# All Questions

49 views

### search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
85 views

### How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
84 views

### Why should $a,b < N$ for Montgomery Reduction?

In Montgomery reduction, when calculating $a \times b \mod N$, it is required that $a \lt N$ and $b \lt N$. I think $0 \le T \lt N \times R$ is enough for the Montgomery Reduction. Rationale: Let ...
112 views

### Blowfish Weak keys

I've read about the weak key issue with Blowfish, but can't seem to find anything that explains the practical effect of weak keys on Blowfish with the full 16 rounds. Is there any actual attack upon ...
33 views

### DSSP reduction to DSSI

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" by DeFeo, Jao and Plut, a reduction from the Decisional Supersingular Product (DSSP) problem to Decisional ...
51 views

### Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
39 views

Please clarify the below doubt regarding EC point addition and multiplication: $P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows: $X = (a*P) + (b*P)$ $Y = ... 0answers 25 views ### Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap? Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over$\Bbb Z$? It could ... 0answers 76 views ### Does SHA-1 meet the strict avalanche criterion? Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ... 0answers 61 views ### How to choose McEliece's parameters? At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ... 1answer 41 views ### Why should the input value on a DPA attack be non-constant? I actually was wondering if anyone could help me out with the following problem: Let's assume we are attacking the first SubBytes() operation on AES with the help ... 0answers 43 views ### Determine safety of exercise hash functions There have been several attacks against hash functions such as$h_{sha1}$and$h_{md5}$. Professor A suggests a new function$h_{666}$with an output length of 666 bits. Professor B suggests ... 0answers 70 views ### Worst case one way function the worst-case one way function is defined as follows $$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$ can you give any example of such function? 0answers 30 views ### Residue requirements of Rabin-Williams primes? I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ... 0answers 54 views ### Elliptic curve point addition I have this curve in E(F131) : $$Y^2 = X^3 + X + 2$$ I want calculate the sum P + Q considering that $$P= (5,1)$$ and $$Q = (60, 49)$$ For calculate the result i use these formulas:$$xr = ... 0answers 94 views ### Is there a mental poker algorithm that does not rely on commutative encryption? The algorithm for mental poker that I saw on Wikipedia and everywhere else relies on an encryption algorithm such that$E_k(E_j(P)) = E_j(E_k(P))$, but I can't find a modern and secure algorithm for ... 0answers 102 views ### DPA Attack on HMAC SHA-256 I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ... 0answers 54 views ### Cryptographic enforcement schemes using Diffie-Hellman If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ... 1answer 117 views ### Ring signatures in ECC Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ... 0answers 76 views ### RSA_DH vs ECDH implementation In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ... 0answers 47 views ### Proposed unidirectional authentication scheme I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ... 0answers 92 views ### SHA3 Keccak, absorbing data to the state I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ... 0answers 87 views ### Avoiding known plaintext attacks with an additional XOR-Layer Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ... 0answers 321 views ### Proper way to generate symmetric keys [duplicate] I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly. I've been trying to find how you would generate a key for symmetric encryption (say ... 0answers 122 views ### Simplicity and precision in cryptography papers [closed] I know a PhD student who recently had his paper on applied cryptography rejected because one the reviewers claimed that it was "the solution was too simple and the notation used was more than ... 0answers 64 views ### Energy necessary for brute-forcing or decryption I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it. ... 0answers 92 views ### Proving that a plaintext is the Paillier decryption of a certain ciphertext [duplicate] Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ... 0answers 100 views ### Pseudorandom Function Proof Given a set of pseudorandom functions$F=\{f_s^i\}_i$for each$s\leftarrow\{0,1\}^n$generated at random; moreover each$f_s^i$uses a specific PRG$G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: ... 1answer 151 views ### Is there a need to encrypt data when send over https? [closed] I was monitoring web traffic from my Android mobile using Man in the middle proxy. I installed certificate signed from my server in my mobile and I could see all applications sending sensitive ... 0answers 39 views ### During electronic voting, how does one hide the choice from Voting device? Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially ... 0answers 145 views ### How to calculate the non-linearity of an s-box? I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ... 0answers 63 views ### Implementing modular reductions (n*n) [closed] I'm implementing a public key cryptosystem in a proprietary System On Chip that only allows modular reductions by$n$. However, that cryptosystem requires ($n^2$) modular reductions. Perhaps someone ... 0answers 90 views ### Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size? The CKM_RSA_PKCS Mechanism in PKCS#11 v2.20 section 12.1.6 PKCS #1 v1.5 RSA is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 signature of data hashed externally to a ... 0answers 152 views ### What are the well known protocols that offer perfect forward secrecy? [closed] As far as I know these are the well known protocols that offer PFS TLS/SSL (with DHE-RSA, DHE-DSS, ECDHE-RSA or ECDHE-ECDSA) SSH (RFC4253) OTR (Protocol Version 3 Spec) IPsec (with IKEv1 and IKEv2) ... 0answers 74 views ### Exponentiation with fully homomorphic encryption [duplicate] I have often heard that because a fully homomorphic encryption scheme allows for both additions and multiplications on encrypted data, most other operations can be simulated. I don't understand how ... 1answer 201 views ### Counter Mode (CTR) and mult-CPA I am not sure if Counter Mode (CTR) encryption is mult-CPA (chosen-plaintext attack) secure or not. 1answer 65 views ### Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit? [duplicate] In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ... 1answer 104 views ### Hardness assumptions on composite order bilinear groups [closed] I am not at all knowledgeable in elliptic curve cryptography. So, here lies a couple of questions that I failed to find answers for to my satisfaction. Is there any known Type-III bilinear pairing ... 0answers 73 views ### Is it possible to perform one-way Diffie-Hellman MITM? Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ... 0answers 94 views ### Performing HMAC with random key before MAC comparison In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ... 0answers 119 views ### Key Recovery Smart-Vercauteren SWHE In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ... 1answer 269 views ### ASN.1 encoding off RSASSA-PSS default parameters I am not totally sure the question belongs to crypto and not stackoverflow but nevertheless... The problem is the encoding of the RSASSA-PSS default algorithm identifier parameters in an X509 ... 0answers 248 views ### Difference between statistical PRNG and cryptographic PRNG? [duplicate] What's the difference between a statistical pseudorandom number generator (PRNG) and a cryptographic-strength PRNG? I've seen a lot of PRNGs that are proposed for statistical uses -- e.g., ... 0answers 110 views ### Formal proof of theorem concerning the Random Oracle Model Reading a book on cryptography by Douglas R. Stinson I've met the following theorem, which is stated without proof (see here). Thereby,$\mathcal{F^{X,Y}}$denotes the set of all functions from ... 0answers 75 views ### What is the fixed point attribute of DES (when used with weak-keys) I've heard in some lecture that the weak keys in DES implies the existence of$2^{32}$fixed points in the algorithm, i.e. that$DES_k(x)=x$for$2^{32}$such$x$'s. I couldn't find anything about ... 1answer 174 views ### Polynomial division hardware implementation I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ... 0answers 57 views ### How exactly is the output of the XOR step in PBKDF2 used? I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ... 0answers 361 views ### Existential Forgery on textbook RSA signatures Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen$σ_1 = (m_1)^d \bmod N$and$σ_2 = (m_2)^d \bmod N$He forges$m' = m_1\cdot m_2σ' ...
Assume out of a set of ElGamal signatures, I've discovered that two have the same y i.e. $signature_{1}$ on $m_{1}$ = $(y,s_{1})$ and $signature_{2}$ on $m_{2}$ = $(y,s_{2})$. The public keys for ...