Marc Ilunga
  • Member for 3 years, 8 months
  • Last seen this week
Could celestial objects be used in cryptography?
14 votes

I believe a potential application can be found in the so-called "bounded storage model" introduced by Maurer here: https://crypto.ethz.ch/publications/Maurer92b.html In summary, the bounded ...

View answer
Does adding complexity mean a more secure cipher?
6 votes

This is indeed a example of complexity not adding security and actually weakening it. The second encryption can be written as $c = c_1|| c_2$, where $c_1 = E_k(m) \oplus m$ and $c_2 = E_k(m) \oplus ...

View answer
Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?
Accepted answer
6 votes

Yes. In this paper, Coron and al. showed that a plain MD construction is secure when it's inputs are prefix-free. They actually proved the indifferentiability of the construction. In other words ...

View answer
Why do one-time pads not provide message authentication?
4 votes

The OTP does not provide message integrity, wasn't designed too and almost certainly can't. The OTP is a model that formalizes the notion of confidentiality. A System providing integrity should to ...

View answer
Statistical closeness implies computational indistinguishability
4 votes

Another way to see this would be to try and upper bound the distinguishing advantage for any distinguisher and relate that to the statistical distance. Edit: Since the following answer is really ...

View answer
double encryption - One Time Pad
4 votes

The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad. The security of the ...

View answer
Formal definition PRNG
Accepted answer
4 votes

If we call $U_k$ the random variable uniformly distributed over bit strings of length $k$, then a function $g: \{0,1\}^k \to \{0,1\}^m$ is called pseudo-random generator if no feasible(poly-time if ...

View answer
Is the One Time Pad secure in additive Rings?
3 votes

The classical xor-based one-time pad can be generalized to finite groups. Let $(G,*)$ be such group with order $p$ and $*$ is the group operation(like the xor). The message, the pad and the ...

View answer
What are the differences between a UHF (as used in cryptography) and a cryptographic hash function?
2 votes

The main difference is as you noted: Cryptographic hash functions need not be keyed. So intuitively the weak collision resistance guarantee for UHFs is indeed weaker that what we ask for cryptographic ...

View answer
How to Understand Authenticated Key Exchange?
Accepted answer
2 votes

One way to understand this is through a rather abstract and constructive viewpoint, abstracting away specifics. As you mentioned, a DH key exchange needs to be done in an authenticated manner ...

View answer
Soft question: What are examples of beautiful proofs in cryptography?
2 votes

The indifferentiability framework by Maurer et al. is an important and widely used framework when discussing security of hash functions. The essence of the framework is that if a hash function $\...

View answer
MPC protocols for high school kids
2 votes

A fun one(and how I was introduced to MPC) could be to compute the average constipation rate of the class or something like that, where each student has a constipation rate between 0 and 100. This ...

View answer
A question regarding next-bit predictors
1 votes

I am not sure this is correct but I'll give it a try... More specifically instead of relating the conditional probabilities, I will rather try and bound conditional entropies i.e $H(X_k | X_1^{k-1})$. ...

View answer
Measuring entropy of a uniform distribution source
Accepted answer
1 votes

I will try and answer with a different perspective than the other 2 excellent answers, namely I want look at properties of entropy that may help bridge the intuition and the actual definition. Shannon'...

View answer
How to solve high exponent attack for same message in RSA
1 votes

If you have $e$ ciphertexts for the same message, then the attack is the same, you just have to apply the CRT with $e$ values, then computing the $e$'th root of the resulting value might need some ...

View answer
Soft question: What are examples of beautiful proofs in cryptography?
1 votes

Another extremely beautiful yet simple construction with an elegant proof is the one-time pad. The one-time pad is an information-theoretical secure encryption scheme. It is usually described as a ...

View answer
Signature security proof in the Random Oracle model
1 votes

The words "controls"(in the question) and "manipulates"(in the paper) can be somehow misleading as to what is happening. Often in literature this is rather formulated as: emulates a random oracle, etc....

View answer
A hash function for sets that from a hash of a set and a subset of it doesn't reveal the hash of the remaining elements in the set
1 votes

This is not really an answer but a collection of observations. Condition 1) seems a bit problematic and confusing. It seems that it would only hold if the size of $S$ is large enough independently ...

View answer
Monotonicity of min-entropy
1 votes

I think I've found the solution. Let $z = (z_1,\ldots,z_{t+1})$ be the value that maximizes $P^{Z^{t+1}}[\cdot]$ and the probability is $Pz$. Let $x = (x_1,\ldots,x_t)$ the value that maximizes $P^{Z^...

View answer
Is OTP with homomorphic encryption trivial?
1 votes

In principle, you could define the OTP over any group, where encryption of a group element $m$ is done by sampling a uniform group element $k$ and compute the ciphertext as $c = m + k$. Here $+$ is ...

View answer
Proof one-time pad is perfectly secret with eavesdropping game definition
Accepted answer
1 votes

Might be too late.. but yes the approach is correct. As you said, since the one time pad is being used, Eve doesn't really need $c$(not even choosing the two messages) she could just use some ...

View answer
Using the same RSA key for verifying a website and digital signature
1 votes

tl;dr: send to the server $enc(random) \times theHash$, and divide the value that you get back by $random$. That is your forged signature for $theHash$. Your setup can be summarized as follows: with ...

View answer
Asymmetric cryptosystems based on curves besides elliptic curves
0 votes

Besides Elliptic Curves, conic sections (over an appropriate finite field $\mathbb F_p$) also provide a group structure. Therefore they could be used in Diffie-Hellman key exchanges. Note, however, ...

View answer
Is a PRG concatenation using the same input still a PRG?
0 votes

This is in complement to the other answers. We can look at a concrete example with $G: \{0, 1\} \to \{0, 1\}^2 = \{00, 01, 10, 11\}$ and $G(k) = k|k$ A natural game to play is to just try to guess ...

View answer
Is there only one formula for the statistical difference between a pair of distribution ensembles?
0 votes

In the cryptographic context, the $\Delta(X;Y)$ formula(i.e the statistical distance) seems to be the most 'natural' because of the way we define security in terms of a distinguishing advantage. i.e $$...

View answer
Is there a cryptographic approach to availability
0 votes

It's surely depends on the model and what the adversary is allowed to do. As mentioned in the other answer, if we take a somewhat restricted adversary, there are means(not purely cryptographic per say)...

View answer