0
votes
0answers
15 views

A5/1 and LFSR incrementation

I am working on A5/1 and I'm not sure to all understand about it. We consider that we receive a burst(228 bits-sequence) to encrypt every 4.615 milliseconds. So when we have initialized our LFSR's ...
0
votes
0answers
23 views

signed message susceptible to block re-ordering , block deletion , block replication

We would implement a Public Key Cryptography (PKC) based digital signature by breaking the message into blocks and signing each block independently. One of the issues associated with digital ...
0
votes
0answers
42 views

Low exponent attack against RSA

According to this: http://www.cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/rsa.pdf One can calculate the message m, if there was no padding scheme involved. My question: is it possible to find ...
0
votes
0answers
17 views

Help in uderstanding NIZKPoK notation (and how to code it) needed

Hello fellow cryptographers I have a rather silly question for you; I am aware of how Schnorrs NIZKPoK / SoK works when someone must prove knowledge about DL: y = g^x; (and how to code it) RFC ...
0
votes
0answers
132 views

Serpent 256bit Non bit sliced version (Table Sbox/IP/FP/LT/ILT) (Non-bitslice notation rules)

Good afternoon! I got some mismatches while counting Round Keys at non bitsliced version of Serpent. I have used official AES submission outputs (file ecb_iv.txt). AES submission package test vector: ...
0
votes
0answers
45 views

Public key encryption without ciphertext expansion

Say I have a database column that is defined as VARCHAR(255) that stores names. I can assume that names can be up to 255 chars. I need a public key encryption so that I can replace names with their ...
0
votes
0answers
37 views

Password generation/storage scheme

How bad is the following strategy for a password manager on a local machine? The user wants to sign up for somesite.com where he needs a password. The user has previously generated a secret key ...
0
votes
0answers
23 views

Elliptic Curves Readdition

I found the term re-addition in https://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html and I cannot figure out what it is. It has actually same complexity of addition and I dont see the ...
0
votes
0answers
15 views

Computing the redundancy of language for a Vigenère cipher with m=5

Redundancy of L = 1- Entropy of L/ log base 2 {P} The Redundancy of L is given by 1 minus the Entropy of L divided by log base 2 of the Cardinality of the Plaintext space. Could someone advise me how ...
0
votes
0answers
59 views

initiate the elliptic curve

when we consider a curve in a prime field for example Weierstrass form and want to initiate it in Miracl,we should give these inputs for initiate curve: ebrick_init(&binst,x,y,a,b,n,window,nb) ...
0
votes
0answers
78 views

Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack

While reading a literature on signature schemes, I came across the concept of Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack. Can anyone point me to the paper ...
0
votes
0answers
57 views

Need help solving a shift cipher problem?

A three letter alphabet {a, b, c} has probabilities p(a) = .5 and p(b) = p(c) = .25. A shift cipher is applied to pairs of letters. More precisely: plaintexts consist of two-letter sequences of ...
0
votes
0answers
46 views

Forward Secrecy with pseudorandom functions

Let $H_1$, $H_2$ be keyed hash functions (e.g. $H_i(x) = SHA_{256}(s_i||x)$ for pseudorandom $s_1$, $s_2$). Let $s_n = H_1^k(s_0)$, $k_n = H_2(s_n)$, where $s_0$ is a secret (pseudorandomly chosen ...
0
votes
0answers
16 views

Isn't 'exponent' only present in MSME equations in Groth-Sahai framework?

Below are different types of equations in Groth-Sahai framework. All three instantiations, viz. Subgroup Decision, SXDH and DLIN allow to commit to exponent. But, isn't the concept of exponent only ...
0
votes
0answers
39 views

Generating a public key certificate with ECDSA params

I have an ECDSA key generated in a HSM and I am able to retrieve it's public key components via the PKCS11 library. I would like to create a public x509 certificate with the public params for the ...
0
votes
0answers
67 views

Bit level permutation

Could anyone explain how secure is bit level permutation? What is the most serious threat against the security of this kind of cipher? Thank you
0
votes
0answers
75 views

how to find key matrix in hill cipher

I want to solve this problem but there are 3 known plaintext-ciphertext pairs. The key of Hill cipher is a 3*3 matrix as k=[k1,k2,3; k4,k5,k6; k7,k8,k9] where the unknown ...
0
votes
0answers
62 views

side channel attacks on AES

Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for? Timing attacks affect RSA more than symmetric ciphers in-so-far as ...
0
votes
0answers
50 views

Need help solving message encrypted on an Enigma machine?

So basically I'm in a class an one problem we were given a while ago was one involving an enigma machine and a few messages. I do not have any idea of how to approach it, and I really need help. The ...
0
votes
0answers
67 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
0
votes
0answers
45 views

How are key length and size of group elements related?

I am reading a paper on ring signature where the author has mentioned a correlation between key length requirement and size of group elements. Can anyone hint me how he arrived at this conclusion out ...
0
votes
0answers
69 views

Possible Digital Signature Hack?

I am starting to learn more about cryptography and I just read more about how asymmetric keys can make a digital certificate, and I would like if someone could explain me why the following case can't ...
0
votes
0answers
57 views

Don't Understand these Parameters

I don't understand section 3 of the paper Fully Homomorphic Encryption over the Integers. How can one calculate these paramters and make these equations in pictures into code?
0
votes
0answers
26 views

impersonating attack against a protocol

recently I'm reading Efficient eCK-secure Authenticated Key Exchange Protocols in the Standard Model, and I sense that the scheme in the following(the reader can refer to the paper for details) is ...
0
votes
0answers
20 views

Ability to locate free sectors on an encrypted volume

I am trying to understand, generally how could this be a security issue ? Assuming the volume's backing media has this weakness (lets say an NTFS sparse file based TrueCrypt container) what could the ...
0
votes
0answers
44 views

Problem understanding the construction of block cipher distinguishers

I know a block cipher distinguisher is an algorithm which can predict with high probability whether a system is a random permutation or a block cipher by asking a few queries to the system. My ...
0
votes
0answers
71 views

Montgomery Multiplication in FPGA explanation

I'm trying to implement an RSA module in a FPGA. I choose to use Montgomery multiplication. I've found a document where the Montgomery Multiplication is pretty clear. I don't understand only a step. ...
0
votes
0answers
37 views

Need: Fast bulk signature verification followed by fast non-interactive multisignature aggregation

Q: Is there an efficient way to batch-verify signatures (e.g. some may be incorrect) and then non-interactively aggregate the correct ones into a multisignature (they are of the same message) such ...
0
votes
0answers
53 views

Protocol for establishing physical ownership of a connected/IoT device?

If I'm connected to a device e.g. using BLE are there rules/protocols for establishing that I'm also in physical possession of that device (at least for the first time I connect to it)? Crypto is in ...
0
votes
0answers
31 views

Perform general computation using a crypto algorithm as a building block

I have a somewhat special question. In our software we use a existing dongle which got cracked by our customers. The protection offered by the dongle isn't very sophisticated. For the moment I can't ...
0
votes
0answers
25 views

Plain cascade and Xor cascade

I have seen in few places (mostly papers) talking about plain cascade and XOR cascade. I know what is cascade cipher is but I am not clear about what these are. Can anyone help to understand using ...
0
votes
0answers
72 views

fuzzy commitment implemenation to make secure biometric template

I want implement some ideas from an article that is about making secure biometric templates using fuzzy commitment and fuzzy vault. I need to implement just the fuzzy commitment (fuzzy commitment is a ...
0
votes
0answers
52 views

Scalar multiplication of elliptic curve point by a fraction

I'm implementing an algorithm that works on a generic finite cyclic group written in the classic multiplicative notation: (G,*) = < g > , n = |g| At a ...
0
votes
0answers
24 views

Calculating cost of variables and equation in Groth-Sahai (DLIN) proof system

In Groth-Sahai proof system under DLIN assumption [Page 29], they have provided a few number denoting the cost of each variable and equation. Can anyone please explain how did they calculated the ...
0
votes
0answers
41 views

Partial Homomorphic Schemes with padding

As mentioned in wikipedia there are many Partial Homomorphic Encryption(PHE) scheme like RSA, Elgamal, Pailler etc. But out of them only unpadded RSA scheme seems to be partial(multiplicative) ...
0
votes
0answers
65 views

Self-Convergent Hashing

What is the name of an algorithm that hashes its result as an embed of larger set of data that results back to the hash? For instance where f(x) is the hashed result and x is the dataset, and ...
0
votes
0answers
44 views

Is there a practical succinct interactive argument for fortress draws in chess endgames?

(In theory, it is known that collision-resistant hashing suffices for the type of protocol that I'm asking about: page 3.) Is there a known practical candidate protocol for succinctly (and ...
0
votes
0answers
31 views

Hard problems in composite order group even when factorization is known

Composite discrete log problem has been proved to be reducible to hardness of factorization and discrete log on the prime factor groups. Are there any problems apart from that in composite order ...
0
votes
0answers
32 views

Size of Messages Exchanged by PRV and VER for Schnorr Protocol

In this file Elliptic Curve Based Zero Knowledge Proofs and Their Applicability on Resource Constrained Devices I don't understand the Table 6 (Table 6: Size of Messages Exchanged by the Prover(PRV) ...
0
votes
0answers
44 views

Advantages of using intermediate hash over full hash in digital signature application

Description of intermediate hashes Intermediate (or partial) hashes are canonical forms of digest state that can be transferred from one hash implementation to another, so that the other, limited ...
0
votes
0answers
94 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
0
votes
0answers
63 views

What is a proof of data possession that accounts for fake mirrors?

Alice pays Bob $5/month to host a gigantic file for her. She wants to occasionally verify that Bob is actually hosting the file. To do this, she selects random blocks from the file, and ...
0
votes
0answers
74 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
0
votes
0answers
58 views

What are the consequences of not checking the server mac in a TLS connection?

The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU However, I want to make it clear that you don't have to ...
0
votes
0answers
81 views

Looking for crypto with derived keys?

I am looking for cryptographic algorithm or combination of them. Basically I need an algorithm, which can generate private key and for this key can be computed multiple keys based on some seed. So a ...
0
votes
0answers
69 views

Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?

Say I have a string that I want to keep hidden. You can then enter a known string which is added to the end of the hidden string and you are given the sha256 hash of the combined string. If you were ...
0
votes
0answers
52 views

How to know private key is computed from specific partial private key?

In a certificate-less cryptography, I have learned that – to resolve the key escrow problem of IBE – the concept of a partial private key is used. Now, consider the following Scenario: After ...
0
votes
0answers
37 views

Locally Dedcodable Codes and Private Information Retrieval

Does anyone know about Locally Decodable Codes (LDCs)? It seems the private information retrieval schemes that based on LDCs are computationally efficent (answer a query without processing the whole ...
0
votes
0answers
53 views

Re-encryption mixnet

Can an Elgamal-based re-encryption mechanism be used in a free route mixnet topology? Until 2006 it was not possible, but I couldn't find the later research results or achievements. Can anyone suggest ...
0
votes
0answers
66 views

How to make a crypto-currency robust to 51% attacks?

For Example: In Bitcoin it is theoretically possible to double spend if you control > 50% of the computational power in the network. Also it is possible to apply "selfish mining" with far less than ...

15 30 50 per page