Hot answers tagged

4

In many applications, especially in zero-knowledge proofs, we need commitment schemes that are additively homomorphic. Pedersen commitment schemes do have this property, hash-based commitment schemes don't. If we do Pedersen commitments on elliptic curves for performance reasons, where we fix two points $P$ and $Q$ on a curve, we can define: $\text{commit}(...


3

The point is not to make the attack infeasible time-wise. Computational resources (usually, area*time, which is roughly a measure of the monetary cost) needed for the attack is the only thing you can hope to increase here. As you observed, it is always possible to parallelize brute-force search of passwords, so the best you can do is increase the ...


2

The first scheme is similar to what's called Encrypt-and-MAC. It is not ideal, but it is not fatally broken, and it is still used by the SSH protocol securely. You need to include a counter or other unique value in the data being MACed to maintain IND-CPA security (i.e. identical plaintexts don't have identical MACs). The second scheme you present doesn't ...


1

There are two general approaches to parallelizing MACs: Use a universal hash like GHASH or Poly1305 whose algebraic structure admits essentially arbitrary levels of parallelism. For GHASH and Poly1305, the hash is polynomial evaluation: \begin{equation} H_r(m_1 \mathbin\| m_2 \mathbin\| \dotsb \mathbin\| m_n) := m_1 r^n + m_2 r^{n-1} + \...


1

The salt of a password hash mitigates multi-target attacks like rainbow tables (and variants like the parallel rainbow table search machine), if you use a distinct salt for each user. Effectively, a distinct salt for each user means each user is using a slightly different hash function, so the advantage of any batch attack on many instances of the same hash ...


1

Whatever parameters you pass in will affect the resulting hashes. If you compute only H(Firstname), then two users with the same first name will lead to the same hash even if they have different surnames. P.S. Consider letting users simply have a name so that you respect the vast populations of people out there whose names do not conform to the anglophone ...


Only top voted, non community-wiki answers of a minimum length are eligible