All Questions

6 views

Finding Linear Redundancy by counting the number of distinct frequency distributions of absolute walsh transform

I am writing a program to find linear redundancy in 4x4 s boxes. Is the number of distinct frequency distributions of absolute walsh transform a direct measure of linear redundancy in s boxes? byte[] ...
2 views

Security model scalar multiplication in NaCl

I'm having trouble understanding what the “security model” for “scalar multiplication” in NaCl is. Security model crypto_scalarmult is designed to be ...
35 views

Can a low density subset sum problem be intractable?

Hardness of a subset sum problem depends on it's density. Is it possible for a subset sum problem to be intractable even if it's density is less than 0.9408?
372 views

Is calculating HMAC from hashed input a good idea?

The original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)?...
19 views

Proof that LFSR (with XOR feedback and nonzero seed) will never hit state of all 0s

Does anyone know a good proof that a LFSR (with XOR feedback and seeded with non-zero starting state) will never enter zero state? It is obvious that a zero state will always get stuck in a zero ...
8 views

XOF/derivation as OTP

Probably a stupid question but I haven't seen it asked before... What would be wrong with expanding a key to the length of a given plaintext (using Shake or scrypt) and using that as a OTP on the ...
233 views

Zero-knowledge proof for subset sum problem?

What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem? The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift ...
32 views

What are I2OSP & OS2IP in RSA-PSS verification?

I started working with RSA two weeks ago. But I coudn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algo. I am ...
7 views

FIPS 186-4 seems to have an excessively complex q generation

So in DSA you have two primes - p and q. q is N bits long (let's assume 160 bits) and p is L bits long (let's assume 1024 bits). Here's what FIPS 186-4 says about generating the q parameter for DSA: ...
200 views

Security of a self-decrypting block-cipher?

If I have a block-cipher like for example AES, a plaintext $x$, we use different function to encrypt and decrypt : $\text{encrypt}(x) = y$ , $\text{decrypt}(y)=x$. Now, if we build a function with a ...
124 views

Authentication protocol which detects client impersonation from another machine

Consider following authentication protocol. Client ClientA knows some initial secret KeyA shared with server. Client also knows IP of legitimate server. Now when client wants to establish connection ...
6 views

The length of the shortest vector in Lattice

In Micciancio and Regev's paper "Lattice-based Cryptography",the length of the shortest vector is at least min{q, 2^{2*squart(nlog_qlog_(dert))}} . I want to ask why the paper chose the latter as the ...
116 views

Detecting encryption in real-time?

Is there anyway to detect encryption in real-time through a common signature or pattern recognition. Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can ...
6 views

Store and share data on web server

I'm developing an intranet for a company where admins are sharing a huge excel file containing all the necessary password, on the common TSE. I've managed making them encrypt it with a common password ...
619 views

What exactly is a “garbled circuit”?

There are plenty of questions here about the details and how-to's of "garbled circuits", but I have not seen anything that defines what garbled circuits are. What exactly is a garbled circuit? What ...
148 views

RSA: revealing the modulus factorization by choosing a bad message

I started reading the book Cryptanalysis of RSA and its variants by M. Jason Hinek and I stumbled upon a phrase that intrigued me: plaintext messages that are relatively prime to the modulus (i....
322 views

Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
27 views

How can I find all points on an elliptic curve?

I have an elliptic curve $$y^2=x^3 + 8 \times x + 6 \mod 13$$ How do I find all the points on this EC? Also, could you give me more examples?
120 views

Bit level permutation

Could anyone explain how secure is bit level permutation? What is the most serious threat against the security of this kind of cipher?
238 views

Key exchange using ECDH vs ECIES?

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
527 views

Building a cryptography system by combining a block cipher and a stream cipher?

I have to come up with a design for a cryptography system by combining a block cipher and a stream cipher. I can't seem to come up with anything on my own. Can someone point me in the right direction ...
39 views

Garbled table for 3 inputs

I have a truth table of a full adder with 3 inputs (A,B,Cin) and 2 outputs (S, Cout). How can I create a garbled truth table? I mean, in the general form it is ...
245 views

what are the NTRU keysize and application in industry?

I'm a student currently working on a research project on the NTRU cryptosystem, I've read some papers about this cryptosystem, and in those papers they are talking about keysize, is it the size of the ...
106 views

pairing parameters in PBC library

I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used. I noticed that we can give any file in the param subdirectory. Is ...
69 views

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ... 2answers 117 views Is pseudorandom function also a one-way function? Can I assume this? Specifically, I want to know if the following two cases are valid. Suppose$prf_k(m)=c$One-wayness: Only given$c$, we cannot reveal$m$. Without key$k$, even given$m$, cannot ... 0answers 44 views Existence of a random function under constraints Let$F_1$and$F_2$be two random functions taking as input$N$bits and returning$N$bits. Let$C_1$and$C_2$two constants of$N$bits. Is there a random function$P$taking as input$2N$bits ... 1answer 853 views What characters are valid in PGP encrypted and signed messages? What characters may be present in a PGP encrypted message or a PGP signature? For example, do encrypted messages only use the Roman alphabet + some numbers and symbols? Can the character set be ... 2answers 484 views Triple-DES DUKPT CBC PIN variant vs Data variant Does any know the difference between triple des dukpt decryption algorithm with PIN variant and Data variant? I have done Triple DES DUKPT PIN variant, which generate session key from KSN and BDK. ... 2answers 90 views One-way function definition I cannot understand why a one-way function$f$is defined in this way$\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$and not$\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$where$A$is a ... 1answer 84 views How to encrypt a vector$e\in Z^{m}$using LWE I have a vector$e \in Z^{m}$, now I want to encrypt it by using LWE (Learning With Errors). Because in LWE, we have to encrypt of a bit$\{0,1\}$. How can I encrypt a vector$e \in Z^{m}$? 1answer 135 views AES with different modulo operations? I don't get the modulo 10001 operation in MixColumns so much. If I have to take the byte computations mod 100011011 anyway ... 1answer 131 views Size of a MAC for a quickly checked message? Let suppose that we have to check a message that was written one second ago. The message is discarded immediately after having being checked. What "minimal" size for such a MAC is secure? 1answer 286 views Encryption schemes and pseudorandom permutations Can an encryption scheme (deterministic or not) be viewed as a pseudorandom permutation taking as input a message and returning a value of the same bit-encoding length? 3answers 1k views Complexity of arithmetic in a finite field? I am wondering what the complexities are of adding/subtracting and muliplying/dividing numbers in a finite field$\mathbb{F}_q$. I need it to understand an article I am reading. 1answer 794 views Linear Feedback Shift Register Taps Linear feedback shift register tap charts are availale for registers of length 3 to 168. Does anyone have a chart for register lengths from 168 to 256 or beyond? 1answer 115 views OCB and GCM security Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well. 1answer 199 views Requirement for the length of a HMAC tag? I've seen NIST requirements about key length. What about the output lengths ? Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ? 1answer 230 views Why Merkle Tree doesn't suffer Birthday attack? I am trying to understand why Merkle Tree doesn't suffer the birthday attack? Can you help me? 1answer 86 views Username and Password: How does it work? Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number$r_a$. Bob sends Server Hello with another random number$r_b$. Suppose they ... 1answer 32k views How does RSA signature verification work? I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ... 1answer 170 views What could be the problem with this TLS 1.2 Client Finished Message approach? Can someone make sure I'm creating my Client finished message properly as I've been working at this for days and keep getting a Bad record MAC error and I have no idea what I'm doing wrong. First ... 0answers 178 views TLS 1.2 finished message stucture [duplicate] I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, ... 1answer 743 views What methods allow us to determine the language used in a monoalphabetic substitution cipher? Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ... 1answer 223 views Is any specific packet cipher mode to be prefered for use with – for example – UDP? Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order ... 1answer 110 views +50 Applying machine learning algorithms to homomorphic encrypted data I have a basic understanding of encryption and I got back to the topic because of an interesting site that encrypts financial data using homomorphic encryption (HE) and I would be happy for any input ... 1answer 29 views Client side encryption / hashing of “person ID's” with password? What we're looking for A solution where data is stored and retrieved (!) from a server using a person ID that can only be known at the client (form of ... 2answers 37 views Secure logical AND using Ishai-Sahai-Wagner Scheme I want to try to implement a secure AND the way it was described here: https://eprint.iacr.org/2010/441.pdf It says that there are two bits a and b and that they have been split into d+1 shares. How ... 1answer 33 views IND-CCA Security of a encryption scheme which is combination of two schemes I have two public key encryption scheme$\Pi_0$and$\Pi_1$and one of them is IND-CCA secure, another one is IND-CPA secure. Let$\Pi$be a public key encryption scheme, which is a combination of$\...
I have a two party protocol, let's call it $M$. At some point, there are $k$ steps, each one involving an oblivious transfer protocol, which is known to be secure against semi honest adversaries. ...