New answers tagged

3

Hash functions are candidates for random oracles. SHA-3 and BLAKE2 are close to being one but not SHA-512 since it has a length extension attack that we don't expect from a RO. The different hash functions already produce different outputs even SHA-512 and its truncated version SHA-512/256 since their initial values are different. Actually, you don't need ...


2

In the random oracle model this is safe to do because you can use a single oracle $\mathcal{O}$ and use domain separation to obtain two independent oracles from it (e.g. $\mathcal{O}(1 \parallel \cdot)$ and $\mathcal{O}(2 \parallel \cdot)$, where $\parallel$ denotes concatenation). Then you can consider the outputs to be totally independent from each other. ...


1

Terminology is important here. A cryptographic salt's main purpose is to secure passwords during reuse and avoid hash pre-computation. So yes, that provides your domain separation. But your question is about randomness extraction from arbitrary sources i.e including devices. NIST's SP800 90B "Recommendation for the Entropy Sources Used for Random Bit ...


0

If both secure schemes are UC-secure, combining them to design a new secure scheme is also secure in terms of the security properties defined in the original secure schemes. It has been proved in the UC framework.


0

A key point here is that in Fiat-Shamir transformation, you need to make a distinction between what security means in real implementation and what it means in the theory of your design. It is true that in practice we use hash functions to implement Fiat-Shamir transformation, but as you mentioned it doesn't seem easy to simulate the proof in this case. In ...


Top 50 recent answers are included