1
vote
0answers
1 view

Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
4
votes
2answers
160 views

Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain ...
1
vote
1answer
9 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
2
votes
2answers
249 views

How can I map arbitrary group elements to unique integers without using Hash functions?

Let's say, I have a group $G$ of large prime order $p$. A set $S$ consists of $n$ random elements chosen from $G$. Without using a collision resistant hash function $H$, how can I map elements of $G$ ...
5
votes
1answer
189 views

Can machine learning analyze random number generator?

I'm studying for random number generators(RNG) and I saw about machine learning a few days ago. So I searched analysis of RNG using machine learning. But I couldn't find such fields. Are there such ...
2
votes
1answer
15 views

Weakening of Pallier cryptosystem due to ciphertext equivalence and order in CryptDB

Pallier Cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or different ...
3
votes
0answers
22 views

Quantum computing vs AES s-box equation

Do quantum computers have any affect on the ability to solve the non-linear AES s-box algebraic expression, or does solving it still fall under search algorithms (Grover's)? If quantum computer do ...
1
vote
1answer
89 views

Easy explanation of “IND-” security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
0
votes
0answers
17 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
11
votes
3answers
2k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
5
votes
1answer
606 views

Coefficients in Shamir's Secret Sharing Scheme

Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can ...
2
votes
0answers
26 views

Does SHA-1 meet the strict avalanche criterion?

Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ...
1
vote
0answers
19 views

Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
3
votes
1answer
52 views

RSA with $\lambda(n)$ or $\varphi(n)$

The PKCS #1 v2.0 specifications suggest using $\lambda(n) = \mathrm{lcm}(p-1,q-1)$. What is the benefit of choosing $\lambda(n)$ over $\varphi(n) = (p-1)(q-1)$ in RSA key generation?
0
votes
0answers
18 views
1
vote
1answer
37 views

Diffe-Helman Exchange result is always 1

I watched a video on Khan Academy explaining the Diffe-Hellman exchange. When I try to do an example problem, I get 1 all the time. Does the generator and prime modulus (or base on Wikipedia) have to ...
1
vote
2answers
67 views

Inner product with homomorphic encryption

I want to do a very simple thing: Given two vectors, I want to encrypt them and do some calculation, then decrypt the result and get the inner product between both vectors. Can you recommend me ...
1
vote
1answer
21 views

What is the difference between a PRF and a PRF+?

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences. The IKE RFC defines a PRF as: ...
3
votes
2answers
177 views

SHA-256 exhaustive search

How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (togheter with a salt)? Are there any formulas that can be employed? For ...
0
votes
0answers
23 views

SPI security of FE1 scheme

I have a question about security of FE1 in paper "format preserving encryption". Can anyone explain me, why we are allowed to replace PRF with random function in security proof? And also, why $G_0$ is ...
0
votes
1answer
66 views

computational complexity class of decryption of AES

I haven't really seen what computational complexity class of decryption of AES is. Can anyone provide reference papers or answers here?
0
votes
0answers
11 views

Reversing Rotation + XOR

I have this cypher which is as follows : Take 2 numbers : A=1011 and B=1010 if the ith bit of A is 1 then shift B i times to the left. So in the end you will get ...
1
vote
0answers
25 views

Why have round constants in hashes?

This may seem like crypto 101, but why do hash functions like SHA2 and Whirlpool have round constants that are absorbed into their respective states? I can understand that in a cipher you need some ...
-1
votes
0answers
12 views

different feistel words in key size

I have confusion on Feistel word in key size. Means, "what is the meaning of key size with different feistel word ?" What does m=2,3,4 represent.
1
vote
2answers
36 views

How much pre-hashing a password increase security against brute force attack?

I am wondering how much hashing a password used as key for a symmetric key algorithm helps preventing brute force attack on crypted text. Let's assume I want to crypt text A using key B using ...
0
votes
1answer
57 views

Which is the most secure steganography technique? [on hold]

Just like we have AES in crypotography, which is the most secure technique in Steganography? I am looking for a technique in which the standard image characteristic modifications it does go ...
0
votes
2answers
67 views

What are the advantages of using OFB (Output Feedback Mode)? [on hold]

I have a problem with OFB mode, because I have heard that it is stronger than CFB.
2
votes
1answer
16 views

Could a crypto system that uses non-FIPS crypto but then upgrades complete to FIPS be FIPS certified?

I know most people around here (including myself) are anti-FIPS, but I have a FIPS related question. Could a crypto system that is not FIPS, e.g. one based on primitives like Curve25519, achieve FIPS ...
1
vote
1answer
44 views

Calculating Multiplicative Inverse for Rijndael S-box using EEA

I am currently learning, and I'm stuck on something that I thought is very simple. On many academic sources they suggest using Extended Euclidean Algorithm to calculate the multiplicative inverse for ...
1
vote
2answers
85 views

Secure symmetric encryption algorithm for any-size base62 data

I am searching for a secure algorithm to encrypt base62 (or any other base) data for ids in urls. It should feature: No blocksize etc, limiting the length of the message to a factor of n If you ...
1
vote
1answer
41 views

What is the complexity for attacking 3DES in linear or differential cryptanalysis?

I know that 3DES is NOT vulnerable to DC , LC . But is it because the attacks requires too many input\output pairs ? Or because it's impossible ? (i.e requires more than 2^64 pair )
3
votes
2answers
49 views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
2
votes
1answer
42 views

Can I reduce the MAC size in TLS?

The MAC size is reduced to 80 bits in truncated_hmac extension , which says "forging of MAC values cannot be done off-line: in TLS, a single failed MAC guess will cause the immediate termination of ...
2
votes
1answer
24 views

Software interface for KDF and PBKDF?

I'm working on an implementation of Krawczyk and Eronen HKDF from RFC 5869. From Krawczyk's original paper, he identifies four inputs to a KDF in Cryptographic Extraction and Key Derivation: The HKDF ...
2
votes
1answer
69 views

Differential Privacy and appropriate noise distribution

In differential privacy solutions and more specifically for queries that they do entail counting the proposed solutions define the Laplace distribution that is best calibrated for low error. Other ...
1
vote
1answer
205 views

How to prove Security of Onion Layers of encryption?

CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels ...
0
votes
1answer
61 views

In what cases will RSA not work? [duplicate]

I know that there are cases when RSA will not work like when the number to feed into the system is greater than the modulus. I was wondering if there were any other cases when RSA won't work I looked ...
4
votes
0answers
88 views

Is there any practical attack to create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
0
votes
1answer
52 views

Standards to be a good cipher [on hold]

I'm not sure I even understand this site, but based on what I see, how can one tell if a cipher is a good one-at what level is it considered good?
8
votes
6answers
280 views

Mutual verification of shared secret

Is it possible to develop a scheme where two parties, unsure if they have the same secret, can verify that the other does or does not share the same secret, without one party being able to cheat and ...
0
votes
1answer
160 views

Problem with testing MD5 collisions

I am trying to test MD5 collisions presented in “Collisions for Hash Functions MD4, MD5, HAVA” (PDF) by Xiaoyun Wang, Dengguo Feng, Xuejia Lai, Hongbo Yu; 2004. I wrote a PHP script to test it, but ...
2
votes
0answers
21 views

How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper, which only specifies ...
0
votes
2answers
56 views
0
votes
1answer
49 views

DSA: Authentication and assurance of authorized parties

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private ...
1
vote
1answer
59 views

Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
6
votes
3answers
374 views

1 Billion Bit Encryption?

So, browsing through YouTube, I stumbled on this video interview of John Draper (Captain Crunch), one of the first "hackers". He talks for about 3 minutes (until 27:48) about his home rolled ...
3
votes
0answers
50 views

What is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; yet ...
0
votes
0answers
15 views

Implementations of Adi Shamir's ID Based signature scheme [on hold]

Are there any open source or commercial distributions of Adi Shamir's ID based signature scheme? If yes, could you please point?
2
votes
2answers
81 views

Do all attacks against PKCS1 v1.5 encryption require an oracle

As far as I know, all attacks against RSA PKCS1 v1.5 require an oracle; is that true? Or are there any other attacks against it which are able to break it without an oracle? Background: I need to ...
0
votes
1answer
71 views

Working on subgroup of $\mathbb{Z}^*_p$ in practice

It is said that, given a group $\mathbb{Z}^*_p$, we can always have a subgroup whose order is prime. To this end, for a safe prime $p=2q+1$, compute $x_i^2 \bmod p$ for all $x_i \in \mathbb{Z}^*_p$. ...

15 30 50 per page