2
votes
1answer
506 views

Generate an insecure public / private key pair

I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods. As far as I know PGP ...
2
votes
1answer
416 views

Questions about proof of correct encryption in the Paillier cryptosystem

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ...
2
votes
1answer
227 views

Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, $L=s^e\...
2
votes
1answer
136 views

How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
2
votes
1answer
983 views

How to break AES CBC with PKCS#5 padding?

If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?
2
votes
1answer
401 views

ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
2
votes
1answer
182 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
220 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
227 views

Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
2
votes
1answer
603 views

What's a good P to use in ElGamal key generation?

I need to generate a 1024 bit ElGamal key on Android, and key generation takes forever (~10 minutes on a Galaxy Nexus), I suspect because it take so long to generate a safe prime. Is it dangerous for ...
2
votes
1answer
121 views

Is it safe to hold key file's hash in application

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)? Thanks
2
votes
1answer
394 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
2
votes
1answer
564 views

Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
2
votes
1answer
212 views

In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
2
votes
1answer
508 views

DGK Cryptosystem Encryption Speedup

Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
2
votes
2answers
12k views

OTP from Sony BIOS password recover [closed]

From Dogbert's blog: Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the ...
2
votes
1answer
83 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
2
votes
1answer
203 views

RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
2
votes
1answer
992 views

HASH Algorithm for 8 bits MCU

I need to implement the HASH algorithm (MD5 & SHA-1) on an 8 bit MCU. I hear it can only be implemented on 32bit and sometimes 16bits MCU. Is that possible? I will appreciate link where possible. ...
2
votes
1answer
290 views

How does the energy consumption of the SHA-3 finalists compare?

I am curious, is there any paper where SHA-3 competitors are compared in terms of energy efficiency?
2
votes
1answer
662 views

Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
2
votes
1answer
995 views

Verilog simulation of Data Encryption Standard

I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance .
2
votes
1answer
53 views

Proof that a encrypted file has the same content as an (existing) original

Assume that Alice has a file F which she is going to send, in encrypted form, to Bob. Alice possesses F and the public encryption key K of Bob in form of an X509-certificate. She generates the file E ...
2
votes
1answer
46 views

Why is it so hard to make longer hashes?

I was reading this answer about why there is no such thing as a SHA-1024 hash: SHA-2 was built with state and word sizes to meet the security requirements on commodity computers (x86 and Alpha), ...
2
votes
1answer
41 views

Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference? Many Thanks
2
votes
0answers
38 views

How does Bluetooth pairing (SSP with numeric comparison) work?

I have a question concerning the pairing of two Bluetooth devices using Simple Secure Pairing with numeric comparison. The NIST document I am looking at states on page 14: Numeric Comparison was ...
2
votes
1answer
42 views

Choosing between RLWE-KEX methods.

Recently, I've been researching and implementing a bit of post-quantum cryptography, and I came across two RLWE-KEX algorithm for key exchange. The first one, which I implement in my software, is ...
2
votes
0answers
47 views

Avoiding doubled letters in encrypted text

I have an encrypted string based on an "alphabet" of 29 runes and access to successfully decrypted (runes->English) plaintext. Testing for a Vigenere cipher, I tried a Friedman attack (aka Kappa test, ...
2
votes
0answers
39 views

Why is a LCG not suitable for use in a cryptographic primitive?

Two's complement addition (and multiplication) are non-linear with respect to XOR and AND. This means that for bit vectors over $\mathbb{Z}_2$, the operation $a + x$ cannot be expressed as the matrix ...
2
votes
0answers
62 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
2
votes
0answers
46 views

Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
2
votes
0answers
19 views

hash function notations and existing cryptographic hash algorithms [duplicate]

I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions $...
2
votes
0answers
24 views

What is bounded-retrieval model?

What is bounded-retrieval model in cryptography? How is it related (or apply) to leakage-resilient cryptography?
2
votes
0answers
60 views

Are analog quantum computers a threat to RSA and DLP?

We already know that D-WAVE's "quantum computers" can't really run the Shor's algorithm, because the way they're built doesn't qualify them as universal quantum computers. Now researchers actually ...
2
votes
0answers
51 views

Is the ring learning with errors problem still hard if the errors are drawn from some subspace?

Let $R=\mathbb{Z}_p[x]/x^n+1$ be the ring used in normal RLWE, which is linear space over $\mathbb{Z}_p$ with dimension of $n$, let $S$ be a linear subspace of $R$ which described by linear ...
2
votes
0answers
25 views

Why SSH does not use a certificate authority in the same way as SSL [closed]

SSL requires the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client. SSH on the other hand relies on the client having the server's ...
2
votes
0answers
30 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
0answers
28 views

Cryptographic Algorithm [closed]

I'd like to find out the cryptographic algorithm which uses only lowercase letters and numbers to encrypt a message, and it has 256 bits (always). For example: fff51ebcad2c44c75d7d5d4c5184b3e4
2
votes
0answers
8 views

How to decrypt SSL data on a considered-to-be-compromised host? [closed]

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
2
votes
0answers
28 views

How to determine how good our generator of random numbers is [duplicate]

I am using SecureRandom class in java with default constructor and after i run it four times and each times i will take back 4 "supposed highly secured random numbers" . First run : -35 -43 -127 12 ...
2
votes
2answers
190 views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
2
votes
0answers
81 views

Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known to ...
2
votes
0answers
207 views

The knife paradox?

In one of the hot forums of today on how to convince friends cryptography is good one of the arguments stated is the knife paradox, I was unable to find the answer on Google and my question is what is ...
2
votes
0answers
25 views

Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
2
votes
0answers
37 views

Can I serve data for user without the ability to access them? Which functions for the user remain?

My Problem I want to serve sesible data for users as a webservice that is accessed by the user via the browser. Restrictions: I may not be able to technically acces the data of the user Data is ...
2
votes
0answers
48 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
2
votes
0answers
29 views

Proving CCA security for scheme constructed from secure PRP

We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$. $E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of ...
2
votes
0answers
54 views

Is there any symmetric key cipher (block or stream cipher) providing partial decryption?

symmetric key cipher (block or stream cipher) providing partial decryption of data at some points. Although the entire data has not been decrypted, the data decrypted to that specific point should be ...
2
votes
0answers
24 views

Creating an SPN cipher from ChaCha20 or Salsa20's double round function

Given that ChaCha20's building blocks have been also used to construct a hash function, can the double round function from either ChaCha20 or Salsa20 be used to construct a secure SP-network cipher? ...
2
votes
0answers
34 views

Some confusions about Repeated Doubling Algorithm?

The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93. Clearly, this algorithm is ...

15 30 50 per page