2
votes
1answer
224 views

Is there an efficient way to hide the encrypted plaintext length with a block cipher?

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
2
votes
1answer
494 views

Generate an insecure public / private key pair

I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods. As far as I know PGP ...
2
votes
1answer
402 views

Questions about proof of correct encryption in the Paillier cryptosystem

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ...
2
votes
1answer
212 views

Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, ...
2
votes
1answer
123 views

How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
2
votes
1answer
929 views

How to break AES CBC with PKCS#5 padding?

If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?
2
votes
1answer
388 views

ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
2
votes
1answer
179 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
215 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
221 views

Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
2
votes
1answer
584 views

What's a good P to use in ElGamal key generation?

I need to generate a 1024 bit ElGamal key on Android, and key generation takes forever (~10 minutes on a Galaxy Nexus), I suspect because it take so long to generate a safe prime. Is it dangerous for ...
2
votes
1answer
119 views

Is it safe to hold key file's hash in application

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)? Thanks
2
votes
1answer
377 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
2
votes
1answer
550 views

Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
2
votes
1answer
193 views

In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
2
votes
1answer
455 views

DGK Cryptosystem Encryption Speedup

Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
2
votes
2answers
11k views

OTP from Sony BIOS password recover [closed]

From Dogbert's blog: Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the ...
2
votes
1answer
81 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
2
votes
1answer
203 views

RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
2
votes
1answer
919 views

HASH Algorithm for 8 bits MCU

I need to implement the HASH algorithm (MD5 & SHA-1) on an 8 bit MCU. I hear it can only be implemented on 32bit and sometimes 16bits MCU. Is that possible? I will appreciate link where possible. ...
2
votes
1answer
289 views

How does the energy consumption of the SHA-3 finalists compare?

I am curious, is there any paper where SHA-3 competitors are compared in terms of energy efficiency?
2
votes
1answer
620 views

Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
2
votes
1answer
972 views

Verilog simulation of Data Encryption Standard

I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance .
2
votes
0answers
79 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
2
votes
1answer
42 views

Why are the bit lengths of keys and digests equal in Lamport signatures?

In Lamport's one time signature scheme: One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$. Cryptographic hash function to ...
2
votes
1answer
63 views

How to detect what crypto-method is used by Filecoder.Q?

I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q". How to detect the encryption method that is used and the key, that is not using any ...
2
votes
0answers
19 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
2
votes
1answer
30 views

On the security definition of password-authenticated key exchange

I found in all PAKE papers, the security is defined as something like this: Let $Succ(A)$ be the probability that an attacker $A$ successfully distinguished the session key from a random string. Then ...
2
votes
0answers
57 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
2
votes
0answers
30 views

CryptDB data re-encryption and onion layers

From the CryptDB paper , I understoond that the onion layers once decrypted are not re-encrypted. Only columns which are queried infrequently will be re-encrypted to higher onion layers. But if we ...
2
votes
0answers
41 views

Unpredictable value rotation

I have very vey basic skills in cryptography, it's hard for me to explain clearly my problem so I will start with an example. Estimote beacons have a security function called secure UUID, once ...
2
votes
2answers
103 views

How do I create a secure encryption scheme using addition?

You have a 4 number long PIN code with each number ranging from 0 to 9 which you wish to encrypt. You are then given a random 4 digit number ranging from 0 to 9999, which when added to the original ...
2
votes
0answers
16 views

Decoding the Playfair cipher with a crib [duplicate]

I have a Playfair cipher text and I know a portion of the text (one world). How can I decode the cipher from here? Thanks.
2
votes
0answers
59 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
2
votes
0answers
28 views

RC6-like key schedule with 16-bit S-boxes

I am trying to figure out an encryption algorithm whose key schedule function seems to be similar to RC6. However, it seems to be creating S-Boxes using 16-bit integers instead of 32-bit ones. I have ...
2
votes
0answers
27 views

Some questions about the internals of bcrypt [duplicate]

I'm attempting to get a better understanding of cryptography and have run into some questions about bcrypt. Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But ...
2
votes
0answers
27 views

Would LWE problem be still secure if error were like this $e=2e_1$?

In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE ...
2
votes
0answers
47 views

What is perfect collision-resistence in probability terms?

update: removed lots of stupidity... sorry. I didn't know I can be this stupid but I achieved it. 1. Goal Let $\mathcal{D}$ be the universal space of our plain data. Our goal is to find a function ...
2
votes
0answers
18 views

CRL number generation sequence

RFC 5280 states that the CRL number should be monotonically increase. I have seen this common practice of incrementing the CRL number by 1, everytime a new CRL is generated. But can i use epoch time ...
2
votes
0answers
48 views

Prove that the given scheme is CPA secure or not

Given: F is a length preserving PRP. Encryption scheme $\Pi$ for messages of n/2 bits where: $m\in\{0,1\}^{n/2}$ $k\in\{0,1\}^n$ Enc: Select a random string $r\in\{0,1\}^{n/2}$ and output ...
2
votes
0answers
69 views

how to verify subset of hashes from hash list

I need to verify a couple hashed (SHA256) integers from a list of approximately 50 hashed integers in a message. The list can be divided into groups. The (plain) integer data is not in the message, ...
2
votes
0answers
30 views

Password hashing in embedded systems

Are there good options for password hashing in embedded systems? These systems often cannot afford slow has functions. I can think of a few approaches: Store the (hashed) passwords in a HSM that ...
2
votes
0answers
36 views

How would you name and/or describe this algorithm?

First up: this is not a decoding request or anything. This is about terminology. Twice per year, we email another department to ask for a new licence file for their software. They are always slow to ...
2
votes
1answer
106 views

Doubling the block length of a given block cipher

IMHO the main essence of a Feistel cipher of block length $n$ is the working of a non-linear function $F$ that is applied to the two halves of the block of length $n/2$. Now suppose a certain block ...
2
votes
0answers
25 views

Are there unreachable MD5 hashes? [duplicate]

Are there any known MD5 hashes that can´t occure, no matter what (finite) input is taken? Thanks
2
votes
1answer
52 views

Why is AES-128 considered secure while RSA needs a 1024-bit size to be considered secure [duplicate]

I got asked this question today and I didn't know the answer, AES-128 is considered secure, the key size is 2^128, so you would need in average 2^127 tries to break the key. Why does RSA need at least ...
2
votes
1answer
61 views

Compression in key generation of DES algorithm

Does anyone have a pseudo-code or an algorithm or even a diagram of the compression (pc2) of the DES algorithm? I can't find a relation between the bits that are dropped, even when I do it manually ...
2
votes
1answer
79 views

Construction of division polynomials

I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ...
2
votes
0answers
32 views

Are collisions in AES-128 theoretically possible when the plaintext is the same? [duplicate]

Is it theoretically possible to find $P$, $K$, and $K^\prime$ such that $E_K(P) = E_{K^\prime}(P)$ where $E$ is AES-128 and $K \ne K^\prime$? I'd imagine this would be infeasible, but is it actually ...
2
votes
0answers
56 views

Q: Relevance of physical layer security to cryptography

I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly ...

15 30 50 per page