2
votes
1answer
591 views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2
votes
1answer
965 views

Shamir Secret Sharing - Threshold decryption implementation

I'm implementing Shamir secret sharing in C using OpenSSL. I've split up the private key and I'm ready to start decrypting the original message using some of the shares. I set $n = 5$ (5 shares ...
2
votes
2answers
239 views

RSA keys finding when messages are known

I have this situation, where, in a game, people send messages to each other (game moves etc...) These messages need to be encrypted, and should only be readable by the destination person. I am using ...
2
votes
1answer
412 views

server side Javascript security

It is accepted that the javascript library lacks the ability to create an adequate PRNG. My understanding that this was mainly due to the limits of a sandboxed browser enviroment that javascript ...
2
votes
1answer
1k views

How to test distribution of a hash function?

From what I've found, it is generally accepted a cryptographic hash function like SHA-2 has an evenly, randomly distributed output. Is there a way to test this without running through the entire 2^...
2
votes
3answers
477 views

Can we construct fully homomorphic encryption scheme based on non-circuit approach?

At present, all FHE scheme are be constructed based on circuit approach. Can we construct fully homomorphic encryption scheme based on non-circuit approach? Is Polly cracker non-circuit approach ?
2
votes
1answer
2k views

Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
2
votes
1answer
2k views

BouncyCastle Elliptic Curve implementation

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve). ...
2
votes
1answer
3k views

Calculating the inverse modularity of the determinant for Hill cipher

I'm trying to decrypt a message encrypted with Hill Cipher, but I don't understand how to find the determinant so it solves the equation $det * 1/det = 1 mod 26$. The determinant for my key matrix is ...
2
votes
1answer
327 views

What are the safe ways to derive HMAC key using block cipher?

Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
2
votes
1answer
999 views

Self-expiring symmetric keys, or: cryptography in absence of secure deletion

I can encrypt some data D using a random symmetric key K, obtaining a ciphertext C, and then encrypt K with my public key Pub and obtain H. So far so good: I can only decrypt C if I have H and my ...
2
votes
1answer
401 views

Why can't Homomorphic encryption schemes support algorithms with conditions/branching?

If it isn't already apparent from the title of my question, i should make clear that I have only a very basic understanding of homomorphic encryption. I would like to know why homomorphic encryption ...
2
votes
1answer
228 views

How is the EAX-mode used in EAP-PSK (RFC 4764)?

According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel). In RFC 4764, the ...
2
votes
2answers
281 views

Stream cipher malleability

Considering a stream cipher that produces a ciphertext $c$ from a message $m$ and a key $k$ is it possible to apply operations (multiplication and/or addition) directly to $c$ without knowing the key ?...
2
votes
1answer
191 views

How many different keystreams can I produce with AES in Counter Mode?

I'm using a 64-bit nonce (incremented between the streams) and a 64-bit counter (incremented within a stream) for AES in CTR mode. How many different key streams can I produce with this setup?
2
votes
1answer
2k views

Using “Additional Authenticated Data” as a secondary key

In implementing a cipher in GCM or CCM mode, you are provided the option to add "Additional Authenticated Data" (AAD). This AAD is required for decrypting the cipher text, and seems to be used when ...
2
votes
1answer
1k views

Generating a strong unique Initialization Vector

How can I determine if I am generating a unique and strong Initialization Vector? If my mode is generating Keystream? Is there any scientific explanation in generating a unique and strong ...
2
votes
2answers
239 views

Byte location of plaintext vs ciphertext when using a block cipher or stream cipher

I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in ...
2
votes
1answer
3k views

Use of nonces in Kerberos and Needham–Schroeder protocols

Can you please explain me what is the reason of using nonces in the Needham-Schroeder and in the Kerberos protocols for Key Transport. In particular : Can you explain me the use of $N_A$? And ...
2
votes
1answer
264 views

Regarding matsui's Paper on Linear Cryptanalysis of DES

I's going throught the the Paper by Matsui on Linear Cryptanalysis of DES . In that he says $NS_{5}(16,15)=12$ And then in the next paragraph he says considering the expansion and permutation phases ...
2
votes
1answer
286 views

Separate Read and Write Keys in TLS Key Material

Why does the TLS protocol use different symmetric keys for receiving and sending data? Isn't it enough to have a single key used for both reading and writing?
2
votes
1answer
219 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. 2.2....
2
votes
1answer
917 views

Recovering the key in an ElGamal Signature Scheme variant

From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3: Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that ...
2
votes
1answer
300 views

Public Key Encryption with forward secrecy

Is there a known non-trivial system with plausibly secure public key encryption where: 1. $\;\;$ the $\:$ time $\:$ function is efficiently computable 2. $\;\;$ [pubkey,privkey] $\:$ pairs are ...
2
votes
2answers
1k views

Finding the LFSR and connection polynomial for binary sequence. [closed]

I have written a C implementation of the Berlekamp-Massey algorithm to work on finite fields of size any prime. It works on most input, except for the following binary GF(2) sequence: $0110010101101$ ...
2
votes
1answer
86 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
2
votes
1answer
1k views

RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
2
votes
1answer
113 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
229 views

Shannon entropy calculation: is $H(A|R·A) = H(A)$?

Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$. Now I take a non-random $m×m$ ...
2
votes
1answer
286 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
2answers
244 views

AESManaged Trade Compliance Issue in United States

I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the ...
2
votes
2answers
612 views

Is there an effective way for public key generation in homomorphic encryption schemes?

Is there any way to effectively generate valid distributed public key in schemes like ElGamal or Benaloh for a number of participants? There's no need in private keys since there's no intent to ...
2
votes
1answer
25 views

Older key as PGP subkey?

Currently I have a 2048-bit PGP key. Suppose I create a new 4096-bit key. Can I add that old key as a subkey of this new one?
2
votes
1answer
25 views

Last Sbox of a block cipher for Linear Cryptanalysis

I figured I should try to learn about linear cryptanalysis with a super simple cipher with only one Sbox. The problem is that with that approach the last subkey bits seem to be involved in the linear ...
2
votes
1answer
57 views

Are transposition ciphers insecure?

Given plaintext: P[i], i = 1..N Given stream of cryptographic numbers S[i, j], i = 1..N, S[i, j] in [1, j] generated by RC5 for example We encrypt using Fisher-Yates shuffle algorithm: ...
2
votes
2answers
60 views

Probability of hash collision in exhaustive mapping from input to output

Suppose I had a hash function which produced a 256-bits output for any given input (such as SHA-3-256). Now suppose i did an exhaustive mapping from every possible 512-bits input to a given 256-bits ...
2
votes
1answer
34 views

Am I correctly understanding TLS 1.2 PRF (Pseudorandom Function)?

According to RFC 5246 Section 5 PRF(secret, label, seed) = P_<hash>(secret, label + seed) and ...
2
votes
2answers
32 views

How to find the keyword of the Playfair text knowing/not knowing the plaintext and having decrypted text?

I know how the Playfair cipher works. I would like to know how can I find the keyword of the play fair cipher in two cases: 1) knowing the plaintext 2) not knowing the plaintext? Some examples: <...
2
votes
1answer
25 views

Using a round function intended for an SP network in a Feistel network?

If I use the round function from a secure SP network (such as AES) and use it in a Feistel netwok, is this a good starting point for the second cipher? My thought is "yes" because: it already has ...
2
votes
1answer
36 views

Why are {0,1}-matrices almost-MDS only when n is 2, 3, or 4?

In this paper authors claim that {0,1}-matrices are almost-MDS (have branch number n - 1) on when n is 2, 3, or 4. For example, how can this two matrices have the same branch number? $$\begin{pmatrix}...
2
votes
1answer
67 views

Cryptanalysis of XOR cipher with repeated key phrase

My assignment is to cryptanalyze cipher text that we know was encrypted with a stream cipher (bitwise XOR of plain text and key stream), and decrypt to plain text. We know the key stream is a repeated ...
2
votes
1answer
66 views

Get $a$ such that quadratic residue has a solution (Rabin)

My task is to implement Rabin signature. I have trouble with choosing padding a such that $$x^2 \equiv a \pmod n$$ has a solution. In that context, $n=p\cdot q$ is composite, where $p$ and $q$ are ...
2
votes
1answer
63 views

Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says: The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are ...
2
votes
1answer
58 views

How can I show RSA OAEP IND-CPA secure

How can I show, that RSA with OAEP is IND-CPA secure by using G,H one way function?
2
votes
1answer
68 views

Understanding the Hidden Subgroup Problem specific to Integer Factorization

I've been reading about the Hidden Subgroup Problem (HSP), specifically trying to understand how it is related to the integer factorization problem. I've read What exactly is the impact of the hidden ...
2
votes
1answer
33 views

Can (EC)DH keys be used as the signed content in X.509 certificates?

From Wikipedia's article on ECDH: The public keys are either static (and trusted, say via a certificate)… Also see this question on this very site. These indicate to me that a certificate (...
2
votes
1answer
47 views

reconstructing data on a noisy channel?

I have an interesting situation where I have a block cipher and a noisy channel. The interesting thing is that I happen to know much about the data. The cipher is a balanced Feistel network, and for ...
2
votes
1answer
206 views

Client Puzzles and HMAC

I'm learning about client puzzles for DoS (Denial of Services) Protection, and I came across this question. For each request, the server sends the client a freshly generated random challenge r and ...
2
votes
1answer
60 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
2
votes
1answer
64 views

Distinguishing two sets of pseudorandom values when their keys differ by one

Suppose we use a pseudorandom function $PRF$ and a random key $k$ to generate a set of pseudorandom values: $\forall i, 1\leq i \leq n: w_i=PRF(k,i)$ Now, consider instead of picking a fresh key, ...

15 30 50 per page