1
vote
1answer
6 views

Finding Linear Redundancy by counting the number of distinct frequency distributions of absolute walsh transform

I am writing a program to find linear redundancy in 4x4 s boxes. Is the number of distinct frequency distributions of absolute walsh transform a direct measure of linear redundancy in s boxes? byte[] ...
0
votes
0answers
2 views

Security model scalar multiplication in NaCl

I'm having trouble understanding what the “security model” for “scalar multiplication” in NaCl is. Security model crypto_scalarmult is designed to be ...
0
votes
1answer
35 views

Can a low density subset sum problem be intractable?

Hardness of a subset sum problem depends on it's density. Is it possible for a subset sum problem to be intractable even if it's density is less than 0.9408?
7
votes
2answers
372 views

Is calculating HMAC from hashed input a good idea?

The original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)?...
2
votes
1answer
19 views

Proof that LFSR (with XOR feedback and nonzero seed) will never hit state of all 0s

Does anyone know a good proof that a LFSR (with XOR feedback and seeded with non-zero starting state) will never enter zero state? It is obvious that a zero state will always get stuck in a zero ...
0
votes
0answers
8 views

XOF/derivation as OTP

Probably a stupid question but I haven't seen it asked before... What would be wrong with expanding a key to the length of a given plaintext (using Shake or scrypt) and using that as a OTP on the ...
3
votes
0answers
233 views

Zero-knowledge proof for subset sum problem?

What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem? The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift ...
2
votes
1answer
32 views

What are I2OSP & OS2IP in RSA-PSS verification?

I started working with RSA two weeks ago. But I coudn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algo. I am ...
0
votes
0answers
7 views

FIPS 186-4 seems to have an excessively complex q generation

So in DSA you have two primes - p and q. q is N bits long (let's assume 160 bits) and p is L bits long (let's assume 1024 bits). Here's what FIPS 186-4 says about generating the q parameter for DSA: ...
8
votes
2answers
200 views

Security of a self-decrypting block-cipher?

If I have a block-cipher like for example AES, a plaintext $x$, we use different function to encrypt and decrypt : $\text{encrypt}(x) = y$ , $\text{decrypt}(y)=x$. Now, if we build a function with a ...
2
votes
1answer
124 views

Authentication protocol which detects client impersonation from another machine

Consider following authentication protocol. Client ClientA knows some initial secret KeyA shared with server. Client also knows IP of legitimate server. Now when client wants to establish connection ...
0
votes
0answers
6 views

The length of the shortest vector in Lattice

In Micciancio and Regev's paper "Lattice-based Cryptography",the length of the shortest vector is at least min{q, 2^{2*squart(nlog_qlog_(dert))}} . I want to ask why the paper chose the latter as the ...
1
vote
2answers
116 views

Detecting encryption in real-time?

Is there anyway to detect encryption in real-time through a common signature or pattern recognition. Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can ...
0
votes
0answers
6 views

Store and share data on web server

I'm developing an intranet for a company where admins are sharing a huge excel file containing all the necessary password, on the common TSE. I've managed making them encrypt it with a common password ...
8
votes
1answer
619 views

What exactly is a “garbled circuit”?

There are plenty of questions here about the details and how-to's of "garbled circuits", but I have not seen anything that defines what garbled circuits are. What exactly is a garbled circuit? What ...
6
votes
2answers
148 views

RSA: revealing the modulus factorization by choosing a bad message

I started reading the book Cryptanalysis of RSA and its variants by M. Jason Hinek and I stumbled upon a phrase that intrigued me: plaintext messages that are relatively prime to the modulus (i....
2
votes
1answer
322 views

Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
0
votes
0answers
27 views

How can I find all points on an elliptic curve?

I have an elliptic curve $$y^2=x^3 + 8 \times x + 6 \mod 13$$ How do I find all the points on this EC? Also, could you give me more examples?
3
votes
2answers
120 views

Bit level permutation

Could anyone explain how secure is bit level permutation? What is the most serious threat against the security of this kind of cipher?
3
votes
1answer
238 views

Key exchange using ECDH vs ECIES?

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
2
votes
1answer
527 views

Building a cryptography system by combining a block cipher and a stream cipher?

I have to come up with a design for a cryptography system by combining a block cipher and a stream cipher. I can't seem to come up with anything on my own. Can someone point me in the right direction ...
-1
votes
0answers
39 views

Garbled table for 3 inputs

I have a truth table of a full adder with 3 inputs (A,B,Cin) and 2 outputs (S, Cout). How can I create a garbled truth table? I mean, in the general form it is ...
4
votes
1answer
245 views

what are the NTRU keysize and application in industry?

I'm a student currently working on a research project on the NTRU cryptosystem, I've read some papers about this cryptosystem, and in those papers they are talking about keysize, is it the size of the ...
1
vote
1answer
106 views

pairing parameters in PBC library

I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used. I noticed that we can give any file in the param subdirectory. Is ...
2
votes
0answers
69 views

Ciphertext size of any CPA-secure public-key encryption scheme

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ...
4
votes
2answers
117 views

Is pseudorandom function also a one-way function?

Can I assume this? Specifically, I want to know if the following two cases are valid. Suppose $prf_k(m)=c$ One-wayness: Only given $c$, we cannot reveal $m$. Without key $k$, even given $m$, cannot ...
-1
votes
0answers
44 views

Existence of a random function under constraints

Let $F_1$ and $F_2$ be two random functions taking as input $N$ bits and returning $N$ bits. Let $C_1$ and $C_2$ two constants of $N$ bits. Is there a random function $P$ taking as input $2N$ bits ...
4
votes
1answer
853 views

What characters are valid in PGP encrypted and signed messages?

What characters may be present in a PGP encrypted message or a PGP signature? For example, do encrypted messages only use the Roman alphabet + some numbers and symbols? Can the character set be ...
2
votes
2answers
484 views

Triple-DES DUKPT CBC PIN variant vs Data variant

Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ...
4
votes
2answers
90 views

One-way function definition

I cannot understand why a one-way function $f$ is defined in this way $\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$ and not $\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$ where $A$ is a ...
1
vote
1answer
84 views

How to encrypt a vector $e\in Z^{m}$ using LWE

I have a vector $e \in Z^{m}$, now I want to encrypt it by using LWE (Learning With Errors). Because in LWE, we have to encrypt of a bit $\{0,1\}$. How can I encrypt a vector $e \in Z^{m}$?
2
votes
1answer
135 views

AES with different modulo operations?

I don't get the modulo 10001 operation in MixColumns so much. If I have to take the byte computations mod 100011011 anyway ...
2
votes
1answer
131 views

Size of a MAC for a quickly checked message?

Let suppose that we have to check a message that was written one second ago. The message is discarded immediately after having being checked. What "minimal" size for such a MAC is secure?
1
vote
1answer
286 views

Encryption schemes and pseudorandom permutations

Can an encryption scheme (deterministic or not) be viewed as a pseudorandom permutation taking as input a message and returning a value of the same bit-encoding length?
4
votes
3answers
1k views

Complexity of arithmetic in a finite field?

I am wondering what the complexities are of adding/subtracting and muliplying/dividing numbers in a finite field $\mathbb{F}_q$. I need it to understand an article I am reading.
3
votes
1answer
794 views

Linear Feedback Shift Register Taps

Linear feedback shift register tap charts are availale for registers of length 3 to 168. Does anyone have a chart for register lengths from 168 to 256 or beyond?
6
votes
1answer
115 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
2
votes
1answer
199 views

Requirement for the length of a HMAC tag?

I've seen NIST requirements about key length. What about the output lengths ? Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ?
1
vote
1answer
230 views

Why Merkle Tree doesn't suffer Birthday attack?

I am trying to understand why Merkle Tree doesn't suffer the birthday attack? Can you help me?
1
vote
1answer
86 views

Username and Password: How does it work?

Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number $r_a$. Bob sends Server Hello with another random number $r_b$. Suppose they ...
25
votes
1answer
32k views

How does RSA signature verification work?

I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ...
1
vote
1answer
170 views

What could be the problem with this TLS 1.2 Client Finished Message approach?

Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong. First ...
0
votes
0answers
178 views

TLS 1.2 finished message stucture [duplicate]

I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, ...
5
votes
1answer
743 views

What methods allow us to determine the language used in a monoalphabetic substitution cipher?

Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ...
2
votes
1answer
223 views

Is any specific packet cipher mode to be prefered for use with – for example – UDP?

Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order ...
5
votes
1answer
110 views
+50

Applying machine learning algorithms to homomorphic encrypted data

I have a basic understanding of encryption and I got back to the topic because of an interesting site that encrypts financial data using homomorphic encryption (HE) and I would be happy for any input ...
2
votes
1answer
29 views

Client side encryption / hashing of “person ID's” with password?

What we're looking for A solution where data is stored and retrieved (!) from a server using a person ID that can only be known at the client (form of ...
1
vote
2answers
37 views

Secure logical AND using Ishai-Sahai-Wagner Scheme

I want to try to implement a secure AND the way it was described here: https://eprint.iacr.org/2010/441.pdf It says that there are two bits a and b and that they have been split into d+1 shares. How ...
0
votes
1answer
33 views

IND-CCA Security of a encryption scheme which is combination of two schemes

I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\...
3
votes
1answer
84 views
+100

Is security against semi honest adversary inheritable?

I have a two party protocol, let's call it $M$. At some point, there are $k$ steps, each one involving an oblivious transfer protocol, which is known to be secure against semi honest adversaries. ...

15 30 50 per page