3,597 reputation
1519
bio website
location United States
age
visits member for 2 years, 10 months
seen 19 hours ago

1d
comment Asymmetric algorithm for one time signing of small cleartext
An attacker could do that, but it shouldn't be accepted as a revocation of any pair $\langle m',p\rangle$. $\hspace{.86 in}$
1d
comment Asymmetric algorithm for one time signing of small cleartext
Whenever the system receives a message $m$ as input, the system lets $x$ be a uniformly-random bit-string of the right length and publishes $\langle m\hspace{.02 in},f(x)\rangle$. $\;$
1d
comment Asymmetric algorithm for one time signing of small cleartext
... um, it wouldn't mean that. $\;$
1d
comment Asymmetric algorithm for one time signing of small cleartext
@fread2281 : $\:$ You can just treat each message independently "to avoid that forgery." $\hspace{1.16 in}$
1d
comment Asymmetric algorithm for one time signing of small cleartext
@QuadrExAtt : $\:$ everone $\mapsto$ everyone $\;\;\;\;$
1d
comment Asymmetric algorithm for one time signing of small cleartext
x is a uniformly-random bit-string of the right length. $\;$
1d
comment Asymmetric algorithm for one time signing of small cleartext
Why can't they just bundle f(x) with the data for some one-way function f? $\;$
1d
comment Asymmetric algorithm for one time signing of small cleartext
One thing he might mean by better security is hopefully being secure against quantum algorithms. $\hspace{.43 in}$
1d
comment Asymmetric algorithm for one time signing of small cleartext
How was RSA "proved to be as difficult as prime factorisation"? $\;$
Aug
27
comment Possible CPA or CCA attack when using AES-CBC mode under the following situation?
imaging $\mapsto$ imagine $\;$
Aug
26
comment Proof for composed signatures
Is "the result" just the detached signature or the signed message? $\:$ Are "the advantages for breaking" those with respect to weak or strong unforgeability? $\;\;\;\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
site.uottawa.ca/~lucia/courses/4105-10/CIRCUITSATisNPhard.pdf $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
Real executions use Binding keys and the Simulator uses Hiding keys. $\;$
Aug
24
comment Groth-Sahai proofs and hardness assumptions
They show that violating the zero-knowledge property is at least as hard as $\hspace{1.67 in}$ violating those hardness assumptions. $\:$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
You could try BB signatures, even though knowing a large number of signatures reduces the time needed to recover the signing key. $\:$ (Notice the top paragraph on page 12.) $\;\;\;\;$
Aug
21
comment ECC cryptography with shorter signature when not needing high security?
"IC" $\:$ =?= $\:$ "integrated circuit" $\;\;\;$ ? $\;\;\;\;\;\;\;$
Aug
20
comment IND-CCA2 secure schemes without Plaintext Awareness?
iacr.org/archive/pkc2009/54430381/54430381.pdf $\;$
Aug
20
comment A patched SHA1 attempt for password verification
or even basE91 $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
It makes the resulting protocol be such that, as far as I can see, there does not necessarily exist a fast classical two-for-one guessing attack on a large $N$ that can handle arbitrary pairs of candidate passwords. $\;$
Aug
20
comment Why does the SRP-6 calculation of B include a multiplier k = 3?
That's certainly not obviously equivalent, since it makes $k$ depend on the client's message. $\hspace{.91 in}$