# All Questions

1answer
78 views

### How to construct Hash function of type $H:\{0,1\}^x \times G \mapsto Z_p^*$?

In many cryptographic protocols design, I have seen the statement 'Choose a Hash function $H:\{0,1\}^x \times G \mapsto Z_p^*$ i.e a hash function which takes as input a binary string of finite ...
1answer
140 views

### Questions about a SHA3 cipher stream encryption scheme

I have written an encryption implementation using a hash as a cipherstream for demonstration purposes. I know it is slower than more sensible options such as AES but I am interested in several things, ...
1answer
66 views

### Extracting key bits from linear cryptanalysis equation for SDES

From the linear cryptanalysis of SDES, we get a linear equation consisting the K[1, 3] of the round key 1 and 2. From this how will I retrieve the key bit? How do we solve the linear equation we get ...
2answers
93 views

### Linear cryptanalysis complete key guessing

In linear crypt analysis, partial sub keys are guessed and verified for its correctness with the help of plaintext and ciphertext. From the partial sub key, how it is possible to guess the complete ...
1answer
61 views

### Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
1answer
105 views

### Is secure lattice based cryptography in future?

Lattice cryptography is a post quantum cryptography that work on two NP-hard problem in below: Find shortest nonzero vector from origin and Find minimum distance of a arbitrary point out of lattice ...
1answer
71 views

### Data Encryption Standard (DES) S-Boxes

I read that the S-boxes introduce the much needed nonlinear behavior to DES. Can someone give me a lay mans explanation of why the effect of the S-boxes is said to be non-linear?
1answer
332 views

### Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
1answer
51 views

### Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
1answer
72 views

### Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
2answers
83 views

### comparison of security for identity based signature and Hashing (SHA-1) the identities

I would like to know which method can provide better security: using identity based signature or hashing the identities and message (using SHA-1) for authentication?
1answer
64 views

### Which algorithm would be ideal for ephermal key generation followed by DH key exchange?

Bob and Alice, both generate a temporary public key pair each using X algorithm on their individual PC. After being authenticated by a third party, they use the DHE to come to get a common symmetric ...
1answer
114 views

### How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
1answer
58 views

### Perfect Forward Secrecy in PGP/asynchronous email

Looking at the RFC for PGP email/asynchronous chat with PFS here https://tools.ietf.org/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good? Alice and Bob retrieve each ...
1answer
74 views

### Does including the size of the hashed data improve security over just the hash

Trying to settle a discussion at work. We are mostly concerned with pre-image resistance. Suppose we have a common secure hash function $H$ (e.g. SHA-1/SHA-2) and some message $M$ we want to hash. ...
1answer
191 views

### How to prove secret value in Pedersen commitment is equal to secret value in Fujisaki commitment?

We have Pedersen commitment C to the secret value x, and Fujisake commitment C' to the secret value x. How can we make a zero-knowledge proof of equality for x value in the commitments?
1answer
64 views

### Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example: ...
1answer
38 views

### Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
1answer
63 views

### Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...
2answers
86 views

### Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext

This is my homework question (but I am not asking the answer to it): Suppose two users Alice and Bob have the same RSA modulus n and suppose that their encryption exponents eA and eB are ...
1answer
118 views

### Breaking a Modified Caesar Cipher

Does anyone know of an efficient way of breaking a modified Caesar cipher (where the key is a set of numbers (the amount of shift) that is repeated throughout the plaintext, e.g. {1,2,3,4,5}) via ...
1answer
95 views

### IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
1answer
149 views

### Encryption that can only be decrypted once?

I want to encrypt a message so that it can only be decrypted once. I know that we can use nonces to do this when we exchange data over a communication channel, but in my case the cipher text will be ...
1answer
70 views

### PublicKey Unknown Encoding

I have a public key: ...
1answer
270 views

### Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
1answer
52 views

### What is the most an adversary can do in the context of public key masquerading?

Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair: $$A: (P_A, S_A), B: (P_B, S_B)$$ and A already ...
1answer
85 views

### Collision likelihood from /dev/urandom for VMs using the same underlying hardware

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if ...
1answer
55 views

### Design for file transfers to a new party

I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet. Here's my current thought for Alice wanting to send Bob ...
1answer
49 views

### How to detect changes in data while preserving confidentiality (under constraints)?

Suppose party $A$ has two pieces of data, $X$ and $Y$, either of which may change separately, or they may change together. Given the following constraints: $A$ knows its current $X$ and $Y$ but has ...
1answer
254 views

Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ \operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$... 1answer 141 views ### Very short signatures? (eg: 48bits?) Our application requires some 'mild' form of 'proof of origin' for the tokens we issue (~200 bytes), however, the value of each is trivial. The requirement is to provide 'tamper resistance' rather ... 1answer 269 views ### Testing hash functions for collision resistance I was hoping to implement a software that allows testing a user-defined hash function for cryptographic properties (Meant to pique interest in cryptographic hash function for a school showcase), as ... 1answer 63 views ### What is the notion of an interactive assumption? In this paper: Sequential Aggregate Signatures with Short Public Keys: Design, Analysis and Implementation Studies the authors sell the paper as the first who propose Aggregate signatures without ... 1answer 165 views ### Wanted: Simple ring signature example I spent all day trying to figure ring signature schemes out but apparently I wasted time. I read the original ring signature paper (Rivest's How to leak a secret). I'm having numerous problems. Let's ... 2answers 70 views ### Profile Complexity LFSR I try to understand how Complexity of an LSFR calculated. For example I have a bit sequence 110101 and it's profile 1 1 2 2 3 3. Is there any easy way in order to produce the profile? 2answers 53 views ### Is it secure to use TOTP with same key and different time-counters? If I use TOTP to generate codes with different "expiration" time, using the same key for HMAC, will I create some kind of weakness? 1answer 62 views ### Is it possible to add error propagation to OTP? What would be the recipe to add error propagation to a one time pad? I.e. if I change a single letter in the clear text message, I want the encrypted message to change starting from that letter and up ... 1answer 189 views ### Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How? Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ... 1answer 162 views ### CPA and pseudorandom generator Just started learning about Cryptography and Network Security in general, and I can't seem to grasp the understanding of the following question. Please correct me if I am misunderstanding anything. ... 1answer 97 views ### Is Shoup's Practical Threshold Signatures considered secure? I am planning to use threshold cryptography in a Java application. So far, I have only found ThresSig and a ECDSA implementation used in TwoFactorBtcWallet. However, ThresSig is based on a 15-years ... 1answer 188 views ### OpenSSL ECDH key exchange mechanism I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ... 1answer 76 views ### Can we use the authentication tag as Nonce / IV for the next message? Let's assume we're in some scenario requiring transfer of large amounts of data. This means we can only use AES-GCM chunk-for-chunk as its maximal size is restricted to a few GiBs. This means we have ... 3answers 73 views ### Digital signature algorithms within the European Union I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages? I ... 1answer 95 views ### Is there a standard for public key encrypting and signing short messages? Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate ... 1answer 102 views ### Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification? Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ... 2answers 94 views ### What kind of operations are involved in NTRU? I've read that lattice based algorithms involve matrix-vector products. Is this the case of the NTRU algorithm? When I've read the details of the NTRU algorithm, I've seen products of polynoms. Where ... 1answer 181 views ### How AES treat string input to encrypt data and what will happen if the cipher key is less than that expected? The official docs of AES have several example of how hexadecimal or byte input can be encrypted. I have some problem about the input text and cipher key. My question is: How can encrypt string input ... 1answer 126 views ### Is the ring of octonions “commonly” used in Cryptography? I've recently read "Fully Homomorphic Encryption on Octonion Ring" by Yagisawa, which is based on octonion rings over finite fields. Personally I've never encountered octonion rings in cryptography ... 1answer 71 views ### Using AES for smaller blocks in a Feistel network I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext ... 1answer 92 views ### Converting a pre-image resistant hash to second pre-image resistant I am looking for some standard conversion from any hash function$f\$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?

15 30 50 per page