2
votes
1answer
78 views

How to construct Hash function of type $H:\{0,1\}^x \times G \mapsto Z_p^*$?

In many cryptographic protocols design, I have seen the statement 'Choose a Hash function $H:\{0,1\}^x \times G \mapsto Z_p^*$ i.e a hash function which takes as input a binary string of finite ...
2
votes
1answer
140 views

Questions about a SHA3 cipher stream encryption scheme

I have written an encryption implementation using a hash as a cipherstream for demonstration purposes. I know it is slower than more sensible options such as AES but I am interested in several things, ...
2
votes
1answer
66 views

Extracting key bits from linear cryptanalysis equation for SDES

From the linear cryptanalysis of SDES, we get a linear equation consisting the K[1, 3] of the round key 1 and 2. From this how will I retrieve the key bit? How do we solve the linear equation we get ...
2
votes
2answers
93 views

Linear cryptanalysis complete key guessing

In linear crypt analysis, partial sub keys are guessed and verified for its correctness with the help of plaintext and ciphertext. From the partial sub key, how it is possible to guess the complete ...
2
votes
1answer
61 views

Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
2
votes
1answer
105 views

Is secure lattice based cryptography in future?

Lattice cryptography is a post quantum cryptography that work on two NP-hard problem in below: Find shortest nonzero vector from origin and Find minimum distance of a arbitrary point out of lattice ...
2
votes
1answer
71 views

Data Encryption Standard (DES) S-Boxes

I read that the S-boxes introduce the much needed nonlinear behavior to DES. Can someone give me a lay mans explanation of why the effect of the S-boxes is said to be non-linear?
2
votes
1answer
332 views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
2
votes
1answer
51 views

Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
1answer
72 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
2
votes
2answers
83 views

comparison of security for identity based signature and Hashing (SHA-1) the identities

I would like to know which method can provide better security: using identity based signature or hashing the identities and message (using SHA-1) for authentication?
2
votes
1answer
64 views

Which algorithm would be ideal for ephermal key generation followed by DH key exchange?

Bob and Alice, both generate a temporary public key pair each using X algorithm on their individual PC. After being authenticated by a third party, they use the DHE to come to get a common symmetric ...
2
votes
1answer
114 views

How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
2
votes
1answer
58 views

Perfect Forward Secrecy in PGP/asynchronous email

Looking at the RFC for PGP email/asynchronous chat with PFS here https://tools.ietf.org/html/draft-brown-pgp-pfs-03 can anyone tell me why the following scheme is no good? Alice and Bob retrieve each ...
2
votes
1answer
74 views

Does including the size of the hashed data improve security over just the hash

Trying to settle a discussion at work. We are mostly concerned with pre-image resistance. Suppose we have a common secure hash function $H$ (e.g. SHA-1/SHA-2) and some message $M$ we want to hash. ...
2
votes
1answer
191 views

How to prove secret value in Pedersen commitment is equal to secret value in Fujisaki commitment?

We have Pedersen commitment C to the secret value x, and Fujisake commitment C' to the secret value x. How can we make a zero-knowledge proof of equality for x value in the commitments?
2
votes
1answer
64 views

Cryptographic hash with ability to ignore specific bits based on a hidden pattern?

I'm looking to use password-style hashing to validate an environment, where some parts may be irrelevant. For example: ...
2
votes
1answer
38 views

Should I authenticate memory data which was loaded from authenticated disk file?

Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to ...
2
votes
1answer
63 views

Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...
2
votes
2answers
86 views

Find plaintext of RSA by solving extended euclidean algorith for two encrptions with two different exponents for same plaintext

This is my homework question (but I am not asking the answer to it): Suppose two users Alice and Bob have the same RSA modulus n and suppose that their encryption exponents eA and eB are ...
2
votes
1answer
118 views

Breaking a Modified Caesar Cipher

Does anyone know of an efficient way of breaking a modified Caesar cipher (where the key is a set of numbers (the amount of shift) that is repeated throughout the plaintext, e.g. {1,2,3,4,5}) via ...
2
votes
1answer
95 views

IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
2
votes
1answer
149 views

Encryption that can only be decrypted once?

I want to encrypt a message so that it can only be decrypted once. I know that we can use nonces to do this when we exchange data over a communication channel, but in my case the cipher text will be ...
2
votes
1answer
70 views

PublicKey Unknown Encoding

I have a public key: ...
2
votes
1answer
270 views

Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
2
votes
1answer
52 views

What is the most an adversary can do in the context of public key masquerading?

Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair: $$ A: (P_A, S_A), B: (P_B, S_B)$$ and A already ...
2
votes
1answer
85 views

Collision likelihood from /dev/urandom for VMs using the same underlying hardware

We have multiple virtual machines sharing the same physical hardware. We use /dev/urandom for session key generation. But a question comes up: if ...
2
votes
1answer
55 views

Design for file transfers to a new party

I'm pondering a problem of how to enable transfers of files from clients to people that does not yet have an application/account/keys yet. Here's my current thought for Alice wanting to send Bob ...
2
votes
1answer
49 views

How to detect changes in data while preserving confidentiality (under constraints)?

Suppose party $A$ has two pieces of data, $X$ and $Y$, either of which may change separately, or they may change together. Given the following constraints: $A$ knows its current $X$ and $Y$ but has ...
2
votes
1answer
254 views

Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts

Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ $$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$...
2
votes
1answer
141 views

Very short signatures? (eg: 48bits?)

Our application requires some 'mild' form of 'proof of origin' for the tokens we issue (~200 bytes), however, the value of each is trivial. The requirement is to provide 'tamper resistance' rather ...
2
votes
1answer
269 views

Testing hash functions for collision resistance

I was hoping to implement a software that allows testing a user-defined hash function for cryptographic properties (Meant to pique interest in cryptographic hash function for a school showcase), as ...
2
votes
1answer
63 views

What is the notion of an interactive assumption?

In this paper: Sequential Aggregate Signatures with Short Public Keys: Design, Analysis and Implementation Studies the authors sell the paper as the first who propose Aggregate signatures without ...
2
votes
1answer
165 views

Wanted: Simple ring signature example

I spent all day trying to figure ring signature schemes out but apparently I wasted time. I read the original ring signature paper (Rivest's How to leak a secret). I'm having numerous problems. Let's ...
2
votes
2answers
70 views

Profile Complexity LFSR

I try to understand how Complexity of an LSFR calculated. For example I have a bit sequence 110101 and it's profile 1 1 2 2 3 3. Is there any easy way in order to produce the profile?
2
votes
2answers
53 views

Is it secure to use TOTP with same key and different time-counters?

If I use TOTP to generate codes with different "expiration" time, using the same key for HMAC, will I create some kind of weakness?
2
votes
1answer
62 views

Is it possible to add error propagation to OTP?

What would be the recipe to add error propagation to a one time pad? I.e. if I change a single letter in the clear text message, I want the encrypted message to change starting from that letter and up ...
2
votes
1answer
189 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
2
votes
1answer
162 views

CPA and pseudorandom generator

Just started learning about Cryptography and Network Security in general, and I can't seem to grasp the understanding of the following question. Please correct me if I am misunderstanding anything. ...
2
votes
1answer
97 views

Is Shoup's Practical Threshold Signatures considered secure?

I am planning to use threshold cryptography in a Java application. So far, I have only found ThresSig and a ECDSA implementation used in TwoFactorBtcWallet. However, ThresSig is based on a 15-years ...
2
votes
1answer
188 views

OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
2
votes
1answer
76 views

Can we use the authentication tag as Nonce / IV for the next message?

Let's assume we're in some scenario requiring transfer of large amounts of data. This means we can only use AES-GCM chunk-for-chunk as its maximal size is restricted to a few GiBs. This means we have ...
2
votes
3answers
73 views

Digital signature algorithms within the European Union

I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages? I ...
2
votes
1answer
95 views

Is there a standard for public key encrypting and signing short messages?

Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate ...
2
votes
1answer
102 views

Is a 256 bit HMAC-SHA256 key compromised if the tail is used for identification?

Using a truncated hash of a key seems to be a safe way to identify the key (i.e. key fingerprint), but what about truncating a key itself in the case of HMAC-SHA256? Example: ...
2
votes
2answers
94 views

What kind of operations are involved in NTRU?

I've read that lattice based algorithms involve matrix-vector products. Is this the case of the NTRU algorithm? When I've read the details of the NTRU algorithm, I've seen products of polynoms. Where ...
2
votes
1answer
181 views

How AES treat string input to encrypt data and what will happen if the cipher key is less than that expected?

The official docs of AES have several example of how hexadecimal or byte input can be encrypted. I have some problem about the input text and cipher key. My question is: How can encrypt string input ...
2
votes
1answer
126 views

Is the ring of octonions “commonly” used in Cryptography?

I've recently read "Fully Homomorphic Encryption on Octonion Ring" by Yagisawa, which is based on octonion rings over finite fields. Personally I've never encountered octonion rings in cryptography ...
2
votes
1answer
71 views

Using AES for smaller blocks in a Feistel network

I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext ...
2
votes
1answer
92 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?

15 30 50 per page