Ricky Demer
Reputation
5,490
Top tag
Next privilege 10,000 Rep.
Access moderator tools
 Oct 15 comment Proving the security of a one-way function with partially known input An OWF needs one non-parameter input (the x in wikipedia's incorrect definition). $\:$ With parameters, one will need to distinguish between "one-way for whatever parameters [are / will be] used", one-way for some specific distribution of parameters, and "one-way even when the adversary chooses the parameters". $\hspace{.27 in}$ Oct 15 comment Proving the security of a one-way function with partially known input Is "the question" the one we're commenting on right now, or one of the two you linked to? $\;$ Oct 15 comment Proving the security of a one-way function with partially known input I mean, give two efficient procedures such that one of them will transform any OWF f into an OWF h for which the other has a noticeable probability of recovering TXT from H1,H2,...,Hn. $\;$ Oct 15 comment Proving the security of a one-way function with partially known input One wouldn't "go about prooving" that. $\:$ One would instead give a counterexample. $\hspace{1.44 in}$ Oct 13 comment Scale-Invariant DGHV Scheme - Decryption ... You're apparently implementing ​ mod 2 ​ wrong, since that should output a non-negative number. ​ ​ ​ ​ Oct 13 comment Very short signatures? (eg: 48bits?) @HenrykPlotz : $\:$ Can those specifically target short signatures, rather than just going after the private key? Oct 13 comment Very short signatures? (eg: 48bits?) @user152408 : $\;\;\;$ (I noticed an assumption I was making, that I should check.) $\:$ Do you specifically want short signatures or just want the length of the signed_message object to not be much longer than the length of the message? $\:$ If the latter, then there's a much better approach. $\;\;\;\;\;\;\;\;$ Oct 13 comment Very short signatures? (eg: 48bits?) @user152408 : $\:$ Make sure you read the paragraph I gave the title to, rather than just other parts of the paper that paragraph is in. $\;\;\;\;$ Oct 12 comment Very short signatures? (eg: 48bits?) I think Ultra Short Weakly Secure Signatures are the closest thing known to what you're asking about. $\;\;\;\;\;\;$ Oct 12 comment Does a padding oracle have the encryption key? Where in real life do I see such an oracle? Usually, such vulnerabilities are in the SSL/TLS part, since in most cases, the only $\hspace{1.45 in}$ other cryptography they do is password hashing. $\;$ Oct 11 comment Weakness of SRP after server compromise @SEJPM : $\:$ I don't see any mention of HMAC in the question. $\;\;\;\;$ Oct 11 comment Inverting RSA function @EVELYN : $\:$ k is a positive integer, and in this case that's all it is. $\;\;\;\;$ Oct 6 comment SHA-256 “almost unique”? No. $\:$ Yes; there's no publicly known method that seems likely to find a collision in $\hspace{1.46 in}$ SHA-256 with significantly less than $2^{128}$ work. $\;\;\;\;$ Oct 5 answered Probabalistic Polynomial-time Algorithms & One-way functions Oct 5 comment Generating unbiased numbers with a biased six sided die? To get a bounded number of throws per output-or-lack-thereof, the "until it gives other than 1" step can be moved to the beginning and then have its number of repeats limited. $\:$ (In fact, even without the "repeats limited" part, that would also stop timing attacks.) $\;\;\;\;$ Oct 5 comment RSA 1024 bit forge a new matching signature from a chosen message The message is chosen by the forging procedure itself, not the person who's using that procedure. $\hspace{.4 in}$ Oct 4 comment Bcrypt input length vs collisions (Also, bcrypt does not encrypt.) ​ ​ Oct 2 comment Is this distributed OTP scheme secure? Oct 2 comment Is it possible to create “non overlapping” RNGs? If R1 and R2 must be independent, then this becomes equivalent to [non-interactive commitment such that commitments are pseudorandom]. $\;$ Sep 29 reviewed Reviewed Encrypting or HMACing password digests