A reference request is a request to be provided with (links to) documentation, official papers, and specs related to one or more specific algorithms or cryptographic procedures, to provide a trusted base for what's being said or written.

learn more… | top users | synonyms

1
vote
0answers
21 views

What is the technical name for a public key container in DER format?

I have a public key in the following (format-neutral; the type is specified by the DER bytes) format: ...
1
vote
1answer
48 views

Feistel cipher vs Substitution-permutation network - number of rounds

So I have been doing for the last couple of days comparison between Feistel cipher and Substitution-permutation network. Now I can say I know a lot about them and their similarities and differences ...
2
votes
2answers
57 views

SHA512withRSA - Looking for details about the Signature Algorithm

I am trying to find information about the Signature Algorithm SHA512withRSA and have been unsuccessful so far. In the current state, the signature is too long, so I would like to check the code for ...
2
votes
0answers
85 views

“Practical” operations supported by functional encryption?

I'm curious about what operations have been developed into functional encryption schemes. What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic ...
3
votes
2answers
419 views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two eliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
3
votes
1answer
93 views

Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?

Which public key encryption scheme is re-randomizable? Is there any library for re-randomizable encryption scheme? If not, how can I re-randomize a given public key encryption scheme? I cannot find ...
3
votes
1answer
43 views

Implementing the Mceliece Encryption - making the Generator Matrix

I am working on an implementation of the Mceliece Encryption system (MCE) and the Niederreiter encryption system. I have been through the basics of finite fields, polynomial arithmetic and some coding ...
1
vote
1answer
45 views

EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...
0
votes
0answers
73 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
-1
votes
1answer
86 views

What's the best packet cipher mode for use with UDP for example? Advantages or disadvantages of any alternatives?

Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order ...
1
vote
0answers
40 views

IND-CCA2 secure schemes without Plaintext Awareness?

I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
5
votes
2answers
1k views

Does SHA-1024 hash exist?

Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that? Links: SHA-2 at Wikipedia
3
votes
1answer
188 views

Simple proof that shows AES is not a uniform permutation on any n-bit string?

Is there a simple proof that shows AES is not a uniform permutation on any $n$-bit string? Since I'm just starting with crypto, I'd like to see a simple yet elegant proof for the said property. ...
2
votes
1answer
65 views

Construct block cipher from a smaller one with mixing function

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The key component is the ...
1
vote
2answers
162 views

How to encrypt a file for random access

I am a programmer familiar with C/C++ and Python. Lately, we got an assignment from a team asking us to work on one of their projects: we need to make a small program to encrypt a large file using ...
3
votes
2answers
80 views

Hash or compression function in Merkle tree nodes?

Wikipedia says about a Merkle tree: Nodes further up in the tree are the hashes of their respective children. Usually, a cryptographic hash function such as SHA-2 or SHA-3 is used for the hashing. ...
3
votes
2answers
187 views

Security issues of a MAC-then-Encrypt-then-MAC approach?

Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ...
3
votes
2answers
90 views

Combining two keys

What is the most secure way to combine two "random" keys X of size k (k ≤ 512 bits) and Y of size 512 bits in one key Z of size k? Result Z will be used for encryption/decryption with various ...
1
vote
0answers
80 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
3
votes
0answers
108 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
2
votes
0answers
64 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
1
vote
1answer
61 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that ( length($p$) == length($q$) )$\implies$ gcd$(pq,(p-1(q-1)))$=1 where length($k$) = # bits in ...
2
votes
0answers
39 views

Malicious KGC attack in the identity-based authenticated key exchange protocol

There are two users $A$ and $B$ who are in different domain. Let's assume that $A\in KGC_1$ and $B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ...
5
votes
1answer
249 views

Adi Shamir's secret database of all primes

I was going through these presentation slides (PDF) on Crypto 2013. It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild. In the last slide, it was ...
1
vote
0answers
87 views

Public and Private key encryption in simple math

Can anybody show me (or point me to resource) how to generate public key and private key with simple math? Steps which can be reproduced in a simple calculator – so the message, keys all can be ...
3
votes
1answer
83 views

Client authentication on limited hardware

I'm developing a authentication and authorization protocol for a Bluetooth device. The device should communicate with an Android app and needs to be able to authenticate the app during the connection ...
4
votes
3answers
115 views

Encrypting text file line by line with stable encryption

I want to store files in a secure manner (i.e. no one should be able to decrypt the contents of the file without the secret key) but I also want a diff tool to be able to show me which lines changed ...
3
votes
2answers
273 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
2
votes
1answer
58 views

LFSR Output Sampling for Berlekamp-Massey

Looking at the use of Linear Feedback Shift Registers in cryptographic algorithms, I have learned that the Berlekamp-Massey algorithm can be used to find the (shortest) LFSR that generates a given ...
3
votes
1answer
110 views

What is the quantum-resistant signature scheme with the smallest signature + pubkey?

After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant ...
2
votes
1answer
55 views

Is there a deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed?

I was just wondering, is there a type of deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed? I have pairs of random numbers and need to ...
3
votes
1answer
146 views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
1
vote
1answer
113 views

Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA-256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the number of bits in $W(i)$ keep ...
2
votes
0answers
153 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
4
votes
3answers
225 views

Can I create a fixed length output from a fixed length input?

I use AES256 for various purposes in my app. However, the purpose I am now trying to achieve is the following: Input is for example AU00000001 and I would like a ...
-1
votes
1answer
56 views

Theory for pre-paid debit card: card-to-card transfer [closed]

In Sweden in the late 90's they deployed a electronic prepaid cash system system, and if I remember correctly you could transfer money between cards without online access. Wikipedia states that the ...
2
votes
2answers
88 views

One Time Pad for large changing files

i wondered what the security implications are if I do the following. If I had a large file encrypted with a OTP and want to change only a few bytes in the plaintext. what security vulnerabilities do I ...
1
vote
0answers
64 views

Bilinear pairing

I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are point doubling and line function computation point addition ...
4
votes
2answers
243 views

Update to “Cryptographic Right Answers”

I'm a big fan of Colin Percival's "Cryptographic Right Answers" post. This was written in 2009, which is a long time ago in Internet years. Is the advice still valid or, if not, can someone point me ...
1
vote
0answers
66 views

Blowfish vs. Twofish regarding power consumption

If I wanted to use Blowfish or Twofish to provide security on a device where power consumption is crucial. Regarding power consumption, which one would win? Generally, which algorithms are known to ...
1
vote
0answers
78 views

Looking for crypto with derived keys?

I am looking for cryptographic algorithm or combination of them. Basically I need an algorithm, which can generate private key and for this key can be computed multiple keys based on some seed. So a ...
1
vote
2answers
104 views

How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption?

I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$ ...
3
votes
1answer
105 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
1
vote
0answers
41 views

P10 to P8 in S-DES

I am new to cryptography. During my learning I am facing a problem with S-DES. I am confused where P10 to P8 come from, and I’m ...
2
votes
1answer
88 views

Is it possible to combine two operations rotation and xor?

I can see many xor and rotation operations in cryptography. I just want to make some algorithms fast. So, I'm looking for a way to combine between xor rotation operations. I don't know if it is ...
2
votes
0answers
42 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
1
vote
0answers
47 views

RSA Key Blinding

I was looking the answer to the following question (Timing attack on modular exponentiation), discussing the Private Key Blinding as a countermeasure for timing attacks. Therefore I'm asking if ...
4
votes
1answer
116 views

Generating unsigned, bounded random value using signed bounded random values

Use case: I have a random number generator that can generate random numbers in a range that is limited by a number $x$, say $x$ ranges from $2$ to $2^{(n - 1)} - 1$ exclusive. In this case $n$ is ...
1
vote
1answer
37 views

Computational Diffie-Hellman problem over the group of quadratic residues

Suppose that $N=pq$ where $p$ and $q$ are safe primes. $\mathbb{QR}_N$ is the group of quadratic residues which is a cyclic group with order $\frac{\phi(N)}{4}$. Let $g$ be the generator of ...
2
votes
1answer
95 views

Computing youngest person among 3 while keeping ages private

I already found a protocol to find out who is richer (older) between two parties, but Is there any protocol to find the youngest person among 3 parties, without revealing actual ages?