1
vote
0answers
40 views

PKCS#11 Sessions

I am maintaining an application that uses PKCS#11 to talk to a smartcard. Somehow a session gets generated, but i cant figure out where in the code. I am using c# and the PKCS11Interop wrapper. The ...
1
vote
0answers
36 views

Is it possbile to get same set of public and private keys twice while creating CSR ? If so where does the conflict happens !?

I'm new to cryptography and please clarify if my below assumption is wrong. Lets assume, that two different banks creating CSR and they get identical public and private key pairs of RSA. In such ...
1
vote
0answers
137 views

Is there specific name for simple XOR with ADD/SUB encoding?

Several years ago a group of malware authors began using code like this: for (j = 0; j < length; j++) ptr[j] = (ptr[j] ^ VALUEA) - VALUEB; for encoding, and ...
1
vote
0answers
40 views

Are there any existing ASN.1 structures for transferring symmetric keys?

Is there any reasonable ASN.1 standard to encode symmetric keys? I found PSKC, but it seems extremely heavy, and I can't quite find any library (e.g. bouncycastle) that would simplify using it. If ...
1
vote
0answers
23 views

LFSR, different bits from different initial states

Suppose we useLFSR, which gives output $x_1x_2x_3\dots$ from some particular initial state. From another state, different from previous, same LSFR though, it gives sequence $y_1y_2y_3\dots$ ...
1
vote
0answers
39 views

Symmetric stream cipher, is it known?

I am thinking on a simple symmetric stream cipher. My first idea is the following: The key is a set of array of random bytes ($\underline{k}_1$ ... $\underline{k}_n$), whose length is $l_1$, $l_2$, ...
1
vote
0answers
30 views

Where can I find a versatile PKI and library leveraging curve25519?

I note that Things that use Curve25519 provides a long list of protocols, software, and libraries that leverage curve25519, but I'm wondering if there is any such software that more fully implements a ...
1
vote
0answers
22 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
1
vote
0answers
54 views

2 round GOST_28147-89 cipher distinguisher

So, here is the scheme of how this will look graphically: The deal is to present distinguisher for this cipher. First of all here is my drafts: Way 1 Assume that distinguisher displays in ...
1
vote
0answers
562 views

Decrypt using OpenSSL produces packing errors

I am receiving an encrypted file and it's key from a partner. The Key has itself been encrypted using our Digital Certificate Public Key, though I don't know exactly how. The partner has instructed me ...
1
vote
0answers
43 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
1
vote
0answers
63 views

In DGHV FHE, why noise $r$ can be in $(-2^{\rho'}, 0)$?

"Fully Homomorphic Encryption over the Integer" described a simple FHE scheme based on the GACD assumption. Its encryption function (on page 6) has the form $c \leftarrow (m + 2r + 2*\sum_{i \in S} ...
1
vote
0answers
88 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
1
vote
0answers
61 views

Ciphertext size of any CPA-secure public-key encryption scheme

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ...
1
vote
0answers
78 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
1
vote
0answers
129 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
1
vote
0answers
309 views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
1
vote
0answers
65 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
1
vote
0answers
232 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
1
vote
0answers
52 views

FFX Encryption over alphabet of arbitrary radix

I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ...
1
vote
0answers
84 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
1
vote
0answers
50 views

What consequences do the plaintext space size has on the performances in the BGV scheme?

In the BGV paper [1], the authors say in §5.4 that you can have $\mathbb{Z}_p$ as plaintext size with a large $p$. What is the impact of the size of $p$ on the ciphertext size and computational work ...
1
vote
0answers
74 views

ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...
1
vote
0answers
46 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
1
vote
0answers
47 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
1
vote
0answers
41 views

Clarify EC point addition and multiplication

Please clarify the below doubt regarding EC point addition and multiplication: $P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows: $X = (a*P) + (b*P)$ $Y = ...
1
vote
0answers
90 views

Where can I find names for cryptographic notation I don't recognize?

I'm new to this space and find myself stumbling over come cryptographic/mathematical notation. Search engines are not very helpful when copying and pasting Greek letters. Is there any reference that ...
1
vote
0answers
102 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
1
vote
0answers
67 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one ...
1
vote
0answers
31 views

Voting protocol - How many dishonest tallying centres can the protocol cope with?

We have the voting protocol that is described here. I am looking at the following exercise: Determine how many dishonest tallying centres the protocol can cope with before the following properties ...
1
vote
0answers
43 views

Digital signature in a group chat scenario?

I understand that RSA is great for 1-to-1 digital signature. In the group chat of N people, other than storing and maintaining N public keys, is there a simpler way of authenticating each and everyone ...
1
vote
0answers
95 views

Unicity Distance - AES

I am quite confused calculating the unicity distance and I was hoping that someone can clarify some things for me. My main issue comes from somewhat a difference of the calculation given by our ...
1
vote
0answers
52 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
1
vote
0answers
55 views

Elliptic curve point addition

I have this curve in E(F131) : $$Y^2 = X^3 + X + 2 $$ I want calculate the sum P + Q considering that $$P= (5,1)$$ and $$ Q = (60, 49)$$ For calculate the result i use these formulas: $$ xr = ...
1
vote
0answers
134 views

My attempt of combining socialist millionaire and Diffie-Hellman. Is it any good?

I've come up with an algorithm to solve the socialist millionaire problem, but I'm not sure if the algorithm is secure. I wasn't able to find any flaw in it, but it seems too simple to be secure, so ...
1
vote
0answers
45 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute ...
1
vote
0answers
67 views

Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
1
vote
0answers
80 views

Does the encryption algorithm DES perform random permutations? If so how is information not lost?

Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are separately permuted (shuffled) My question is this : Is the shuffling of the bits performed ...
1
vote
0answers
56 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
0answers
80 views

What are some hashes that do not exhibit the avalanche effect?

I do not know much about cryptography. But, I'm in a situation where I need a hashing method that does not exhibit the avalanche effect. I tried Googling but couldn't find anything.
1
vote
0answers
82 views

How do I verify a reset token if the token is hashed in DB?

I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, ...
1
vote
0answers
45 views

Commitment scheme to share money

I have such problem: party $X$ has an amount of money $M$, which it needs to share with $n$ other parties. Every week the amount of money is different. Let say not, that I am a party A, which is one ...
1
vote
0answers
76 views

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the ...
1
vote
0answers
68 views

Matsui's Linear attack on DES P box

I'm trying to understand Matsui's linear attack on DES and I have something I don't understand in his paper. In his paper he say that: $NS_{5}(16,15)=12$ (which is OK) and from that he say that: ...
1
vote
0answers
55 views

How to securely map an element from an smaller domain to the other element in a large domain

Problem: I have a small sized domain, say s-bit. It's clear that the probability for an adversary to guess an element is $ \frac{1}{2^s}$. I need to make the probability negligible. However, I need to ...
1
vote
0answers
382 views

Montgomery Reduction

I'm taking a hardware cryptography class and working on a problem that focuses on Montgomery Reduction. So by definition: Computing a x b (mod N) Pick R, s.t. R > N, gcd (R,N) = 1 Compute N^-1 ...
1
vote
0answers
52 views

Cache Attacks on Cloud Infrastructures

I read something about cache attacks like this: Enter KSM (Kernel SamePage Merging). KSM enables the kernel to examine two or more already running programs and compare their memory. If any memory ...
1
vote
0answers
141 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
1
vote
0answers
51 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
1
vote
0answers
42 views

Using a Secure RNG in Probabilistic Fair Exchange

I am attempting to implement probabilistic fair exchange described in Probabilistic Non-Repudiation without Trusted Third Party. A secures a message using AES with 512 bit keys (in my ...

15 30 50 per page