3
votes
2answers
307 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
1answer
219 views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
3
votes
1answer
391 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
3
votes
2answers
230 views

Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
3
votes
2answers
232 views

Can I combine two PRNGs to make use of more seed data?

I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...
3
votes
1answer
94 views

How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
3
votes
1answer
155 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
3
votes
1answer
335 views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
3
votes
2answers
168 views

Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ ...
3
votes
1answer
206 views

RSA Without Padding?

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message. Given that an ...
3
votes
2answers
245 views

Two step encryption

Is there any asymmetric cryptography algorithm which will allow recursive encryption. ...
3
votes
1answer
905 views

Cracking the Beaufort cipher

Is there any easy way to crack a Beaufort cipher? We have a Vigenère table, and are trying to guess the keyword. Any easier way?
3
votes
3answers
144 views

The meaning of “scheme”

This question is a bit different from other questions here, but I think it is suitable to correctly understand the terminology of cryptography. Consider the following two sets of terms: Encryption ...
3
votes
3answers
644 views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
3
votes
1answer
156 views

Encrypt array of int for individual retrieval

I have limited exposure to cryptographic terminology, so please bear with me. My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
3
votes
1answer
271 views

Is symmetric encryption vulnerable to plain-text-attacks?

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
3
votes
1answer
473 views

Advanced Encryption Standard Algorithm Secret Key

just a follow up question with this question.. How does the key schedule of Rijndael looks for keysizes other than 128 bit? A 256-bit key can still encrypt a block of plaintext in 128 bit? but in ...
3
votes
1answer
301 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
1answer
374 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
3
votes
1answer
1k views

RSA cracking: The same message is sent to two different people problem

Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ...
3
votes
1answer
242 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
3
votes
2answers
437 views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
3
votes
3answers
1k views

What is the importance of Modular arithmetic in cryptography?

Why do we use modular arithmetic so often in Cryptography?
3
votes
1answer
191 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
3
votes
2answers
266 views

If Bob steals Alice's private key, how exactly would he read her encrypted documents?

So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ...
2
votes
1answer
84 views

LFSR get output from characteristic polynomial?

Say you have a characteristic polynomial of an LFSR: $$f(X) = X^4 + X^3 + 1$$ How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ...
2
votes
1answer
146 views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
2
votes
1answer
120 views

Is $H(x) = x^2 \bmod p$ pre-image resistant, second pre-image resistant and/or collision resistant

I have the function $H(x) = x^2\bmod p$ , where $p$ is a prime of length n bits and this function maps to the message $x$ to a n-bit hash value $H(x)$. I need to find out if it is pre-image ...
2
votes
1answer
84 views

Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
2
votes
1answer
160 views

Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
2
votes
3answers
179 views

Why can't hashes be reversed with toffoli gates?

This is a follow up question to this question: Crack cryptographic hash functions using Toffoli gates?. Suppose there is a hash function $$H(x)=y,$$ where $x$ is the input of the function and $y$ is ...
2
votes
1answer
184 views

Homomorphic encryption for vector addition

Building on the question and answer from Addition-only PHE in F# which ponders homomorphic cryptosystems to navigate, relatively, a single dimension without revealing absolute position (an encrypted ...
2
votes
1answer
119 views

Distinguishing attack on CBC-MAC

I want to ask about distinguishing attack on CBC MAC, as in the paper published by Ketting Jia, Xiaoyun Wang, Zheng Yuan, and Guangwu Xu: Distinguishing Attack and Second-Preimage Attack on the ...
2
votes
2answers
193 views

How does this happen in RSA malleability?

I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur. $$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$ ...
2
votes
2answers
91 views

Speed up modular exponentation with fixed base and modulus

Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed? ...
2
votes
1answer
274 views

Why does plain RSA not work with big messages ($m>n$)?

From what I can remember, RSA is something like this: Generate 2 distinct prime numbers $p$ and $q$ that have similar bit length. Compute $n=pq$ and $\phi(n)=(p-1)(q-1)$ Compute $e$ such that ...
2
votes
1answer
374 views

A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
2
votes
3answers
174 views

OFB or CTR mode without an IV

I'm reading the SSL specs here. The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is ...
2
votes
1answer
51 views

How do I know if a given curve requires a FpCurve F2mCurve or ECCCurve?

I'm trying to read a public key into Bouncy Castle (secp256k1) and need to choose from the following objects FpPoint; FpCurve; or ...
2
votes
1answer
201 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
2
votes
1answer
125 views

Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

Assumptions: Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys. Each message is encrypted using a new key; meaning: once a key is used, it's destroyed. Alice and Bob ...
2
votes
3answers
235 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
2
votes
2answers
225 views

Could completely public passphrase hashes ever be reliably secure?

This is a hypothetical question and I only have a basic understanding of Cryptography. If one were to follow the very best cryptographic practices for storing passphrases, could it ever be possible ...
2
votes
1answer
179 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
2
votes
1answer
598 views

Inverting the encryption equation of a symmetric cipher

I've just started a cryptography course. I am beginning to understand the concepts (I'm only in week 2) but I just can't get my head around the theories and principles when written as equations. I've ...
2
votes
1answer
310 views

What key exchange do OpenSSL and CryptoAPI prefer by default?

Here is what I know. When I connect to a brand-new Linux Web server with Chrome and click the "lock" icon, the key exchange algorithm is described as "ECDHE_RSA". (Yes I know what that is.) When I ...
2
votes
1answer
118 views

RC4 system pitfalls

A system fell into my neck, where lots of files are splitted into several segments and encoded via RC4. RC4, because client side - slow computer, slow flash arithmetic ops - can only decode big blobs ...
2
votes
2answers
198 views

Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
2
votes
3answers
105 views

Securing content and login with “same” password

I'm writing a client application that wants to store some secret information with a storage service. The client has to authenticate the user with the service and the service should not be able to ...
2
votes
1answer
306 views

Solve a system of non linear equations over GF

I have the following set of equations: $$M_{1}=\frac{y_1-y_0}{x_1-x_0}$$ $$M_{2}=\frac{y_2-y_0}{x_2-x_0}$$ $M_1, M_2, x_1, y_1, x_2, y_2,$ are known and they are chosen from a $GF(2^m)$. I want ...

15 30 50 per page