# Tagged Questions

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key ...

481 views

### Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
189 views

### Verbatim of early work on public-key cryptography?

In late 1997, the history of public-key cryptography was turned around with the announcement by the CESG (April 2000 archive) that public-key cryptography was theorized in a 1970 note [1] by James ...
59 views

### Using a single Ed25519 key for encryption and signature

The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
283 views

### Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
51 views

### How should I implement a secure recovery of encryption?

I want to create a system to host as securely as possible encrypted data in a way that not even the system can know the content of the data, but that it could be recovered. I would like to know how ...
200 views

### Ring Signature - paper/code difference in trying to solve inverse trap door function?

there is a paper on ring signatures and a python implementation of it here. The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
40 views

### In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
37 views

### Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
80 views

### How did G.H. Hardy's work contribute to today's public-key cryptography?

I know that Hardy's work in number theory was used by Clifford Cocks in 1973 to develop the basis for public-key cryptography. What specifically was this work, and how is it used today in ...
168 views

### Security implications of public nonce

I'm planning to use the crypto_box() functions of Nacl (or, alternatively, the crypto_box_easy() functions of libsodium) to ...
152 views

### Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem to ...
430 views

### RSA reencryption scheme

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user? Basically, such an algorithm would probably be ...
38 views

### How does Bluetooth pairing (SSP with numeric comparison) work?

I have a question concerning the pairing of two Bluetooth devices using Simple Secure Pairing with numeric comparison. The NIST document I am looking at states on page 14: Numeric Comparison was ...
34 views

### Some confusions about Repeated Doubling Algorithm?

The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93. Clearly, this algorithm is ...
70 views

### MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
45 views

### How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
39 views

### David Chaum's anonymous credential

I am a newbie in cryptography (I know the basic RSA, AES stuffs) and am interested in anonymous authentication systems. Looks like David Chaum is the godly figure in the field. I see lots of people ...
66 views

104 views

### How can I make a message into a blocks for NTRU?

I have more bits than the degree of the NTRU polynomial. For example: $x^{11}-1$ message: Hello (I am using ascii, 8 bits for 1 symbol) got: ...
126 views

### Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
230 views

### Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
99 views

### Prevent/minimize replay attacks in public message board

Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
683 views

### Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
69 views

### Feasible attacks on ECRSA cryptosystem

In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows: n = ...
25 views

### To utilize asymmetric cryptography in symmetric manner - demand-of-security-definition?

Cryptography can largely be divided into two classes: asymmetric and symmetric. Like homomorphic encryption now greatly restricted in the asymmetric cryptography, the difference of asymmetric and ...
39 views

### Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...
135 views

### Simulation-Based Proof: When a Secret Key is Involved

Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key. We want to construct a simulator for this party (so this party ...
49 views

120 views

### Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
73 views

### RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one block,...
69 views

### Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
55 views

### How to securely map an element from an smaller domain to the other element in a large domain

Problem: I have a small sized domain, say s-bit. It's clear that the probability for an adversary to guess an element is $\frac{1}{2^s}$. I need to make the probability negligible. However, I need to ...
31 views

### Any ideas on login using Digital Signature PKCS

I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction?
64 views

### Obliviously computing the Least common multiple of two poylnomials

Consider I have two polynomials $f_1$ and $f_2$ of the same degree. I want to secure them (using any kind of encryption except FHE) and outsource them to an untrusted server. I want him to compute the ...
118 views

### RSA OAEP: prevention of partial decryption of ciphertexts

I'm trying to understand RSA encryption (as a beginner in cryptography). go on this wiki page http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding scroll down to the 2 numbered points: ...
96 views

### Opinion on my idea for storing credit cards securely

I've been thinking of ways to store credit cards securely, I thought of this: Take the users credit card info Put the card info in a standard format "Full Name/Card Num/Security Num/Expiry Date"...
225 views

### Mutual authentication with Public Key and session Key

I am trying to understand two protocols for mutual authentication and if they are secure or not. $K$ is the session key, and it's calculated $k=H(TimeStamp)$. Are the following both cases secure? ...
### 1-1 trapdoor function mapping the set of $n$-bit numbers to themselves
I am looking for a trapdoor one-to-one function $f : \{0,1\}^n \rightarrow \{0,1\}^n$ (that is, mapping the set of $n$ bit numbers 1-1 onto itself [any $n$ is OK]). I was considering the use of ...