2,926 reputation
1518
bio website
location United States
age
visits member for 2 years, 5 months
seen 4 hours ago

2d
comment Composing hashes and/or MACs
That works for the usual conditions of unforgeability and pseudorandomness. $\:$ On the other hand, it does not work for the intermediate property of being a privacy-preserving mac. $\;\;\;\;$
2d
comment Which commitment scheme is better for malicious models
What is "the one based on digital signatures"? $\;$
Apr
15
comment Security of RSA for paranoids with padding?
One could just apply naked RSAP to something chosen at random and use a random oracle's $\hspace{.68 in}$ value at that thing as a key, although this approach would increase the ciphertext overhead. $\hspace{.96 in}$
Apr
15
comment Sequence of Encrypting RSA like Chaum Blinding scheme
One would check the signature's authenticity by checking whether or not $\:$ pow(claimed_signature,e,n) == digest(message) $\:$ is satisfied. $\;\;\;$ "Will unblinded_signed_msg == pow(message,d,n) satisfy" what condition? $\;\;\;\;\;\;$
Apr
15
comment Sequence of Encrypting RSA like Chaum Blinding scheme
Are you using Python? $\:$ Is "wayyy to long" more than 15 seconds? $\:$ My laptop was able to evaluate that for 25 random 2047-bit triples in under 7 seconds. $\:$ I would tackle this by making sure you're never computing pow(blinded_message,d), and then looking for other bugs you might have. $\:$ As far as I can see, the value of pow(signed_msg,r**-1,n) is completely irrelevant. $\:$ (I don't see a reason for anything involving r to be in the exponent.) $\;\;\;\;$
Apr
14
comment Sequence of Encrypting RSA like Chaum Blinding scheme
Which of the posts in that link are you talking about? $\;\;\;$ One signs on a blinded_message by computing $\:$ (blinded_message)^d % n $\;$. $\;\;\;\;\;\;$
Apr
14
comment Sequence of Encrypting RSA like Chaum Blinding scheme
Neither party computes r**d. $\;\;\;$ (You may want to actually look at the link I gave for $\:$ (blinded_token)^d % n $\;$.) $\;\;\;$ I'm about to edit in a bound on the blindness in terms of privacyparameter. $\;\;\;\;\;\;$
Apr
13
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
Usefully, the change you describe would also stop a hash collision from immediately yielding $\hspace{.9 in}$ a way to violate unforgeability for every public key. $\;$
Apr
12
comment Why should a signature use PSS padding in RSA?
In addition to issues related to RSA, what your first paragraph describes is analogous to encrypt-and-MAC.
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
I thought that would be about the chaining variable's length, rather than the MAC's length. $\hspace{.95 in}$
Apr
12
comment Why are collision attacks important when talking about MAC schemes?
@DrLecter : $\:$ How will the birthday attack "allow to produce such a forgery"? $\hspace{1.76 in}$
Apr
12
comment Given a message and signature, find a public key that makes the signature valid (ECDSA)
related $\;$
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$
Apr
11
comment Threshold signatures vs. certificate authority+voting verification
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$
Apr
10
comment After heartbleed, how can you safely distribute new certs?
Wouldn't it be "possible that even the root level private keys were compromised" even without heartbleed? $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
The obvious thing you mention is outside of the OP's setting, and the surreptitious thing $\hspace{.98 in}$ you mention would hopefully break the protocol. $\;$
Apr
10
comment Leak-proof protocol: is such a thing possible?
@StephenTouset : $\:$ Things independent of what has been mentioned so far, which is why atzz is only assuming that one of the implementations is malicious. $\;\;\;\;$
Apr
10
comment Security of this deterministic encryption scheme
Probably, although there might be differences resulting from CBC vs CTR. $\;$
Apr
10
comment Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?
@SDL : $\:$ Is the value a actually relevant? $\;\;\;\;$
Apr
9
comment Security of this deterministic encryption scheme
@RichieFrame : $\:$ SIV mode doesn't have a MAC on the ciphertext either. $\;\;\;\;\;$