0
votes
2answers
20 views

Why does a non-prime DH modulus creates a “NOBUS” backdoor

can't we do a nobus backdoor with DH modulus prime? Some have argued that with a prime modulus you can just get the order by doing p-1 and then factor it, thus it is easy to reverse. I argue that this ...
3
votes
0answers
26 views

How do substution-permutation networks work?

I understand what is going on in higher level. But I don't understand what's really going on in page 3 and 4 of this slide. Specifically, How $S_0$ and $S_1$ is used? What goes in what goes out? ...
-4
votes
4answers
75 views

How to break Universal Re-Encryption algorithm?

Let p be a prime, and g be an element of $ℤ^*p$ of prime order q. Let x ∈ ℤq be the private key, and $h = g^x$ (mod p) be the public key. To encrypt a message m ∈ $ℤ^*p$, pick two random ...
1
vote
0answers
42 views

How to prove that a function F isn't a pseudo random function

Let $F$ be a length-preserving pseudorandom function. For the following constructions of a keyed function $F' : \{0, 1\}^n \times \{0, 1\}^{n−1} \to \{0, 1\}^{2n}$, state whether $F'$ is a ...
2
votes
2answers
84 views

HW acceleration for Camellia cipher (x86_64/AES-NI/AVX2)

Modern processors support hardware acceleration for various crypto functions such as AES directly, or general vector operations which can be used in crypto ...
3
votes
1answer
27 views

Does Coppersmith's method always finds non-trivial factor of integers of the form $n=a(2^k b+1)$ assuming $1 < a<2^k b +1$ and $b < n^{1/4-0.05}$?

Crossposted from mathoverflow. Got an argument and numeric evidence that pari's implementation of Coppersmith's method finds non trivial factor of integers of certain form under some assumptions very ...
1
vote
1answer
23 views

ECDH-ECDSA Combination

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties ...
7
votes
3answers
1k views

HRNG for One Time Pad

I have just advanced to the last grade of high school (in Denmark). In this year, we all get to do one big project, where we can build/invent/create whatever we want to "solve a problem". As I study ...
-1
votes
0answers
17 views

Encryption of Real Time UDP packet [on hold]

Hi friends i am very new to cryptography. I am planning to work on real time UDP packet encryption. I have a server which generates fixed size UDP packets at every 200ms and this message is sent to ...
0
votes
0answers
15 views

rsa block cipher -incomplet block size

i have a question about an RSA academic example. if we are using block-rsa with a block-size of 3 and we have this message "android" .it's contain 'and' 'roi' 'd' how to encrypt the last character ...
1
vote
1answer
46 views

Common Modulus Attack not reproducible

I want to calculate a simple example of the RSA common modulus attack. However, the result is not correct and I do not find my mistake. p=$29, q=37, n=p*q = 1073, \phi(n) = 1008, e1 = 5, e2 = 11$ ...
3
votes
1answer
45 views

How to convert AES to a PRNG in order to run NIST Statistical Test Suite?

I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although ...
1
vote
1answer
19 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : y^2=x^3 + x + 1 Generator:(1,7) p=23 Result in Affine use excel: P=(1,7), Q=(7,11) => P+Q=(18,20) Result in Projective use exccel: P=(1:7:1), Q=(7:11:1) => P+Q=(15:2:9) U = U1 - U2 ...
1
vote
2answers
62 views

Secure randomized data matching?

This might be a dumb question but I will go for it. Let's say we have a data set $D$ consisting of sensitive data, and we want to be able to match if a new piece of data $S$ already exists in $D$ ...
-1
votes
0answers
19 views

How do I solve this transposition cipher? [on hold]

(88 characters): ANNHA MSUIM HDSHP CEVVA LEOVE PAERS ADYSC TNLIE LIIET PTSRO CNAFM GONCO NMAMO RLEIT MSNSY LFOOI SASEO RGA. -- My introductory cryptography instructor assigned this, I calculated the ...
9
votes
2answers
9k views

What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
6
votes
1answer
140 views

Why was the Navajo code not broken by the Japanese in WWII?

In reading about this topic recently, to my understanding, the encryption schemes used on top of the Navajo language were very simple and definitely could have been broken (my research shows they ...
3
votes
2answers
45 views

How to generate a random number so server cannot cheat?

Here is the protocol: Bunch of players connected to server. Server creates nonce and hashes it - send hash to clients as bit commitment. Clients make nonces and send hashes to server as their bit ...
35
votes
7answers
28k views

Are there two known strings which have the same MD5 hash value?

Is there an example of two known strings which have the same MD5 hash value (representing a so-called "MD5 collision")?
10
votes
2answers
3k views

How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
8
votes
2answers
404 views

How to do a literature search

How do I do a literature search of the research literature on cryptography? Assume there's some topic in cryptography I'd like to learn more about; how do I search the cryptographic research ...
166
votes
10answers
39k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
5
votes
1answer
49 views

Performing simple arithmetic operations on compressed, and both compressed and encrypted data

We all know it is possible to perform addition and multiplication operations on encrypted data by means of homomorphic encryption methods. My questions are: Is there any cryptosystem that is able to ...
6
votes
1answer
71 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
-1
votes
0answers
10 views

Use precomputed value (ECPoint,int) in Java BouncyCastle [migrated]

I am working with window-method multiplication in affine coordinates. Window Method ...
-1
votes
0answers
17 views

Would the rotors in Enigma machines always advance by one position? Or was there a way to set this?

Before encrypting a letter the first rotor advances by one, right? So there could be a way, once the first rotor turns 26 times, make the second rotor advance two positions instead of one. Or three. ...
3
votes
2answers
50 views

Why Generate Keys are inside game

I am studying reductions to prove security of crypto systems. Generally are used "games" for the proves. For example, the next image is extracted from the page 91 of the book Postquantum Cryptography. ...
4
votes
1answer
48 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
0
votes
1answer
63 views

Homomorphic Encryption with Addition and Exponentiation

Is there any homomorphic encryption scheme which supports addition and power over cipher text ? Paillier is close but it supports addition and multiplication with a constant. I am getting an output ...
0
votes
1answer
29 views

Can OTP be made practical by using stretched hash algorithms? [duplicate]

One of the main reasons for not using OTP in everydays life is that it is highly impractical - for encrypting 4GB of files we need a 4GB key that needs to be exchanged secure. I've had an idea on how ...
3
votes
2answers
116 views

What is the difference between SHA-3(Keccak) and previous generation SHA algorithms?

SHA-1 and SHA-2 share the same structure and mathematical operation as their predecessors - SHA-0 and MD5. Both SHA-0 and MD5 have been broken. This is one of the main reasons why SHA-1 is considered ...
0
votes
2answers
133 views

How to show something is not a one-way function?

Lets say that $f:\{0,1\}^* \to \{0,1\}^*$ is a strong one way function. Let $h(x)=f(x)||x_n$ where $x_n$ is the $n$th bit of $x$. I understand that $h$ will not be a strong one-way function. However, ...
1
vote
1answer
40 views

“Royal Flags Wave Kings Above” [on hold]

I'm a starter to cryptanalysis and in fact to cryptology. Last night I was decrypting a message from a book that I would quite odd. It doesn't make sense. The decrypted message is "Royal Flags Waves ...
0
votes
0answers
27 views

construction of division polynomials

I'm not sure if this is the right place for my question.... I'm trying to understand the construction of the division polynomials used in the schoof algorithm. I firstly followed the report of ...
1
vote
0answers
21 views

Faster discrete Gaussian sampling

Our goal is find a faster discrete Gaussian sampling to solve $"SVP"$ problem in lattice: A lattice is discrete subgroup of $R^n$ such that define as below: let $\{b_1,\cdots ,b_n\}$ be a basis in ...
3
votes
1answer
19 views

Merkle tree (dm-verity) with SHA-256 vs. SHA-1

Is there any knowledge or research on the use of different hash functions within a Merkle tree? My use case is file integrity protection. I am thinking about using different hash functions due to ...
3
votes
1answer
20 views

Deriving a key for HMAC, using PBKDF2

What is the recommended way to derive a key for an HMAC-SHA256, from a passphrase and salt? I'd like to compute an HMAC-SHA256. I have a passphrase, and a message. I note that RFC-7518 (JWA) ...
4
votes
1answer
96 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
12
votes
1answer
826 views

How does a non-prime modulus for Diffie-Hellman allow for a backdoor?

Recently someone found that a Diffie-Hellman modulus used in a unix tool (socat) was not prime. This led some people to shout "backdoor". What I don't understand ...
1
vote
2answers
33 views

NIST HMAC Test vectors

I am searching test vectors of the HMAC-SHA256 primitive to verify the correctness of an implementation. Without hesitation I go on the NIST website to see what they offer. While reading the ...
1
vote
1answer
16 views

Is this the correct procedure for cycle walking using an FPE?

To encrypt a value from a set (say a range of years from 1001 to 2001) Rank the set {0 = 1001, 1 = 1002, 2 = 1003...999 = 2001} Take the value you want to encrypt from the set (year = 1995) and ...
-2
votes
0answers
15 views

OCB(Offset Code Book) authentication encryption [on hold]

Can anyone give me ideas, how to implement Offset Code Book with authentication and encryption.
3
votes
1answer
99 views

How to determine if padding has been used while encrypting a message with RSA?

I am trying to decrypt a RSA encrypted text file. I have a 2048 bit public key. Analyzing the public key with openssl reveals the exponent used is 3. ...
4
votes
2answers
92 views

Classification of a stream cipher

How would one classify a stream cipher that is neither synchronous, nor self synchronizing? I would have thought asynchronous, but from all the sources I can find, asynchronous is synonymous with ...
1
vote
1answer
40 views

Find the minimum Adversary's Advantage

I am wondering how to solve the problem below: Suppose we have a $MAC$ scheme $I=(S,V)$. There is another algorithm that can find a pair of texts $(m0,m1)$, with $m0≠m1$ such that $S(k,m0)=S(k,m1)$ ...
3
votes
1answer
69 views

How does RIPEMD160 pad the message?

For RIPEMD hashing algorithm on hardware I am not exactly getting how padding works So as per my understanding padding will work like explained below: For ripemd 160 message should be multiple of ...
9
votes
2answers
4k views

Can you explain “weak keys” for DES?

A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$. I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
1
vote
3answers
91 views

Algorithms for Cyrillic encryption

I am working on a cryptography application which is to be used in my country. I tried looking up to see if there are any algorithms that support the Cyrillic alphabet, but I found none. Do you know of ...
1
vote
0answers
32 views

Data integrity using steganographic methods

I am looking for a lightweight and fast (almost real time) data integrity checker for a very time critical application. Is it possible to provide data integrity using a steganographic method, lets say ...
3
votes
2answers
51 views

Are there any practical methods of steganography?

There isn't a whole lot of information on steganography in the modern age, from what I can tell. A google search for steganography usually brings up a list of very impractical methods (e.g. tattooing ...

15 30 50 per page