1
vote
1answer
72 views

When we turn Random shuffle to Pseudorandom Shuffle

It's well known that a simple but efficient random shuffle algorithm can permute a vector of $n$ elements in $O(n)$ time. In the algorithm, we need to pick a value $U$ uniformly at random where ...
1
vote
1answer
43 views

Could a key derivation function be used to encrypt data with a weaker key?

To allow the key to be more easily remembered. Example: To encrypt a hard drive without having a remember a key with 128 bits of entropy. From what I find they seem mostly used to hash passwords so ...
1
vote
1answer
78 views

Is it okay for a non-cryptographer to submit crypto code to an open source probject? [closed]

I am not a cryptographer, nor do I claim to be. However, at times I have wanted to contribute to open source cryptography projects such as libsodium. The maintainer of libsodium is a cryptographer, ...
1
vote
1answer
53 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
21 views

Generally accepted algorithm for two-pass, misuse-resistant AEAD that is efficient in software

I would like to know what the standard is for two-pass, nonce-misuse-resistant AEAD that is efficient in software. Thus, AES-SIV is excluded; modes based on a stream cipher like ChaCha20 are ...
1
vote
1answer
34 views

Use of orthogonal vectors in lattice-based cryptography

In lattice-based cryptography, given the basis of the lattice we compute the orthogonal vectors using Gram-Schmidt Orthogonalization process. What is the use of orthogonal vectors in lattices?
1
vote
1answer
60 views

Understanding Diffie-Hellman - Choosing a bad g

I am taking a class on Cryptology, and I'm having a hard time understanding the potential pitfalls of Diffie-Hellman. Specifically, the professor gave the following problem: Alice and Bob want to ...
1
vote
1answer
67 views

Finding collisions in SHA1

I am trying to find two collisions in SHA1 for the 50 least significant bits. I was wondering if there was a way to efficiently do this without having to brute force all of the possible hash outputs? ...
1
vote
1answer
34 views

How to go about encrypting a digital exam?

I'm building a Digital Examination system and I'm having problems understanding some concepts in cryptography. I want use to Asymetric Cryptography and my questions are Do I encrypt the entire ...
1
vote
1answer
35 views

Secure way to hash a lookup value

I want to securely store a database table that consists of an account ID and a few columns of sensitive data. The data only has value if it can be associated with the account ID. My thinking is to ...
1
vote
1answer
114 views

128 Bit AES Issue

I'm trying to use the 128bit TI_aes implementation on my 16bit microcontroller and I'm having the weirdest issue. Every input where two bytes within a word are identical two nibbles within a byte ...
1
vote
1answer
95 views

Fast MAC for 64-bit inputs

I am looking for a fast MAC (~few machine instructions) to be used for hash tables with 64-bit public inputs. I can't use SipHash as the hash function will be inlined in too many places and so the ...
1
vote
1answer
30 views

OpenSSL & TLS1.2 with aes-cbc and initialization vector

I'm trying to manually decrypt DTLS traffic using OpenSSL and TLS 1.2. The cipher suite im using is AES256-SHA256 as listed here. Im able to decrypt the packets with the key that the server and the ...
1
vote
2answers
156 views

AES128 Decryption in Objective-C just slightly off

I have been asked to integrate a home-grown CRM system with a 3rd-party data service provider (DSP). The DSP has encrypted the information they are providing. I only have their decryption ...
1
vote
3answers
107 views

ECDH-ECDSA Combination

I am doing research on cryptography primitives at a basic level and I faced a question on encryption methods. I understood that ECDH is an approach to for secure key exchange between two parties ...
1
vote
1answer
30 views

Is this the correct procedure for cycle walking using an FPE?

To encrypt a value from a set (say a range of years from 1001 to 2001) Rank the set {0 = 1001, 1 = 1002, 2 = 1003...999 = 2001} Take the value you want to encrypt from the set (year = 1995) and ...
1
vote
2answers
77 views

Secure randomized data matching?

This might be a dumb question but I will go for it. Let's say we have a data set $D$ consisting of sensitive data, and we want to be able to match if a new piece of data $S$ already exists in $D$ ...
1
vote
2answers
63 views

Role of Fermat's little theorem in the proof of correctness of ElGamal signature

In the Wikipedia article about the ElGamal signature scheme it is written, that Fermat's little theorem is used in the following proof of correctness: From the signature generation in ElGamal we can ...
1
vote
1answer
77 views

Encryption that could have multiple decryption key

The title looks strange but it is to deal with this situation. The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have ...
1
vote
1answer
90 views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
1
vote
1answer
80 views

Setting up of polynomials for CP-ABE or KP-ABE Access Trees

My question I guess is how the selection is done. A brief explanation with a simple access tree will be very helpful.
1
vote
1answer
50 views

Is this a secure keyed hashing construction?

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the ...
1
vote
1answer
246 views

Difference between AES CMAC and AES HMAC?

Can someone elaborate on how 'signing' is done using AES- CMAC and AES-HMAC? HMAC Signing as I understand: Compute the HMAC( Hash the key and the input concatenated in a special way) Verification: ...
1
vote
1answer
149 views

Simplied DES why 10-bit key?

In Simplified DES algorithm, the plain text is 8-bit & the key is 10-bit, why is that, why can't both be of 8-bits each?
1
vote
1answer
52 views

Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
1
vote
1answer
29 views

What does CMS standard mean by “initial input to the message digest”

I'm really grinding my teeth against digest calculation explanation in the CMS standard. Let's consider the case when the signedAttrs are present. The first ...
1
vote
1answer
39 views

TCG design specification of TPM and nonce creation

I am reading TPM Main Part 1 Design Principles (PDF) which states: The creation of all nonce values MUST use the next $n$ bits from the TPM RNG. I do not know what this means, or how to find out ...
1
vote
1answer
62 views

Why does NaCl's crypto_auth have twice the security level of crypto_onetimeauth?

The crypto_auth function produces a 256-bit HMAC, with a 512-bit version also available. But the crypto_onetimeauth function ...
1
vote
1answer
35 views

Is PKCS#7 padding generated with a pseudo-random-number generator okay?

Let's take this PHP code. We use libsodium and libsodium-php. You have $text, $senderPrivateKey, ...
1
vote
1answer
58 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: ...
1
vote
1answer
26 views

Secure Multiparty Computation with Secret Output

Is there any MPC scheme that allows a function with several secret inputs to be computed, while the output can only become known to one specific party? If not, is this even possible?
1
vote
1answer
142 views

AES-256 add round key how

Can anyone explain to me (or send a link to somewhere) how round keys are added in AES-256? I understand that the round keys is added to the state matrix for each round and how XOR works. But since ...
1
vote
1answer
281 views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...
1
vote
1answer
60 views

How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)

My question is about Key-Policy ABE (KP-ABE). What does it mean when a "Ciphertext is Labeled with set of attribute"? How is it labeled?
1
vote
1answer
67 views

Chosen-Ciphertext Attack on Rabin: Factorize n

At the end of this Wikipedia section, you can see that $$\gcd(|r-s|,n)=q$$ or $$\gcd(|r-s|,n)=p$$ holds. I don't understand why.
1
vote
1answer
67 views

What effect does a salt have on attacks against hashes's fundamental properties?

I am interested in analyzing how adding a salt to our hashed passwords affects the three types of attacks we can use. The three types of attacks against hashes are as follows: We have the hashed ...
1
vote
1answer
23 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
1
vote
2answers
22 views

Does threshold crypto (m-of-n) guarantee that m peers discover the plain text?

In a threshold cryptosystem, is there any guarantee that all $m$ peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee? For instance ...
1
vote
1answer
57 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
1
vote
1answer
160 views

Modular Arithmetic in RSA

Consider the following the following RSA public key $pk = (N, e) = (1457, 1307)$. (a) Knowing that $187^2 \equiv 1 \pmod {1457}$ find the factorization of $N$. (b) Given the factorization of $N$ ...
1
vote
1answer
33 views

NORX duplex padding

MonkeyDuplex constructions defined by Keccak authors has padding in every duplex block. Why only last duplex block is padded in NORX? Is it because NORX has domain separation, or simply because ...
1
vote
1answer
54 views

CMAC for messages shorter than 128bit

RFC4493 describes the generation of AES-CMAC and padding for messages with length > sizeof(aes128_key). However I need to generate the CMAC for a series of messages shorter than 16 byte. So I'd like ...
1
vote
1answer
60 views

RSA Optimal Asymmetric Encryption Padding Beginner

I'm new to the OAEP scheme. I learn it from the Wikipedia page. Link The page does not explain a proper setup for of the system. So I'm not sure if the output of the padding scheme which contains ...
1
vote
1answer
71 views

the decryptNode function for leaf nodes in CP-ABE

can someone please explain to me why decryptNode gives as result e(g,g)^rq(0) for leaf nodes, i don't understand how they went from the sconde step to the third ...
1
vote
1answer
129 views

Implementing AES-CBC (Matasano Crypto Challenge 10)

I am currently doing the Matasano Crypto Challenge to learn a bit about cryptography. In that specific challenge one had to implement AES in CBC mode. I did that and verified that encryption and ...
1
vote
1answer
75 views

Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
1
vote
1answer
25 views

How to calculate $v_k(s)$ in Quadratic Arithmetic Program?

In the paper Pinocchio: Nearly Practical Verifiable Computation, there are some polynomials $v_k(x)$, $w_k(x)$ and $y_k(x)$ representing the structure of there circuit. However, as in the "concrete ...
1
vote
1answer
73 views

Taking half of a X bits hash key as secure as using a X/2 bit hash function?

This question comes from a (nitpicking) comment by me in this SO question. I said that using the half of the output from a 256 bit hash function is worse than using a 128 bit hash function. My ...
1
vote
1answer
33 views

Why does the Secure Remote Protocol have resistance of dictionary attack?

Assume that Eeve who masquerades as a legitimate host and convinces Carol to make an authentication attempt. (Carol wants to handshake with Steve – a host) Thus, Eve can get values $A = g^a, M1 = ...
1
vote
1answer
89 views

Exactly how slow is asymmetric encryption?

I'm currently doing a project on RSA, and have just come across this website. https://www.namecheap.com/support/knowledgebase/article.aspx/798/67/what-is-an-rsa-key-used-for On here, it says that ...

15 30 50 per page