8
votes
0answers
148 views
What changed in PKCS#1 v2.2, and why?
PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA.
That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two ...
5
votes
0answers
82 views
+50
How to build an electro-mechanical public key cipher machine?
It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. My question is, if the abstract idea of having a public key ...
5
votes
0answers
155 views
Prove that textbook RSA is susceptible to a chosen ciphertext attack
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.
So I use the fact that the ...
5
votes
0answers
61 views
MD4 First preimage - state of the art
What's the state of the attack to get the first preimage on MD4?
Is it still this http://www.di.ens.fr/~leurent/files/MD4_FSE08.pdf in 2^102 ?
5
votes
0answers
40 views
Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem
If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
4
votes
0answers
99 views
How can scrypt be improved to counter GPU mining
I know scrypt was designed to lessen the GPU/ASIC advantage.
We now have litecoin as a real-world example of this. However, it hasn't worked out perfectly. Most coins are mined by GPUs, although the ...
4
votes
0answers
90 views
Pseudo preimage for a hash made from a cipher
Consider the Miyaguchi–Preneel construction:
$H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros)
$H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$
where $E(K,M)$ is a block cipher (for ...
4
votes
0answers
235 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
3
votes
0answers
45 views
Why is TLS SRP verifier based on user name?
I don't understand why TLS SRP (or SRP in general) includes the user name in verifier calculation, given that user name is basically public.
From spec RFC 5054 $x$, which is then used to calculate ...
3
votes
0answers
48 views
Unique GCM/CCM initial counters without recipient side message counters
I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
3
votes
0answers
105 views
Questions on rank-attacks in Multivariate Cryptography
While reading this article on rank attacks on STS (a public-key scheme based on Multivariate Quadratic (MQ) equations), I stumbled upon some claims that I've also seen in other presentations on ...
3
votes
0answers
127 views
Finding where I am in a linear recurrence relation
Suppose I have a linear recurrence relation
$$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$
where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as ...
3
votes
0answers
345 views
Elliptic curve cryptography related key attacks
This question is an extension of Families of public/private keys in elliptic curve cryptography
As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
2
votes
0answers
17 views
Clipper chip (SKIPJACK) key exchange protocol
According to the Wikipedia page for NSA (emphasis mine):
However, NSA's Fortezza hardware-based encryption cards, created for
the Clipper project, are still used within government, and NSA
...
2
votes
0answers
56 views
Questions about the ideal cipher model
I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ...
2
votes
0answers
40 views
Which version(s) of SRP are in ISO/IEC 11770-4:2006?
I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.
This states that SRP is part of IEC 11770-4, ...
2
votes
0answers
105 views
More technical details on the ongoing (alleged) Chinese cyberattacks
Recently, there has been quite a lot of news about the Chinese compromising various US weapons systems and stealing military designs through "cyberwarfare". I am reading the news sources about these ...
2
votes
0answers
100 views
LT codes with Homomorphic hashing
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
2
votes
0answers
115 views
Correct way to truncate data to a range
2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm.
I want to take a stream of k trusted random ...
2
votes
0answers
72 views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
0answers
46 views
Relaxed trust criterion for mental poker server?
I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
2
votes
0answers
110 views
Single-purpose symmetric encryption scheme for single files
I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design:
...
2
votes
0answers
66 views
State of the art in zero knowledge proof compilers?
What is the current state of the art zero knowledge proof compiler ? I need one that can minimally handle double exponentiation by a known value E.g.
$$Pok\{(\alpha):h=g^{\alpha^b}\} $$
where b, ...
2
votes
0answers
85 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
2
votes
0answers
77 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
2
votes
0answers
72 views
Why does the SRP6 calculation of B included a multiplier k = 3?
In SRP6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?
(In SRP 6b, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP 6.)
2
votes
0answers
58 views
How do you construct a practical full-domain hash function?
I am looking for practical constructions for Full Domain Hash.
I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ...
2
votes
0answers
129 views
Creating colliding x509 certificates: Crafting RSA moduli step
I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7).
Now I have ...
2
votes
0answers
46 views
Encrypting or HMACing password digests
Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
2
votes
0answers
113 views
Odds of false error detection in a randomness test using the chi-squared test?
Common Criteria classifies the requirements for true Random Number Generators, and specifies how these should be tested against failures (these can occur accidentally, or following deliberate attack, ...
2
votes
0answers
63 views
Differential Cryptanalysis of FEAL-4
I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall.
Basically I attacked the final round first (K3) using the differential characteristic of ...
2
votes
0answers
98 views
Transforming simplest protocol into a Sigma-protocol
I have some questions from previous years exams, I hope you could help me with them. :)
Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
0answers
148 views
Does Keccak have an eTCR mode?
On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3):
...
2
votes
0answers
104 views
Ring Signature - paper/code difference in trying to solve inverse trap door function?
there is a paper on ring signatures and a python implementation of it here.
The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
2
votes
0answers
167 views
Is there a practical zero-knowledge proof for this special discrete log equation?
We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:
Alice knows: ...
2
votes
0answers
49 views
Are there any systems like SDSI / SPKI that are currently being developed?
SPKI / SDSI look interesting but appear to have fizzled out and died. Are there any modern competitors?
2
votes
0answers
79 views
How to properly format a PGP Message Block?
As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
2
votes
0answers
136 views
Safe generator for ElGamal signature
What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)?
I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ ...
2
votes
0answers
118 views
RSA reencryption scheme
Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user?
Basically, such an algorithm would probably be ...
2
votes
0answers
366 views
Secp256k1 ECDSA test vectors
I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like ...
1
vote
0answers
65 views
Hash function with values in a multiplicative group of prime order
I have to implement a cryptographic protocol which involves a cryptographic hash function $H: \{0,1\}^* \to G$. It is viewed as random oracle. $G$ is a multiplicative group of prime order.
I want to ...
1
vote
0answers
38 views
How does Poly1305 in the NaCl library calculate a MAC?
I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this ...
1
vote
0answers
122 views
Calculating PGP Symmetrically Encrypted Packet data
I have been trying to create a properly encrypted data packet using the format described in RFC 4880. However, I have been unable to verify any of my outputs due to the lack of examples to draw from ...
1
vote
0answers
64 views
How well analyzed are giant block length ciphers?
I have heard about ciphers that have a block length of 256 megabytes... That is huge.
How well are they understood by the encryption community?
I'm referring to PMC Ciphers.
Has anyone used such a ...
1
vote
0answers
75 views
What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?
I'm working with the affine representations of points of a Koblitz curve.
I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed faster than the standard way. ...
1
vote
0answers
70 views
Question about proof of knowledge defintion?
I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...
1
vote
0answers
68 views
Is OAEP reversible?
Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for ...
1
vote
0answers
59 views
Algorithm digipass-like
I'm pretty sure there are famous algorithms for my problem, but I don't have enough knowledge in this field, so I need your lights.
Here si the problem :
Alice sends key X to Bob.
Bob has an ...
1
vote
0answers
55 views
PKC McEliece + $S$ + $P$
I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
1
vote
0answers
56 views
Perfect secrecy and change of plaintext probability distributions
How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions?
Do ...
