3
votes
2answers
104 views

What is a purpose of reducing lattice basis?

This may be too broad question but it is not. I have been studying lattices for few months now, more specifically I studied: lattice problems ($SVP$, $CVP$ and etc.) lattice cryptography in post ...
0
votes
1answer
34 views

ElGamal scheme signature: if private key a mod p is equal to private sig. key k mod p-1, can an attacker notice and determine the value of a?

If someone is signing a document using the ElGamal signature scheme, and if the random involved in the signature $k \mod (p-1)$ is equal to $a$ (the private key), can an attacker notice? If so can he ...
2
votes
2answers
74 views

Shannon theorem of perfect secrecy

From the class: Shannon Theorem: For a perfect encryption scheme, the number of keys is at least the size of the message space (number of messages that have a non-zero probability). Proof: ...
4
votes
2answers
153 views

How secure would hand ciphers be using a Block Cipher Mode?

I've been looking into different ciphers that require very minimal computation power (calculator, deck of cards, index cards and a pencil), i.e. hand ciphers. For the most part all methods typically ...
0
votes
2answers
61 views

Detecting Encryption in Real-Time

Is there anyway to detect encryption in real-time through a common signature or pattern recognition. Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can ...
4
votes
0answers
44 views

How should I implement a secure recovery of encryption?

I want to create a system to host as securely as possible encrypted data in a way that not even the system can know the content of the data, but that it could be recovered. I would like to know how ...
2
votes
0answers
59 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
1
vote
1answer
225 views

HMAC Secure Key Exchange?

Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute ...
4
votes
0answers
53 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
-1
votes
2answers
53 views

elliptic curve point doubling in Jacobian coordinates

I am writing an application that uses Elliptic curve Diffie–Hellman for authentication. I found two formulas for point doubling in Jacobian coordinates. 1st) \begin{equation} X_1 = (3x^2 + aZ^4)^2 ...
3
votes
1answer
65 views

Does concatenation of two pair computational indistinguishable distributions still indistinguishable?

Let $X,X',Y,Y'$ be some distribution ensembles such that $X\sim X'$ and $Y\sim Y'$, where $\sim$ means computational indistinguishable. Define $(X,Y)$ be the distribution ensemble over $\{0,1\}^{2n}$ ...
3
votes
1answer
193 views

How to perform decryption in this single-bit PKE scheme?

Consider a cyclic group $G$ of order $q$, and let $g$ be a generator for $G$. Assume $(G, q, g)$ is public. Consider the following 1-bit public-key encryption scheme. To $generate (pk,sk)$: $x ...
1
vote
1answer
57 views

multiplicative inverse in galois field $2^8$

I am trying to compute the multiplicative inverse in galois field $2^8$.The question is to find the multiplicative inverse of the polynomial $x^5+x^4+x^3$ in galois field $2^8$ with the irreducible ...
3
votes
1answer
77 views

Why is padded RSA not CCA-secure?

Why is the padded RSA construction given in the picture not CCA secure?
2
votes
1answer
27 views

Can (EC)DH keys be used as the signed content in X.509 certificates?

From Wikipedia's article on ECDH: The public keys are either static (and trusted, say via a certificate)… Also see this question on this very site. These indicate to me that a certificate ...
0
votes
0answers
52 views

Lightest symmetric, fixed key, “Format preserving Encryption” algorithm?

message m = 49 bit string key k = any format but fixed Ciphertexts should be 49 bits long. Are there several "Format Preserving Encryption" algorithms? I want an algorithm that is as light as ...
1
vote
1answer
64 views

DES: Computing the output of S-Box 1?

If the 48-bit input to the S-box is 0xAAAAAAAAAAAA, what are the first four bits emitted by S-box 1? Answer: 0110 I know that an S-Box takes n inputs and give m outputs and that n != m, but I really ...
9
votes
1answer
173 views

On Linux, does /dev/random unblocking imply that /dev/urandom is seeded?

Linux has the familiar problem that /dev/random blocks too much (insisting on being information-theoretically secure), while /dev/urandom doesn't block enough (it will return data before it's been ...
0
votes
1answer
36 views

Can I open a file in plaintext (already decrypt) but the cipher doesn't change?

I want to create an app that encrypts a file and saves it to the Dropbox. Thus, I open and edit this file, I want the file is already decrypted, but the encrypted file that stored in Dropbox still in ...
11
votes
2answers
879 views

Why is CRC said to be linear?

It is commonly understood that CRC satisfies the linear identity with respect to the $\oplus$ (XOR) operation: $\operatorname{CRC}(a) \oplus \operatorname{CRC}(b) = \operatorname{CRC}(a \oplus b)$ ...
3
votes
1answer
58 views

2 party AND computation under passive perfect security

In the book written by Ivan Damagard titled "Secure Multiparty Computation and Secret Sharing", at the end of the third chapter he provides a proof for why it is impossible to securely compute 2 party ...
-1
votes
1answer
197 views

I homebrewed an algorithm. Is it secure?

This is a bit of a cross-posted question which I first asked at StackOverflow, however I was not satisfied with stackoverflow, so I came here for an in depth answer. I, as they say, "rolled my own ...
0
votes
0answers
21 views

Value of security through amiguity?

Let's say that you have a symmetric cipher which takes in an 8 bit plain text value and a key, and generates cipher text which can be decoded using the key to get the original plain text value. Since ...
4
votes
1answer
45 views

Could a strong round function be immune to slide attacks

An excerpt from the wikipedia article on slide attacks states: ...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
1
vote
1answer
37 views

How many bits of plaintext are required to verify a stream cipher key?

If a stream cipher has an $n$-bit internal state, how many bits of known plaintext are required to confirm that particular key is the key? I believe that the answer is at least $n$-bit's of ...
2
votes
2answers
55 views

Is “reused one time pad” safe to encrypt a message like “random number + mod”?

I want to encrypt a message that contains a fixed length random number and a long mod. i.e. 1234564284 (created like this 123456 + (123456 mod 9931)) I assume that reusing the same key is not a ...
3
votes
1answer
34 views

Is this session start protocol secure?

I am working on a password manager application that saves the user's passwords in a remote server. I need to use AES in CTR mode to encrypt the passwords before sending them to the server. The client ...
3
votes
0answers
83 views

Finding sum of two encrypted numbers

Let's consider such process: Two emitents emit two (integer) secret numbers independently They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. ...
4
votes
1answer
56 views

Small subgroup attack on Diffie-Hellman key exchange

Alice and Bob are using DHKE in the group $\mathbb{Z}_p^ * $, where $p = 1031 = 2 \cdot 5 \cdot 103 + 1$. Their generator $g = 2$, which generates a multiplicative group of order $515$ in ...
1
vote
1answer
46 views

ChaCha20 core vs ideal unkeyed PRP

I know that the ChaCha20 core (without the initial constant) is not an ideal PRP and must not be used as such. I also know that $\text{ChaChaCore}(0) = 0$. Are there any other differences?
2
votes
1answer
47 views

What is the most common encoding of messages to polynomials?

How polynomial based encryption schemes such as NTRU encode messages in to polynomials? Is there a generic conversion?
7
votes
1answer
78 views

What are the requirements of a key schedule?

In the first block cipher I designed I used a CSPRNG to generate the round keys. The purpose was to at least have a chance of creating a (hopefully!) secure cipher on the first try (but please don't ...
1
vote
1answer
51 views

How succeptible to accidental collision is the construct sha256(uuid4 + now) in Python?

I need 32 byte pseudorandom sequences that denote unique filenames and am currently using this Python code: ...
1
vote
0answers
37 views

Parallel hashing function that always gives the same hash despite a variable number of cpus

The title pretty much sums it up :) I'm looking for a hashing algorithm that does not need to be cryptographically secure beyond reducing the number of accidental collisions. There is no need to ...
1
vote
1answer
20 views

Question about entity authentication

Say party A wants to make sure they are communicating with party B, and not an eavesdropper E. Then they will use an authentication scheme to do this. But what if there is an eavesdropper on the ...
4
votes
1answer
88 views

Exposed raw RSA private key operation

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
-2
votes
1answer
30 views

SHA encyption (help me) [closed]

OK, so I am a real noob at cryptography stuff and I have a set of files. One is a string that I am trying to decrypt, and the other has this SHA: 4534e95cb5f001719a6119a092459dc826965d60 Can I use ...
1
vote
1answer
116 views

What is the difference between discrete logarithm and logarithm? [closed]

Why discrete logarithm? Is discrete logarithm is part of logarithm? I do not understand the difference between these two concepts.
0
votes
1answer
25 views

Are chosen-prefix collisions for SHA-1 a major threat?

GPG signing of Git commit tags relies on the collision resistance of SHA-1, which is weak. However, the attacker does not get to choose the prefix. How much does this translate to an actual ...
4
votes
2answers
54 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
0
votes
1answer
31 views

Aggregation signature and verification

I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal. Imagine I have a simple digital calculator, with a screen and ...
0
votes
1answer
36 views

dealing with real numbers in Integer Vector Homomorphic Encryption lib

I am using Integer Vector Homomorphic Encryption for the encryption lib. I have to multiply a learning rate of 0.01 (i.e. between 0 and 1) by the encrypted data (vector) but it is not integer. I had ...
2
votes
0answers
28 views

RC6-like key schedule with 16-bit S-boxes

I am trying to figure out an encryption algorithm whose key schedule function seems to be similar to RC6. However, it seems to be creating S-Boxes using 16-bit integers instead of 32-bit ones. I have ...
1
vote
1answer
29 views

Is there an avalanche effect using block cipher modes of operation?

I am studying cryptography and various block cipher modes of operation. Suppose I changed one bit in the last block of the message. Wouldn't that imply no change in all encrypted blocks except for ...
3
votes
1answer
38 views

The solution of insert MAC in a ciphertext without Authenticated Encryption supported

From Should we MAC-then-encrypt or encrypt-then-MAC?, I understand I should do Encrypt-than-MAC, which the MAC included all the information such as IV and cipher text. After reading Why choose an ...
0
votes
1answer
39 views

Proper authenticated encryption

I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct. The message send over the network is: ...
1
vote
0answers
28 views

TLS padding format

My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3 I came across the PKCS7 format for the padding: ...
0
votes
0answers
32 views

autocorrelation and entropy of historical ciphers

I'm learning cryptography and come across historical ciphers such as vigenere cipher,hill cipher,random substitution and etc.I'm using cryptool for learning purposes and I have a question in mind.I've ...
0
votes
0answers
36 views

ECIES is must with Symmetric?(ECIES-AES or ECIES-TDES)

I can't understand the ECIES algorithm. I saw two different ECIES algorithms: Using only Public key Key generation: $A_{pri} : n_A$ $A_{pub} : n_A G$ $B_{pri} : n_B$ $B_{pub} : n_B G$ ...
0
votes
2answers
67 views

Can two files/strings have the same SHA-256 value?

I was wondering whether, theoretically, 2 files can have the same SHA-256 value. Since there are only $16^{256}$ or $2^{1024}$ SHA256 sums, all 1024-bit files (with $2^{1024}$ different combinations) ...

15 30 50 per page