Comment by Command Master on How does bias in a randomness test become...
@MaartenBodewes you're right, apologies. I think it is accurate though that if for a string of random English characters, if its conditional entropy given it xor the key is less than $\log26-1$ bits...
View ArticleComment by Command Master on Semi-honest adversary's random tape in MPC...
Could you give more detail on your exact security definition? I'm not sure why you need such a complicated simulator in the semi-honest setting
View ArticleComment by Command Master on Is this PRF + nullifier + signature construction...
Does the user know $r_p$? If yes, why can't they just create new tokens? If no, how do they produce the ZK proof about $C$?
View ArticleComment by Command Master on Clarify whether a Beaver Triple is essentially a...
What is the multiplication computation function? $f_a(x) = ax$? You can just share $a$ additively, in this case.
View ArticleComment by Command Master on How does Twofish avoid weak keys if it uses...
I'm not sure I'm following - are you claiming that the key-dependent S-box might not be bijective? This is a problem in the construction if it happens, but in the case of Twofish this can't happen -...
View ArticleAnswer by Command Master for Upper bound of ``subadversary'' in a reduction
The notion you are interested in is parameter-aware reduction, see Baecher, P., Brzuska, C., Fischlin, M. (2013). Notions of Black-Box Reductions, Revisited. In: ASIACRYPT 2013, particularly Chapter 3....
View ArticleCiphertext-only attacks on randomly permuted many-time-pad
Consider the encryption scheme where an $n$-bit message $m$ is encrypted with an $n$-bit key $k$ by randomly choosing a permutation $\pi$ of $1,2,3,\dots,n$, and the ciphertext is the pair $(\pi,...
View ArticleAnswer by Command Master for Symmetric functions that become bijective when...
The object you are looking for is called a symmetric Latin square, also known as a commutative quasigroup.The functions you give are given by Abelian groups of order $2^n$ - the first one is...
View ArticleAnswer by Command Master for How to encrypt a message using a public key?
It is illustrative to look at Impagliazzo's five worlds. Impagliazzo shows generating hard SAT instances (or any NP complete problem) together with their solution implies a one-way function: consider...
View ArticleAnswer by Command Master for d and phi encrypted with small e in RSA; how to...
You have the relation $3d = k\phi+1$, for $0\le k\le 2$, so you can apply the Franklin–Reiter related-message attack for the three possible values of $k$, as you can compute an encryption of $3d$ and...
View ArticleComment by Command Master on Dynamic group signature scheme with revocation...
Requirement (4) is impossible — clients are able to recover the list of currently approved signers by preestablishing a signature from each signer and seeing which ones verify correctly, so by...
View ArticleComment by Command Master on Solving $x^2+y^2=1 \mod P$ (P composite and...
What do you mean by found? Where is this code from?
View ArticleComment by Command Master on Is XOR-scrambling with a seeded RNG a secure...
Have you considered using CTR mode? Could you elaborate on the constraints? If the rng is weak that one can potentially construct blocks such that $B_i \oplus \text{rng}(N+i) = B_j \oplus...
View ArticleComment by Command Master on Is an a priori naturalistic conlang undecipherable?
cryptographic side note: the assumption that an adversary won't have access to plaintext-ciphertext pairs is very strong, and is probably not true in practice, where they can e.g. guess what someone is...
View ArticleComment by Command Master on Is an a priori naturalistic conlang undecipherable?
The bilingual dictionary is inferred— they learn it by looking at words which have similar relationships to other words as those in the other language (this is an oversimplification). Note that in the...
View ArticleComment by Command Master on The ability of adversaries in simulation-based...
Do you have a precise definition from a particular paper that you are interested in?
View ArticleComment by Command Master on Associative and Commutative Encryption
Can't the server decryption just add more noise?
View ArticleComment by Command Master on Programmable PRF that can be evaluated before...
If you need a $k$ bit output you can use $k / l$ different programmable DPFs each with $l$-bit output, if that's helpful
View ArticleComment by Command Master on Programmable PRF that can be evaluated before...
@Mikero the commitment has to depend on the value of the other signers' commitments
View Article![ONEW – KAKERA -Unmei no Piece- – EP [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music221/v4/d0/fb/86/d0fb86a5-ba60-4bea-41fb-7f54c125f518/VEATP-45908.jpg/296x296bb.webp)
/pic9814888.png)
