1
vote
2answers
90 views

Is multiplicative blinding less secure than additive?

It's easy to see that additive blinding (e.g., $x+r$ for secret x and random r) is perfectly secure in a finite field (this is a one-time-pad) and statistically secure for $r$ uniformly distributed in ...
1
vote
1answer
21 views

How much does using the same $H$ for all messages weaken GCM?

How much is GCM weakened by using the same MAC key $H = E_K(0^*)$ for all messages that use the same key (which is what GCM actually does) instead of using $E_K(N||0_{32})$ (which is different for ...
0
votes
1answer
23 views

Two Bilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $e_1:G_0 \times G_0 \rightarrow G_1$ and $e_2:G_1 \times G_1 \rightarrow G_T$ and use this to encrypt a message $M$ in the form $M ...
1
vote
0answers
10 views

How to prove the security of block ciphers

I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs... In the field of protocols (like authentication) it ...
18
votes
1answer
2k views

Examples of modern, widely used ciphers that suddenly fell?

RC4 and GOST are two major ciphers (defined as being widely used to encrypt large amounts of data) that fell to cryptanalysis (relatively) suddenly. The first becoming totally broken and the second ...
1
vote
0answers
21 views

Which AES encryption do banks use?

I'm trying to find what size keys banks use for symmetric and asymmetric encryption. I know that the symmetric one is smaller because they want it to be fast but I can't find any information on their ...
1
vote
1answer
15 views

Elliptic Curve Cryptography prime order group

If the order of elliptic group is prime then Then every point is a generator of that group. I tested the above statement on some of the same elliptic curves and found it true. Is that really works on ...
0
votes
0answers
10 views

Weil Pairing - Miller's Algorithm

I tried implementing Weil Pairing using Miller's algorithm.I have got couple of questions. How to select m? http://homes.esat.kuleuven.be/~fvercaut/talks/math_pairingI.pdf As stated in the above ...
-1
votes
0answers
17 views

Is 3 rounds more secure than 2 in this simplified DES?

Consider the following simplification of DES: a plaintext message block of $2n$ bits of length is divided into two blocks of length $n$ (left half $L_0$ and right half $L_1$). In other words, the ...
1
vote
1answer
29 views

Is it safe to use fast/small hash for key identity?

I have to roll database access keys often, but it's important to know which key each system is using in order to avoid unavailability. I want the systems to report that without exposing the key ...
0
votes
0answers
13 views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
0
votes
1answer
72 views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
1
vote
1answer
126 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
4
votes
5answers
241 views

To what extent is WhatsApp's statement on secure messaging realistic?

As those of you who use WhatsApp Messenger probably know, with their recent update chats and calls are now encrypted. Here's what WhatsApp claims: Messages you send to this chat and calls are now ...
7
votes
1answer
328 views

Blinding twice in RSA

I understand that if you have a message $m$, you can blind it by selecting a random $r$ and then multiplying $r^e\times m \pmod{n}$ Someone else then signs it with $d$, raising to the power of $d$: ...
0
votes
1answer
12 views

Create composite group for pairing in JPBC

We use bilinear map $S = (G, G_T , e(\cdot, \cdot))$ of composite order $n = s \times n'$ with two subgroups $G_s$ and $G_n'$ of $G$. Random generators $w \in G$, $g \in G_s$, and $φ \in G_n'$ are ...
0
votes
0answers
41 views

Is it safe to encrypt data using XOR along with CSPRNG seeded with a truly random number?

I was wondering a couple of days ago whether I could reverse the normal encryption order to produce a good AES based cipher variant. The method is as follows: Two users, Alice and Bob, each have a ...
7
votes
0answers
138 views
+150

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
5
votes
1answer
42 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
4
votes
2answers
55 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
3
votes
1answer
85 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
0
votes
0answers
9 views

Can anyone tell whether combinational has higher frequency of operation than sequential or vice-versa?

I have designed SHA3 algorithm in 2 ways - combinational and sequential. The sequential design is giving frequency of operation as 700MHz while the combinational one is giving 0.5MHz so i want to ask ...
0
votes
0answers
43 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
1
vote
1answer
161 views

Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
0
votes
1answer
25 views

Partial-Message Collisions on Iterated Hash Functions

In Cryptography Engineering by Ferguson et al it says the following is a problem with iterated hash functions: Because hashing $m$ and $m'$ leads to the same value, $h(m||X) = h(m'||X)$... for all ...
1
vote
1answer
61 views

Why do we use hex output for hash functions?

Why do we use hex representation as default for the output of a hash functions result? For example the sha256 hash function: the output of sha256 in hex representation uses 64 characters, while ...
2
votes
1answer
254 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = ...
0
votes
0answers
32 views

1-out-of-2 OT from Random 1-out-of-2 OT

Last week I came upon this problem in my h.w.: Let $OT^m$ denote 1-out-of-2 oblivious transfer of $m$ bit inputs. Let $RandOT^m$ denote the following primitive: The sender’s input ...
2
votes
3answers
291 views

What is the fastest block cipher in the (Intel) world?

In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than ...
0
votes
1answer
27 views

Homomorphic multiplication by a scalar

Few homomorphic encryption schemes like Paillier , Ring-LWE support homomorphic multiplication operation by a scalar apart from additive homomorphic property. Loosely they could be defined as below ...
3
votes
2answers
45 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
1
vote
1answer
35 views

Can I get successful signature verification with just altering message and signature?

Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I ...
2
votes
1answer
223 views

RSA signatures without padding

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
4
votes
3answers
174 views

Polynomials and efficient computability

In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT. It's clear that adversaries should be at ...
9
votes
2answers
144 views

Is there a way to optimize a linear scan while preserving anonymity?

I've been wrestling with a problem, and I was hoping if someone else had a bright idea. Here's the problem: I have two sides, Alice and Bob. Alice has a single high entropy string $A$, and Bob has a ...
-5
votes
0answers
60 views

Shamir secret sharing and homomorphism [on hold]

Problem: Implement Shamir’s (k, n) Secret Sharing (SSS) scheme, with $k = 3, n = 5$, to (a) Find shares of a given set of numbers. (b) Compute average from shares (c) Choose any ...
4
votes
1answer
64 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
6
votes
2answers
5k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the ...
0
votes
1answer
85 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
0
votes
1answer
50 views

Where is the mistake in my RSA by-hand calculation?

Like several previous askers, I seem to have made a mistake in my RSA calculation, but despite going back over it three times, I cannot spot it. I picked 1000003 and 6000011 as my primes, ...
0
votes
0answers
36 views

Deoxys: disadvantages vs. AES?

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
1
vote
1answer
48 views

Why is DSA falling out of favor?

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely ...
0
votes
1answer
63 views

Ciphers providing Deniable encryption?

I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario: Deniable encryption allows the sender of an encrypted message to deny sending that message. This ...
0
votes
0answers
9 views

Cryptographic key with editing safeguard [on hold]

I need to encrypt a number in a file, say 142345. It encrypts to EfsFjs or something else. I need a method that safeguards ...
0
votes
1answer
31 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
1
vote
0answers
21 views

Determining an encryption key when ciphertext and algorithm are known

I would like to know how I can tell that I have successfully performed an exhaustive search attack on an encrypted message. Here are the conditions: key is 40 bit I am aware of the cipher text and ...
0
votes
0answers
16 views

Is AES-256 bit encryption secure against this kind of attack? [duplicate]

Recently I came across this article. http://www.cs.tau.ac.il/~tromer/acoustic/ Could this put all computers at risk for decryption?
0
votes
0answers
14 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing?

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
0
votes
0answers
54 views

What functional encryption scheme can be used to compute a linear function?

I am looking for a functional encryption scheme that can compute a linear function. I do not need to work with attributes. All I want is to compute the result of a function $y = a*x+b$, where $x$ is ...
4
votes
2answers
615 views

Is this simple PRNG secure?

$G$ is a PRNG used in a stream cipher and defined in the following way: G receives $s_0$ as an input, which is a random string drawn from a uniform distribution. The output of step $i$ is $s_i = ...

15 30 50 per page