1
vote
0answers
60 views

Efficient Robust Private Set Intersection Additive ElGamal [duplicate]

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ...
2
votes
2answers
335 views

Random numbers for Rabin-Miller primality tests

I've implemented a Rabin-Miller primality test fuction following Wikipedia and the book Applied Cryptography. Now I'm using it for generating primes with a string seed. The book suggests the following ...
12
votes
3answers
1k views

How long will my encryption remain private?

This is a basic question in cryptography but I have not found a good, comprehensive answer. It is explained that our keys should expire and we should get new, stronger ones with time, reflecting more ...
1
vote
2answers
305 views

What does $\Pi$ represent in cryptography?

I am doing a project in cryptography and while reading a tag generation algorithm for files, I got stuck with the meaning of $\Pi$. The screenshot of the algorithm is inserted below. Here the ...
1
vote
1answer
67 views

when to do elgamal exponentiation computation

Recetly while studying about cryptographic primtives, I have come across below line in wiki : http://en.wikipedia.org/wiki/ElGamal_encryption Encryption under ElGamal requires two exponentiations; ...
-1
votes
1answer
236 views

Are the protocols DH-EKE, B-SPEKE, A-EKE, and SRP are considered challenge-response authenticaion mechanisms? [closed]

I got confused which one is considered challenge-response mechanism which one is not.
3
votes
1answer
218 views

Does changing the random number selected for each message increase security in Schnorr's scheme?

I was reading about Schnorr's scheme and in that for signing the signer generates a random number and continues with his operation. I am trying to implement this in a scenario where the signature ...
1
vote
0answers
97 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
3
votes
2answers
185 views

ElGamal in private set intersection: how to handle negative numbers?

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...
3
votes
1answer
291 views

A fast non-cryptographic hash function that is “strong enough”?

I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets. The first idea that came into mind was ...
1
vote
1answer
82 views

Secret key model for a compression function cryptanalysis?

How do we analyze the security of a compression function in the secret key model? More formally, let $H$ be a hash function and $F(IV,M)$ its compression function. Suppose we generate a MAC as ...
1
vote
1answer
117 views

Cryptography: Oblivious Transfer with at most one transfer?

I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function $\text{F}$ with two parameters. $\text{F}(x,y)$ randomly returns $p$ to alice and $q$ to Bob ...
-2
votes
3answers
2k views

How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
6
votes
2answers
3k views

If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?

If someone gives me their PGP key, can I use it with GPG, and vice versa, all the time (100% interchangeable)? Or are there times when they are not compatible, when only PGP can be used with a PGP ...
-2
votes
5answers
238 views

Is symmetric encryption no longer necessary?

Here is it: Symmetric encryption is no longer necessary, because all security services can be implemented with public-key cryptography. Moreover, in public key cryptography the operations for ...
3
votes
1answer
226 views

How to protect against ephemeral key reuse in some signature schemes?

Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this? I'll elaborate more: if you reuse the ephemeral ...
2
votes
1answer
199 views

Shamir Secret Sharing Modular Reduction

Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$. Of course they can ...
6
votes
2answers
249 views

Secure degree reduction for Shamir's secret sharing

I understand the basic Shamir Secret Sharing protocol, and when two shares are multiplied, the degree of the polynomial increases. I've seen in a number of papers a reference to a degree reduction ...
2
votes
4answers
1k views

RSA with composite numbers

It has been said that RSA uses a modulus product of two prime numbers for security reasons. But does RSA even work correctly if we allow composite integers instead? I think that the answer is "NO". ...
8
votes
1answer
462 views

What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
2
votes
2answers
252 views

Impact of distinguishing between random text and cipher text?

In theory, distinguishing cipher text from random text is considered insecure for any PRP algorithm. Say for example - due to Patarin's proof with about six rounds of Feistel Network - the attacker ...
2
votes
1answer
186 views

Question about SHA-2 (and potentially similar hashing algorithms)

I have been educating myself recently about the SHA-2 hashing algorithm, and in the midst of this pursuit, I've encountered a question: This algorithm uses a set of constant hexadecimal values, ...
4
votes
2answers
1k views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
1
vote
1answer
63 views

byte length and offset for k3d3/ed25519 byte[] variables?

I've discovered for myself that java's BigInteger is very slow, so I'm trying to weakly optimize this java implementation of ed25519 which I will fork and post if ...
2
votes
1answer
297 views

Using KDF output for password validation

I am currently revising an AES data format. I would like to determine whether a provided password/key is incorrect. Previously this was done by validating the HMAC, but this makes it impossible to ...
0
votes
0answers
88 views

Question Error Correcting Codes

Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let ...
1
vote
1answer
211 views

Regain 3DES ECB key, assuming I have both encrypted and decrypted text

Let's assume I've encrypted some text with some 24-byte key using 3DES in ECB mode. Is it possible to regain the key if I have both encrypted and decrypted text? (Excluding bruteforce.)
1
vote
0answers
198 views

inverse of scalar multiplier in ECC

I am learning to use ECC. i got into situation where i have $Q=abG$, where $G$ is the generator of the finite field formed on EC using a prime $p$ modulus and $a$ , $b$ are random numbers. now suppose ...
3
votes
2answers
326 views

Breaking a PRNG Scheme

Assume the following scheme for a PRNG generating decimals in [0,100) Given a message and a key, compute tag := HMAC512(message, key). Take the first 5 hexadecimal characters of the tag. If the ...
1
vote
1answer
275 views

Hash 22 byte secret into 512 bit hash: Full entropy?

Does it make sense to hash a 22 byte secret (which may not have full entropy since it is chosen by the user) into a 512 bit hash (using Keccak-512)? More precisely, will the 512 bit hash have full ...
2
votes
1answer
154 views

Efficiently computing the neutral element in a ring isomorphic to Z/NZ?

Edited to clarify question So my question is whether anyone knows of an efficient way to compute the neutral element (I'm gonna call it 1, but the operation doesn't have to be multiplication) in an ...
1
vote
1answer
5k views

How can i predict the next number of a long sequence of seemingly random numbers? [closed]

How can I accurately predict the next random number between 1 and 999, given past results. I have no knowledge of the PRNG or algorithm used. How can I predict the next number of a long sequence of ...
3
votes
1answer
376 views

TLS: Is Integrity assured when using NULL cipher

In specific implementation we're using TLS 1.0, open ssl 0.9.8 but i'm referring to RFC 5246. For performance reasons, I'm being asked if we can use TLS without encryption. The hope is that the ...
5
votes
2answers
81 views

What does it mean that $BW_N$ is a permutation over the squares mod N?

Let $BW_N$ be a function such that $BW_N:\mathbb{QR}_{N} \mapsto \mathbb{QR}_{N}$ and let if be defined as follow: $BW_N(x) = x^2 \pmod N$ where $N=pq$ and p and q are primes and $p=q=3 \pmod 4$. I am ...
2
votes
1answer
658 views

AES mode for file encryption

I'm working on software that should eventually result in a crypto file system similar to encfs. So far, i have a user password that goes through PBKDF2 using ...
1
vote
1answer
163 views

Hashing entropy generator output with SHA256

I'm using SHA256 to hash the output of an entropy generator to generate random numbers. Is it generally better to treat the output of the entropy generator as single messages and hash each of those ...
1
vote
0answers
196 views

Rabin code same message sent with different $N$

I use Rabin code with modulus $N$. Now assume that Alice sends me a message $m$ $(1\le m\le N)$ encoded by Rabin code. Unfortunately after Alice sent me the text I lose the information about the ...
6
votes
1answer
157 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
3
votes
2answers
2k views

ASCII to same-length ASCII encryption?

I need to encrypt an ASCII string [a-zA-Z0-9:] to an ASCII [a-zA-Z0-9] string of the same length. It doesn't have to be unbreakable, it's sufficient that it won't be readable at the first sight. The ...
1
vote
0answers
69 views

Looking for alternative key stretching

I am by no means a security expert, but I am curious whether functions that don't produce different outputs when raised to the power of N (without any psuedo-randomness) exist, that are as strong as ...
1
vote
1answer
168 views

Attack on BB84 algorithm for quantum key exchange?

I have a question which is related to the BB84 cryptosystem. We are not able to send single photons so instead we send $K$ photons at a time all with the same polarization. An enemy can separate one ...
3
votes
1answer
456 views

Is SHA-256 safe when used in this way?

I am wondering whether an attacker can gain any useful information from having several hashes of an unknown plaintext that differs in relatively few bits. For example, if provided with: ...
5
votes
1answer
211 views

How can I break this encryption scheme?

Let $p$ be a large public prime. Alice holds a private key $(e_1,d_1) \in Z_{p-1}^*$ such that $e_1 d_1 = 1 \mod {p-1}$. Bob also holds a different private key $(e_2,d_2)$ with the same property. ...
5
votes
2answers
117 views

Why is this authentication procedure using Rabin crypto not useful?

A friend asked me the following, pointing out that the method is not very useful (my problem is I do not see why it is not good): Consider a person A which chooses $n$ as the public key for the ...
4
votes
1answer
182 views

Encrypting a TCP connection between two unknown nodes

I'm writing an application for controlling computers from a client. I'd very much like it if the connection is secure and only authenticated clients are allowed access. The workflow will be ...
3
votes
1answer
213 views

AES: Is it safe to encrypt same cleartext with same key but with million diferent IV?

The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit. I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV. My ...
5
votes
2answers
502 views

RSA cipher wrong use

Why is it foolish if you decide to use an RSA cipher to encode some message by first converting each letter of the message to an integer? So for exmaple Space=0, a=1, b=2,... After the conversion I ...
3
votes
1answer
125 views

One-time pad mistake in the transmission?

I have a question which arised by analyzing the one-time pad cipher. I encrypt a binary sequence $a_1,a_2,..,a_N$ using a one-time pad with key sequence $k_1,k_2,k_3,...$, so I send $a_1+k_1, ...
3
votes
2answers
700 views

What was the problem in the SSL version 2.0?

What is the main reason (attacks) the appearance of the protocol SSL version 2.0 to replace version 3.0?
2
votes
1answer
148 views

Digicipher and other proprietary systems?

I've always been curious as to how Pay-TV and other Conditional Access systems actually stay secure for any amount of time, given that they are usually one way and (I'm assuming) use symmetric keys ...

15 30 50 per page