Ricky Demer
Reputation
5,080
Next tag badge:
52/100 score
31/20 answers
Badges
1 7 21
Newest
Impact
~53k people reached

• 17 helpful flags
• 250 votes cast

# 1,750 Comments

 1d comment Miller Rabin - Error probability of .5 a possibility? Huh, that does confuse me about the algorithm. ​ ​ 1d comment Miller Rabin - Error probability of .5 a possibility? If u=1 then your initial for loop will execute 0 times. ​ ​ 2d comment Execution time RSA Neither. ​ ​ ​ ​ 2d comment Why can you reverse a modulo function when knowing its primes Nov 20 comment Keyless integrity checking with SHA-256 @Hans : $\;\;\;$ Because resistance to length extension attack is goal (which hash functions would have to go to a non-zero amount of effort to hopefully achieve) that is not at all relevant to your use case. $\:$ However, using randomized hashing would be good. $\;\;\;\;\;\;\;\;$ Nov 16 comment what problem happen if we always use IV Zero in CBC Mode? @Mahsaehsani : ​ See my previous comment. ​ ​ ​ ​ Nov 16 comment what problem happen if we always use IV Zero in CBC Mode? @curious : ​ ​ ​ The actual requirement for CBC mode is that the IV be unpredictable. ​ If the IVs are chosen randomly but, after the adversary sees challenge ciphertext's IV, the adversary learns an IV before choosing the corresponding plaintext, then the adversary can check a guess of the challenge plaintext's initial block. ​ On the other hand, (for example) the middle two bits of the IV always being 1 wouldn't be a problem. ​ ​ ​ ​ ​ ​ ​ ​ Nov 14 comment Encryption that can only be decrypted once? There might also be some way to do it with quantum mechanics. $\;$ Nov 14 comment Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator That depends on whether your planning on actually implementing it or just giving a theoretical construction. ​ Also, I realize that there was ambiguity in my abbreviations. ​ As I'm using it, the C in CZKAoK stands for Computational. ​ Concurrent ZK is not relevant to your application, since Alice's privacy can be shown by a hybrid argument. ​ ​ ​ ​ Nov 14 comment Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator @MHSamadani : ​ ​ ​ Yes. ​ Hopefully, you can fit in a ZKPoK of SK. ​ If Bob is only supposed to have computational security, then a CZKAoK would also work. ​ If you can't do either of those, but Bob's security against an honest-but-curious adversary is information-theoretic, then you could probably also get information-theoretic indistinguishability against a malicious Alice with respect to a PSPACE simulator, which is still a non-trivial notion of security. ​ ​ ​ ​ ​ ​ ​ ​ Nov 14 comment If a PRG is constructed by iterating a PRF, is it backtracking-resistant? Yes. $\:$ en.wikipedia.org/wiki/Advanced_Encryption_Standard $\;\;\;\;$ Nov 14 comment If a PRG is constructed by iterating a PRF, is it backtracking-resistant? A PRF with large domain is hard to invert for parties/people who don't know the key. ​ ​ Nov 14 comment If a PRG is constructed by iterating a PRF, is it backtracking-resistant? Yes. ​ Who is a PRF hard to invert for? ​ ​ ​ ​ Nov 13 comment Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator @MHSamadani : ​ ​ ​ "we need to extract the input of real world adversary" when we need to do something with it (like send it to something/someone), and we don't when we don't. ​ Yes, but it's not relevant here. ​ That depends on the protocol/scheme. ​ "Using a ZKPOK to prove knowing the secret key" would work. ​ ​ ​ ​ ​ ​ ​ ​ Nov 12 comment If PRF is non invertible, why does Ctr-mode work? For any length, $\: \langle$ binary_strings_of_that_length , xor $\rangle \:$ is an abelian group. $\hspace{1.92 in}$ For any length, each element of that group is its own inverse. $\;\;\;$ Nov 11 comment Why can't I reverse a hash to a possible input? You're missing fan-out. ​ ​ Nov 10 comment Modular arithmetics in diffie-hellman (In fact, as I now notice, the "and only if" part follows from the former of those two facts.) $\;$ Nov 10 comment Modular arithmetics in diffie-hellman I think you'd also need "and only if" for the latter of those two facts. $\;$ Nov 9 comment Cracking passwords with more than 10 characters in a few hours? Well, the former at least could be from guessing keyboard patterns. ​ (I don't immediately see such a pattern for the latter.) ​ ​ ​ ​ Nov 7 comment what is the difference between one way function and hard core predicate? Indeed, one-way functions must output more for sufficiently long inputs. $\;$