Timeline for Hash Output Distribution for Partly Randomised Input
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 6 at 20:09 | comment | added | Mark Schultz-Wu♦ | @ArghyaBhattacharjee also I would suggest using $f'_k(x) :=H(k||x)$ instead. Prepending (rather than post-pending) strings is the typical way that domain separation is achieved, which seems to be what you want. | |
| Feb 6 at 19:40 | comment | added | Mark Schultz-Wu♦ | @ArghyaBhattacharjee it is implied by the assumption that $H$ is a random oracle, so it is implied by a standard assumption. It's not clear to me how meaningfully better of an assumption it is to assume $H$ is 2-universal versus just a random oracle directly though --- I think that really depends on your tastes/applications. | |
| Feb 6 at 18:15 | comment | added | Arghya Bhattacharjee | Thanks for the response. For a good cryptographic hash function $H$, would you say it's fair to assume that $\{f_k(x) := H(x||k) \mid k \in \{0,1\}^n\}$ is a family of 2-way universal hash functions? Then we can directly use the Leftover Hash Lemma. | |
| Feb 5 at 23:14 | history | answered | Mark Schultz-Wu♦ | CC BY-SA 4.0 |