# Tagged Questions

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm.

52 views

### Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

I was just going over my (old) notes from Coursera's Cryptography I course, and I was puzzled by the description of SIV as providing deterministic authenticated encryption (DAE). The general SIV ...
73 views

### Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
128 views

### What is Deterministic Authenticated Encryption?

I came across something known as deterministic authenticated encryption in my studies and a lot of people were associating it with Synthetic IV mode. I am having trouble what exactly DAE is because I ...
29 views

### Does SIV mode work for asymmetric crypto?

In ECIES and similar schemes, is it possible to use a hash of the plaintext as the IV?
109 views

### Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
130 views

### What is the meaning of probabilistic encryption algorithm?

I am learning cryptography by myself and I am not able to understand the meaning of probabilistic encryption algorithms. How is it different from deterministic encryption algorithms ? How can the ...
103 views

### Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
68 views

### Weakening of Pallier cryptosystem due to ciphertext equivalence and order in CryptDB

Pallier Cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or different ...
175 views

### Generating PGP key *without* random generator? (using fixed input only)

I understand why in general, a strong random generator or source of entropy is used when generating PGP keys. However, I have a use case where I want to generate PGP keys deterministically, i.e. ...
366 views

### CPA security of a stateless and deterministic encryption system

Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it?
145 views

### Is this a valid “fix” for deterministic encryption in encrypted databases?

It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
289 views

### (Re-)Using deterministic IV in CTR mode / How to: deterministic AES

I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. ...
2k views

### PRNG determinism (and java.security.SecureRandom)

Looking at getDefaultPRNG() in java.security.SecureRandom makes me very unsure about how to use it. On my desktop, it uses sun.security.provider.NativePRNG, which reads from ...
110 views

### request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
101 views

### Is a tweakable block cipher still considered deterministic in nature?

"a block cipher is a deterministic algorithm operating on fixed-length groups of bits, called blocks, with an unvarying transformation that is specified by a symmetric key. - Wikipedia " But with a ...
347 views

### Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
263 views

### Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , \$...
259 views

### Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
222 views

### Public-Key Deterministic Encryption : Why does not provide perfect security?

I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon . Any ...
368 views

### Is this method of deterministically using CBC secure?

I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ...