, 1 month
seen 15 mins ago

Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
Whenever the system receives a message $m$ as input, the system lets $x$ be a uniformly-random bit-string of the right length and publishes $\langle m\hspace{.02 in},f(x)\rangle$. $\;$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
... um, it wouldn't mean that. $\;$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
@fread2281 : $\:$ You can just treat each message independently "to avoid that forgery." $\hspace{1.16 in}$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
@QuadrExAtt : $\:$ everone $\mapsto$ everyone $\;\;\;\;$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
Why can't they just bundle f(x) with the data for some one-way function f? $\;$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
One thing he might mean by better security is hopefully being secure against quantum algorithms. $\hspace{.43 in}$
Aug
30
comment Asymmetric algorithm for one time signing of small cleartext
How was RSA "proved to be as difficult as prime factorisation"? $\;$
Aug
29
revised practically verifying block ciphers strength
general copy-editing
Aug
27
comment Possible CPA or CCA attack when using AES-CBC mode under the following situation?
imaging $\mapsto$ imagine $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
site.uottawa.ca/~lucia/courses/4105-10/CIRCUITSATisNPhard.pdf $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
Real executions use Binding keys and the Simulator uses Hiding keys. $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
They show that violating the zero-knowledge property is at least as hard as $\hspace{1.67 in}$ violating those hardness assumptions. $\:$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
You could try BB signatures, even though knowing a large number of signatures reduces the time needed to recover the signing key. $\:$ (Notice the top paragraph on page 12.) $\;\;\;\;$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
"IC" $\:$ =?= $\:$ "integrated circuit" $\;\;\;$ ? $\;\;\;\;\;\;\;$
Aug
20
comment IND-CCA2 secure schemes without Plaintext Awareness?
iacr.org/archive/pkc2009/54430381/54430381.pdf $\;$
Aug
20
comment A patched SHA1 attempt for password verification
or even basE91 $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
It makes the resulting protocol be such that, as far as I can see, there does not necessarily exist a fast classical two-for-one guessing attack on a large $N$ that can handle arbitrary pairs of candidate passwords. $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$
Aug
19
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
I notice that there necessarily still exists a fast classical attack for any given $g$ and $N\hspace{-0.02 in}$. $\:$ It seems to me that using k = 3 + H(N,g,A) would make it plausible that there is no fast classical attack. $\:$ Is there a better reason than "it takes slightly more computation" for not doing that? $\;\;\;\;$
Aug
19
comment SRP-6 vulnerabilities when N is small
If "someone ... B - kv" then succeeding at finding those logs would give candidate S values. $\hspace{.54 in}$ Probably not, since those logs will almost always exist. $\;$