# All Questions

145 views

### Known plaintext attack on 3 round SIMON block cipher

I am attempting to write a program to perform a linear approximation attack on a reduced round version of the SIMON block cipher, but I am stuck on how to actually apply the linear approximation to ...
865 views

### nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL ...
129 views

### Generate hash value using public key along with message

I was trying to understand one way signature chaining on message by Saxena and Soh. As the message is passed from one user to other, every user can combine their signature to create one single ...
81 views

### Algebraic cryptanalysis on public-key schemes

The book Algebraic Cryptanalysis (Bard, G.V.; Springer, 2009) speaks about transforming a symmetric scheme into a system of polynomial equations and solving these equations to break the scheme. But ...
124 views

### difference between soundness in ZKPoK and special soundness for sigma proofs

What is the difference between soundness in ZKPoK and special soundness for sigma proofs?
107 views

329 views

### Which characters to take into account when calculating unicity distance?

I need to calculate the unicity distance of a block cipher. Assuming I know that the plaintext is an English message I considered using 53 as the size of the alphabet, since the message could contain ...
80 views

### One-way function definition

I cannot understand why a one-way function $f$ is defined in this way $\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$ and not $\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$ where $A$ is a ...
51 views

### Is it possible: Derived key based on variable number of private keys?

I have a MySQL database that I want to encrypt with AES_ENCRYPT() and have to provide access to a variable and possibly changing number of users. Is it possible to derive an encryption key based on a ...
75 views

### Differential Privacy and appropriate noise distribution

In differential privacy solutions and more specifically for queries that they do entail counting the proposed solutions define the Laplace distribution that is best calibrated for low error. Other ...
69 views

### Feldman's VSSS: Showing the Correctness of shares that are Consistent

This is something with which I am struggling to get my head around. In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients ...
101 views

### Effect of CFB IV reuse

If an Initialization Vector (IV) is reused (under the same encryption key) in Cipher Feedback Mode (CFB), what is the effect upon security? I know there is some negative effect upon security, but I ...
448 views

### Key derivation of public key without knowledge of private key

I'm looking for a convenient way to share a set of public keys across multiple services, while preserving privacy by preventing these services from tying the identity of these public key sets together ...
348 views

### Deduplication: Encrypting the SHA-256 hash of a file chunk

I'm designing a data storage system that should be both able to deduplicate data that share the same encryption key, and be reasonably secure. I know that this kind of encryption quality can be ...
85 views

### Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
68 views

### Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption?

Can a cryptosystem be unconditional secure if the same key $k \in \mathcal K$ is used for more than one encryption ? I know that the one-time-pad doesn't have perfect secrecy and doesn't provide ...
95 views

### Security of DES P_BOX

I'm curious about the design of the P_BOX of DES. I found a paper on this topic, but it dates back to 1989. This means the effect of p-box values of the cipher immunity against Differential ...
2k views

### Difference between Symmetric and Asymmetric. Is this answer correct, based on a written test?

I asked the following question on a final exam: Symmetric Ciphers (e.g. AES, DES, Blowfish) use up to 256 bit on the best case, which are considered strong against brute-force attacks. On ...
276 views

### Finding Elliptical curve points and encoding text using them

I recently got into learning Elliptical curve cryptography and are currently building a project in C#. Everything is working well so far, I can encode and decode points, and thanks to this forum I ...
97 views

### Is there an “additive” proof-of-work?

I'm trying to find a proof-of-work algorithm with the following properties: If A(1) is a proof of work with Difficulty(A(1))=n (requires n basic operations on average), then one can find a proof of ...
111 views

### To prove $r \cdot f_1 +f_2 \cdot (s+1)$ is secure

We define the polynomials $r, f_1,f_2,s \in R[x]$. Where $r$ is a random degree 1 polynomial and $s$ is a random polynomial such that: $degree(s)=degree(f_1)=degree(f_2)$, let $R$ be $\mathbb{Z}_p$ ...
80 views

### ASCII input to HMAC weaker than raw bytes?

In various cryptographic programs I've written (most have been toy problems, but this current one is not) I have taken a slothful approach to performing a message digest (hash) of numerical input. I ...
837 views

### what are the security benefits of LUKS?

Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask. Given the LUKS header contains ...
92 views

### How can a good encryptor be made?

I am making an encryptor software for a stream cipher with my own PRNG as a project for an inter school science competition. How can I make one so that after it generates the pseudo random nos. it can ...
240 views

### Large file validation on an embedded system through hash and encryption

As a preface, I have to say that I am a noob in this area. Having said that, I will ask the question. I have a situation where I need to validate and protect against tampering a handful of large ...
1k views

### Format Preserving Encryption for 32 or 64 bit plaintext values

I am looking for a Format Preserving Encryption implementation to apply to either a 32-bit or a 64-bit integer. It looks like AES/FFX mode is just what I need in terms of established security ...
130 views

### Implementation of garbled circuits using RSA

I was just reading these notes on garbled (Yao) circuits and I just stuck trying to figure out how an implementation of Table 1 would work using RSA encryption. In RSA the public key is (n,e). So for ...
380 views

### Serpent 256bit key wrong round keys

Assume that we have this 256bit key: 15FC0D48 D7F8199C BE399183 4D96F327 10000000 00000000 00000000 On first 0-7 keys we can't apply formula wi=(wi-8 xor wi-5 xor wi-3 xor wi-1 xor phi xor ...
477 views

### Generation of N bit prime numbers -> what is the actual range?

Short version: When generating a prime number of N bits, should I draw random numbers from the range $[0 , 2^n]$, or $[2^{(n-1)} , 2^n]$? Context: I'm trying to implement a toy-version of RSA as a ...
79 views

### Committing Bilinear equation in Groth-Sahai framework

Groth-Sahai framework enables us to commit to QE, MSME, PP equations. Now, is the equation below committable in GS framework? A bilinear map $e: G_1 \times G_2 \rightarrow G_T$. $g_1 \in G_1$ and ...
447 views

### VKO GOST R 34.10-2001 (described in RFC4357), Key Agreement Algorithm. Looking for its implementation/detailed description/examples

VKO GOST R 34.10-2001 was described in RFC4357 Page 7 But the description is very poor. Here it is: This algorithm creates a key encryption key (KEK) using 64 bit UKM, the sender's private key, ...
136 views

### Help to understand the chameleon hash function?

Recently, I'm reading Non-Interactive Key Exchange, in the section 4.2(Towards a factoring-based scheme in the standard model,Page 10), the authors uses t\gets ChamH_{hk}(Z||ID;r);\\ Y\gets ...
278 views

### How can I map arbitrary group elements to unique integers without using Hash functions?

Let's say, I have a group $G$ of large prime order $p$. A set $S$ consists of $n$ random elements chosen from $G$. Without using a collision resistant hash function $H$, how can I map elements of $G$ ...
976 views

### SHA512withRSA - Looking for details about the Signature Algorithm

I am trying to find information about the Signature Algorithm SHA512withRSA and have been unsuccessful so far. In the current state, the signature is too long, so I would like to check the code for ...
128 views

### Generating S boxes that satisfy Coppersmith's criteria?

I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts: How many such S-Boxes are possible? Is there any ...
156 views

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
187 views

### Is multiple encryption using NaCL and TLS better?

In general, the idea of multiple encryption sounds interesting - for creating stronger cyphers (especially against implementation bugs), one could always get the configuration details wrong and mess ...
285 views

### Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
103 views

### How can finding a collision help an attacker with tampering messages with HMAC

As stated in the HMAC RFC (RFC 2104): The strongest attack known against HMAC is based on the frequency of collisions for the hash function H. How can a collision benefit an attacker? I would ...
217 views

I recently came across an interesting paper detailing the use of hardened session cookies. Each cookie includes a preimage of the password hash, and the preimage is hashed once more and compared to ...