Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
9

If the KGC gets compromised it will break security, so why should a KGC generate private keys. Certificateless crypto tries to overcome the problem which exists in identity based crypto, i.e., that the KCG generates all the private keys of the users (that is necessary in IBE, see below) and thus knows all the private keys of users (which in turn enables the ...


4

So let's start with the hash functions: $$H_n:A\times B\times C \rightarrow D$$ is the mathematican's notion for a function called $H_n$ that takes arguments from the sets $A,B,C$ (in this order) and maps it to $D$, where $B,C$ are optional. You're facing three types of sets for this: $\{0,1\}^*$ is the set of binary bit-strings of arbitrary size, e.g. ...


3

I still got the impression that you did not really have read my answer to a related question. But still, I try to briefly answer your questions here. First of all, private key extraction essentially means private key generation. Extraction, because the partial private key ($D_A$) is generated with repsect to an identity string $ID_A$ uniquely identifying ...


2

In Kerberos, if the Key Distribution Center is compromised then all the stored keys are exposed. In PKI, if a Certificate Authority is compromised then certificates may be forged. So, I guess we typically assume that the "trusted" third party will not be compromised so easily? Because either method you choose, there are still some inherent risks.


2

It is proposed to use $\operatorname{SHA-256}(\mathsf{horodate}\|\mathsf{password})$ as a key of AES or/and Initial Value (the lack of unique IV is stated as the motivating context). That's a very poor idea. If the password is worth its name and is low-entropy (as most passwords are, and increasingly so since the bar for low-entropy is raising per some ...


1

The usual curves we use in ECC are often not suitable for pairing-based cryptography (e.g. you may not find an efficient bilinear mapping), while pairing-friendly curves may not be suitable for normal ECC (e.g. in gap Diffie–Hellman groups, DDH is not hard). There is an IETF draft on Pairing-Friendly Curves, summarizing the popular curves used in pairing-...


1

the same message for many times with the same password and initial value is absolutely not secure If you are sending THE SAME message, that's maybe not so bad (effectively having ECB mode). The adversary would know it's THE message but not necessarily content of the message. But in most of the cases it's bad idea. And there's risk using different messages ...


1

$\mathbb Z_p^*$ is the multiplicative group modulo $p$, that is (since $p$ is prime) $\mathbb Z_p$ less the element $0$ modulo $p$. Implied or missing in the question's statement and the paper's Setup() procedure is that $g$ is of order $q$; that is, $g$ is such that $q$ is the smallest positive integer $j$ verifying $g^j\equiv1\pmod p$. Finding $r$ given ...


1

As you can see in their abstract, they are assuming that "the standard Computational Diffie-Hellman problem is intractable", thus this means that you may necessarily break their scheme by solving the Discrete Logarithm problem, since the Computational Diffie-Hellman (CDH) problem can be solved easily if the DLP can be solved. The CDH problem is the ...


1

Let $\mathbb{G}$ be a (multiplicatively written) group of order $q$ and let $g$ be a generator of $\mathbb{G}$. The $r$-SDH assumption (Strong Diffie-Hellman) [BB08] states that given $$ g,g^x, g^{x^2}, \dots, g^{x^r} $$ as input, it is hard to compute a pair $(a, g^{1/(x+a)})$ for some $a \in \mathbb{Z}_q$. Writing group $\mathbb{G}$ additively and letting ...


1

Correct me if I am wrong $xH_1$ $(ID_A,w_0)$ means $x \times H_1(ID_A) \oplus H_1(w_0)$ where $x \in Z_q^*$ It is hard to formally respond because I don't have access to the paper you mention but with common sense, just by reading the $H_1$ definition, $xH_1$ $(ID_A,w_0)$ means $x \times H_1(ID_A, w_0)$ where $ID_A \in \{0,1\}^*$ and $w_0 \in Z_p^*$. But ...


1

As far I understood the paper (very briefly) it looks like it's talking about the default asymmetric encryption without the CA (certificate authorities). However - it seems there's the SEM part of the system which seems to know the private keys (???) and acts as the revocation authority. I believe you can use the default Java crypto API without needing to ...


Only top voted, non community-wiki answers of a minimum length are eligible