# All Questions

65 views

### Is timestamping possible without publishing?

The Wikipedia article Trusted Timestamping states that we can timestamp data by publishing it's hash. Publishing can be done either independently or via a third-party publisher, as explained by ...
47 views

### Delinearization in whitebox techniques

I'm reading through Chow et al.'s paper and Link et al.'s paper. There's a part I don't understand about Delinearization. They convert some steps of AES/DES into a Matrix, then divide the matrix in ...
66 views

### Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist

To my understanding in a 1-n Oblivious Transfer the Sender has some Values $X_1...X_N$ and the receiver wants to retreave some $X_I$, with $1 \le I \le N$. Can one now somehow guarantee, that the ...
229 views

### Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
158 views

### Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
108 views

### Timing attacks against RSA, DH and AES

I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, ...
225 views

### Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks

Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created). I would like to create an iOS-...
63 views

### Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
114 views

### Is ecryptfs safe after unmounting but before turning off the computer

I've read that one of the vulnerabilites of ecryptfs is leaks to swap memory, and that the solution is to encrypt swap. But even if swap is encrypted, it's still open until I reboot. I've also read in ...
279 views

### Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
148 views

### encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
153 views

### Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
68 views

### Machine Learning with Encryption [duplicate]

Machine Learning is sometimes associated with cryptography. Many of such cross field studies have been majorly done in use of machine learning for cryptanalysis/decryption. I am interested in knowing ...
385 views

### Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
136 views

### Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
210 views

### Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
77 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
84 views

### Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
62 views

163 views

### Rabin/RSA four possible messages?

Given this encryption method: $$f_{N,e} : Z^{*}_{N} \to QR(N)^{*};\quad f_{N,e}(x) = x ^{2e} \bmod N$$ I need to show that, for any $x_{0} \in Z^{*}_{N}$, there are four elements $x \in Z^{*}_{N}$ ...
402 views

### Is there any analysis of freebsd's “geli” encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
63 views

### Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
168 views

### Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
300 views

110 views

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus HMAC_{H1}(k_1,m)... 0answers 72 views ### Any functioning system for interactive proof? My problem is to outsource an array of data and ask the prover to sort the data. I am wonder if there is any working system out there that support interactive proof for the above computation? Or if ... 0answers 229 views ### Diffie-Hellman exchange So for a Diffie-Hellman problem, I am given the prime$p$for the Diffie-Hellman exchange. I am also given$g$, secret number for machine as$A$, secret number for station as$B$, a Diffie-Hellman ... 0answers 68 views ### Protocol/algorithms based on a variable-length input PRF Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt. 0answers 124 views ### Cryptanalysis not based on method used to encrypt? [closed] When doing cryptanalysis on RSA or something number theory based, there are various attacks that all seem to involve number theory (Wikipedia: RSA_(algorithm) ~ Attacks_against_plain_RSA). Similarly, ... 0answers 837 views ### How do I enable AES-NI (hardware acceleration) for Node.js crypto on Linux? [closed] I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions. These functions use OpenSSL, so they should support AES-NI, but when I correctly enable ... 0answers 212 views ### Infinite depth BLAKE2b tree hashing In the BLAKE2 paper, the authors define Maximal depth (1 byte): an integer in [1, 255] (set to 255 if unlimited, and to 1 only in sequential mode) Node depth (1 byte): an integer in [0, 255] ... 0answers 158 views ### How many messages needs to be send to server to get AES key in Cache-timing Attack I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on AES,... 0answers 588 views ### Question about modifying the MD5 plain text to cause a collision I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ... 0answers 33 views ### Detail about reactive simulatability framework I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ... 0answers 322 views ### How to perform benchmark of block/stream ciphers? I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ... 0answers 93 views ### Can you help me understand this “Message Modiﬁcation by Meet-in-the-Middle” related to Tiger Hash? [closed] I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ... 0answers 182 views ### Integer factorization based password authentication After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ... 0answers 354 views ### How does identification currently work with the German identity card? [closed] Since 18th of December 2010 Germany makes use of an identity card that should allow electronic authentication: (image source: commons.wikipedia.org) From a users perspective, the authentication ... 0answers 93 views ### partial-domain permutation and strong assumption Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ... 0answers 86 views ### Could BREACH be used to determine an HTTPS URL? I was reading this article and had a question.... http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/ As I understand it TLS/SSL work in ... 0answers 169 views ### Security of a 3-party key exchange protocol I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server. We have the following roles:$...
This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...