# All Questions

1answer
319 views

### Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
1answer
175 views

### Looking For Additively Homomorphic Encryption

I have a construction that requires as primitive an Additively Homomorphic Encryption scheme that does not rely on hidden group order, meaning I can't use Paillier. I now have two different ...
1answer
207 views

### Compact digital signature for noisy data

The question asks for a signature scheme, with a public verification procedure, that is tolerant to minor alterations of the signed data during its transmission [possibly in analog form over some ...
1answer
222 views

### AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
1answer
128 views

### Proving the existence of a pseudorandom function

I've been reading the Introduction to Modern Cryptography book by Katz and Lindell as part of my own learning and have come across this exercise which I am not sure how to approach. The exercise is: ...
1answer
79 views

### Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume ...
1answer
164 views

### Measure ECC key size

I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key. So I would ...
1answer
350 views

### AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
1answer
22 views

### Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
1answer
98 views

### Is the SEED blockcipher still secure?

I did found an old question which answers exactly this but it is from 2 years ago and i was wondering if there were any changes. I have not been able to find any new information on the cipher and am ...
1answer
178 views

### AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
1answer
63 views

1answer
203 views

### How can I map arbitrary group elements to unique integers without using Hash functions?

Let's say, I have a group $G$ of large prime order $p$. A set $S$ consists of $n$ random elements chosen from $G$. Without using a collision resistant hash function $H$, how can I map elements of $G$ ...
1answer
61 views

### Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
1answer
113 views

### How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
1answer
133 views

### Will non-ECC algorithms like RSA eventually become too inefficient?

The strength of symmetric and asymmetric encryption schemes scales with the key length, but there is a difference between symmetric algorithms like AES and asymmetric algorithms like RSA. For ...
1answer
77 views

### Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
1answer
41 views

### How to choose the integer m in the general number field sieve (GNFS)?

Given an integer you want to factor $N$, GNFS starts by selecting a monic irreducible polynomial $f \in \mathbb{Z}[X]$ and an integer $m$ such that $f(m) \equiv 0 \text{ mod } N$. In practice, if $m$ ...
1answer
59 views

### Standard serialization format for libsodium-based messages

Does anyone know of a standardized serialization format which can be (or already is) widely used for encrypted messages? For a variety of reasons (mostly complexity, age and poor support across a lot ...
1answer
53 views

1answer
14 views

### Using HMAC SHA256 to protect payment files in local trusted network

in a project that I am working on we have been tasked with eliminating PGP while providing sufficient security to protect payment files only within the Company's trusted network. We arrived at HMAC ...
1answer
30 views

### Why perfect secrecy can be ensured when a plain message and a cipher-text based on one-time pad are correlated?

First, some well-known results are as follows. For random variables $X$ and $Y$, we have $$H(X,Y) \leq H(X) + H(Y).$$ The equality is achieved when $X$ and $Y$ are independent. Second, in one-time ...
1answer
28 views

### what is legend of h(r) in this protocol?

can you help me what is legend of h(r) in below protocol? ‎‎$A‎\leftarrow‎{B}\quad:{h(r)‎‎}{,B}{,P{_A(r,B)}}‎\\A‎\rightarrow‎{B}\quad:r$
1answer
65 views

### Inserting a backdoor into a cryptographic hash function

I'm curious as to how a backdoor can be built into a hash function. What might it take the form of? What's probability of getting one that can be backdoored in a way that can actually undermine its ...
1answer
37 views

### Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
1answer
51 views

### How does the certificate authority generate a signature F?

E=encrypt(K,M) - is message M encrypted with key K gives encrypted text E M=decrypt(K,E) - is encrypted text E decrypted with key K gives message M KCA−pub,KCA−priv - is the private-public key pair ...
1answer
54 views

### Affine transformation in AES: Matrix representation

I know that the affine transformation of the AES can be represented both as a polynomial evaluation over $\operatorname{GF}(2^8)$ and as a matrix-vector multiplication (see, e.g., p.212 C.4 of The ...
1answer
45 views

### anonymous signature implementation and usage?

This is one of the question asked in my class. Implement a anonymous digital signature. So it means hiding signers information. i could not find any article in anonymous digital signing. Also another ...
1answer
29 views

### DSA: Authentication and assurance of authorized parties

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private ...
0answers
163 views

### If H(m) = 0 for some m, how can a DSA signature be forged?

If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key? I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 ...
0answers
238 views

### Blum-Blum-Shub Cryptosystem

I am given $N$, which is Bob's encryption key. I was able to successfully factor $N$ into $N=p*q$. Alice encrypts a messages for bob and sends $a = [1,1,1,0,0,0,1,0,1,1,0,...]$ $b = 1545164156...$ ...
0answers
87 views

### Example of CL PKC

I am trying to solve the example of algorithms of Certificateless Signature by manually and solving the mathematics of Algorithms but not succeed while doing mathematical calculations. Please ...
0answers
77 views

### hybrid PKE scheme CCA2 insecurity

I'm reading a paper here say: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide challenge bit to the CCA2 adversary The author does not define hybrid PKE schemes. What is ...
0answers
178 views

### How to safely sign a 6 characters String?

I have to decide, whether a document, which I am given, was correctly signed by a private key. my Ideas is to sign the document id using RSA with the private key and to print the following onto the ...
0answers
31 views

### nonce is a number that use once.so why in many protocol use nonce several times?

the Nonce is "a number that use once".so why in many protocol use nonce several times? how use nonce in protocols? if problem is save of nonce in database,how saved time stamp and signature in ...
0answers
62 views

### What are the difference between cryptographic primitives and encryption primitives?

For example, from reading I found that the cryptographic primitives of both AES and DES are Confusion and Diffusion. However the encryption primitive for DES was Substitution and Permutation while ...
0answers
66 views

### How does this Cryptowall v3 working to encrypt the file?

In Wikipedia, I've found an explanation about this Cryptolocker, the predecessor of a new variant this Cryptowall v3. I think there's an interesting value to know more about this kind of Trojan. ...
0answers
58 views

### In modern definition, what is Enigma, and what caused its downfall?

This question is sparked from the movie The Imitation Game. This single question will have lots of subquestions. The Germans must put the Enigma at the same settings before encrypting and decrypting ...
0answers
34 views

### Can anyone explain how IV(Initial vector ) are chosen in GCM and in CBC MAC in detail?

I actually want to know in detail regarding the IV selection in CBC MAC and in GCM MAC. There is difference in IV between CBC encryption and CBC MAC. Please explain about MAC.
0answers
49 views

### feistel structure? why decryption is so easy with reverse order of subkey

I am doing an assignment on writing own encryption and decryption algorithm..so i come across feistel structure...can someone explain to me why we only use reverse order of key in decrpytion and we ...
0answers
21 views

### Choosing a cipher in SSH

When and how do the client/server agree on what cipher and MAC will be used during an SSH connection?
0answers
39 views

### How can I understand Shamir's attack on Merkle-Hellman Cryptography?

Is there any specific name for Shamir's attack? Because, I didn't find any attack named "Shamir's Attack" in Wikipedia. Shamir seemed to have published one article which showed that he can attack MH ...
0answers
43 views

### Why is plain ElGamal not secure?

Why is plain ElGamal not secure? What is the proof behind it?

15 30 50 per page