Re: Merkle Signature Scheme is the most secure signature scheme possible for general-purpose use

2010-09-03 Thread Marsh Ray
On 09/03/2010 01:22 PM, Ben Laurie wrote: On 03/09/2010 17:01, Marsh Ray wrote: I played with some simulations with randomly-generated mappings, the observed value would at times wander over 1.0 BoE/log2 N. I think when I did this, I fully enumerated the behaviour of a truncated hash (e.g. the

Re: Merkle Signature Scheme is the most secure signature scheme possible for general-purpose use

2010-09-03 Thread Ben Laurie
On 03/09/2010 17:01, Marsh Ray wrote: > I played with some simulations with randomly-generated mappings, the > observed value would at times wander over 1.0 BoE/log2 N. I think when I did this, I fully enumerated the behaviour of a truncated hash (e.g. the first 20 bits of MD5). Cheers, Ben. --

Re: RSA question

2010-09-03 Thread Sampo Syreeni
On 2010-09-02, travis+ml-cryptogra...@subspacefield.org wrote: I hear that NIST Key Mgmt guideline (SP 800-57) suggests that the RSA key size equivalent to a 256 bit symmetric key is roughly 15360 bits. I haven't actually checked this reference, so I don't know how they got such a big number;

Re: Merkle Signature Scheme is the most secure signature scheme possible for general-purpose use

2010-09-03 Thread Marsh Ray
On 09/03/2010 03:45 AM, Ben Laurie wrote: That's the whole point - a hash function used on an arbitrary message produces one of its possible outputs. Feed that hash back in and it produces one of a subset of its possible outputs. Each time you do this, you lose a little entropy (I can't remember

Re: Merkle Signature Scheme is the most secure signature scheme possible for general-purpose use

2010-09-03 Thread Jack Lloyd
On Fri, Sep 03, 2010 at 09:45:20AM +0100, Ben Laurie wrote: > > That's the whole point - a hash function used on an arbitrary message > produces one of its possible outputs. Feed that hash back in and it > produces one of a subset of its possible outputs. Each time you do this, > you lose a little

Re: Haystack redux

2010-09-03 Thread Alec Muffett
Flamewar seems to have broken out: http://neteffect.foreignpolicy.com/posts/2010/09/02/hay_what I've had issues[1] with some of Morozov's previous writing[2] but if EM is reporting accurately how Haystack is deployed - let alone used - then even laying aside Kerckhoffs' principle / the

Re: Merkle Signature Scheme is the most secure signature scheme possible for general-purpose use

2010-09-03 Thread Ben Laurie
On 01/09/2010 22:45, Zooko O'Whielacronx wrote: > On Wed, Sep 1, 2010 at 2:55 PM, Ben Laurie wrote: >> Or, to put it another way, in order to show that a Merkle signature is >> at least as good as any other, then you'll first have to show that an >> iterated hash is at least as secure as a non-ite