1
vote
0answers
75 views

Encryption - How to find $\sigma$?

Alice communicates with Bill using an encryption system of type Feistel. Specifically, each block has a length of 128 bits, the algorithm has 4 rounds and the common secret key of Alice and Bill is $(...
1
vote
0answers
82 views

Pseudorandom number generators based on hard problems in mathematics

I know that Dual_EC_DRBG's security is based on the ellitpic curve discrete logarithm problem, Micali-Schnorr is based on the difficulty of factorization, and MQ_DRBG is based on multivariate ...
1
vote
0answers
70 views

Boneh-Boyen like signature scheme

Full Boneh-Boyen signature scheme defines a pair of secret keys (SK) $a \in \mathbb{Z}_n$ and $b \in \mathbb{Z}_n$ and a pair of public keys (PK) $A = G^a \in \mathbb{G}$ and $B = G^b \in \mathbb{G}$. ...
1
vote
0answers
92 views

Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$

Is there a encryption scheme in literature, where I can do something like $$F_{k_1}^{-1} \big( F_{k_2}(A) + R \big) = A + O(R)$$ where, $A$ is a $m \times n$ real matrix, $R$ is a $m \times n$ real ...
1
vote
0answers
36 views

Reducing key shares in Damgård-Dupont threshold RSA

I'm working on understanding and implementing Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC ...
1
vote
0answers
31 views

Any ideas on login using Digital Signature PKCS

I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction?
1
vote
0answers
89 views

Exploration of Blum Micali Security By Seed Size

I'm new to cryptography and am most intrigued by mathematically based pseudo random number generators. With reference to the Blum Micali algorithm: $X_{i+1} = G^{X_i} \bmod P$ can security be ...
1
vote
0answers
457 views

Variant of the Decisional Bilinear Diffie Hellman problem

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 \...
1
vote
0answers
60 views

Is there a way to “shorten” a Merkle chain?

If I have a Merkle chain of 3 items, is it possible to create a zero knowledge proof of the existance of a correct chain between hash 1 and hash 3? Editing to clarify (Thanks Ricky), what I mean my a ...
1
vote
0answers
64 views

Obliviously computing the Least common multiple of two poylnomials

Consider I have two polynomials $f_1$ and $f_2$ of the same degree. I want to secure them (using any kind of encryption except FHE) and outsource them to an untrusted server. I want him to compute the ...
1
vote
0answers
110 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
1
vote
0answers
70 views

PRG variant as a commitment scheme

I would like to use a PRG in order to achieve the commitment properties (i.e. Hiding and Binding), however, if we look at a general PRG we cannot state that it has the Binding property. First I show ...
1
vote
0answers
172 views

CAST-256 (CAST6) versions or S-Boxes

Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use ...
1
vote
0answers
561 views

Existential Forgery on textbook RSA signatures

Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen $σ_1 = (m_1)^d \bmod N$ and $σ_2 = (m_2)^d \bmod N$ He forges $m' = m_1\cdot m_2$ $σ' ...
1
vote
0answers
181 views

Implementing a pseudo random function in practice

Can anyone point me to a C++ crypto library with an implementation of a pseudo random function (PRF)? I don't have much background in crypto theory, but I am in the middle of a graduate course ...
1
vote
0answers
118 views

RSA OAEP: prevention of partial decryption of ciphertexts

I'm trying to understand RSA encryption (as a beginner in cryptography). go on this wiki page http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding scroll down to the 2 numbered points: ...
1
vote
0answers
140 views

java.util.Random and Dice Rolls

For this question, a dice roll will be considered two 6 six sided dice, to give a possible output of 2-12. Given a java.util.Random instance r, the output of one roll would be: ...
1
vote
0answers
161 views

CP-ABE: structure of the secret key SK

I am working on Ciphertext-Policy Attribute based Encryption (CP-ABE) and I need to understand how a secret key looks like. For example, assume that the universe of attributes is defined to be {A,B,C,...
1
vote
0answers
158 views

Interactive assumptions not falsifiable?

Can someone explain why an interactive assumption is not falsifiable? Maybe I'm misunderstanding what the statement means, but isn't even a non-interactive assumption interactive, but just with a zero ...
1
vote
0answers
113 views

Complexity to find an preimage of a hash function

Suppose a hash function based on Merkle-Damguard construction. Its compression function is given as $H_i=E_{m_i}(H_{i-1})$, where $E_{m_i}()$ denotes the encryption of an ideal block cipher with $n$-...
1
vote
0answers
131 views

CCA security of a system that splits messages and encrypts each packet

Propose a symmetric key based crypto-system for implementing a secure email system. This system is based on AES and CCA secure. Suppose that you have to encrypt a large message and that this message ...
1
vote
0answers
237 views

The Inhomogeneous Short Integer Solution (ISIS) problem with a clue

The Inhomogeneous Short Integer Solution (ISIS) problem is as follows: given an integer $q$, a matrix $A \in \mathbb Z^{n\times m}_q$, a vector $b\in \mathbb Z^n_q$, and a real $\beta$, find an ...
1
vote
0answers
45 views

Hybrid fair exchange protocol

A gradual fair exchange (layman term) is a form of fair exchange protocol where Alice will transfer 1 bit to Bob then Bob will transfer 1 bit to Alice. The flaw with this protocol is that the party ...
1
vote
0answers
96 views

Opinion on my idea for storing credit cards securely

I've been thinking of ways to store credit cards securely, I thought of this: Take the users credit card info Put the card info in a standard format "Full Name/Card Num/Security Num/Expiry Date"...
1
vote
0answers
253 views

Brute Force AES Calculations

I have an encryption service in which the user decides the length and the type of key, so I would like to build a tool that educates the user on the brute force times for the key they created if using ...
1
vote
0answers
201 views

How represent message in Menezes–Vanstone elliptic curve cryptography

I ask about represent message in Menezes–Vanstone elliptic curve cryptography I now encrypt function as follow $C_1 = (M_1 * K_1) mod\ P$ $C_2=(M2 * k_2) mod\ P$ My question is about how much the ...
1
vote
0answers
180 views

Type of cipher used where ciphertext has no discernible pattern, spaces. Type?

What type of cipher could give ciphertext where for example random ASCII chars between say F-z (symbols and numerals inclusive), but with only a few spaces? Frequency of chars shows some similarities ...
1
vote
0answers
79 views

Why is it hard to calculate Logarithm on Diffie Hellman?

i read something about Diffie Hellman. What i don't understand: Alice selects a randomly generated Number, calculates X = g^x mod p and sends X to Bob. If she calculates g^x, she needs to calcluate ...
1
vote
0answers
63 views

DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
1
vote
0answers
265 views

About the Algebraic Normal Form (ANF) of S-Box in DES

I've thought up a way to represent the transformation of S-Box in DES by ANF. Let $x_i\;(1\le i\le 6)$ be the input of an S-Box, $y_i\;(1\le i\le 4)$ be the output, for example, then $$y_1= 1\oplus ...
1
vote
0answers
92 views

To prove $r_2$ is a uniformly at random value in $Z_n$, where $r_2=r_1 . m$

$m$ is arbitrary value in $Z_n$, where n is RSA modulo. Then we do: $r_2=r_1 . m (modn)$, where $r_1$ is a random value such that $r_1\in Z^*_n$. ** Question(1): is $r_2$ a uniformly at random ...
1
vote
0answers
119 views

Does the transposition cipher have a network application?

So I'm reading a chapter in my networking book and it talks about substitution and transposition ciphers (Transposition Cipher Wikipedia). I know that most network security uses public key or ...
1
vote
0answers
131 views

Does NSS fully implement PKCS 11?

I am looking towards using NSS in a Linux application that makes use of a TPM (HSM). So, I am checking the support of PKCS 11 in NSS, at least for the management of Elliptic Curve keys, signature with ...
1
vote
0answers
60 views

Forward Secrecy with pseudorandom functions

Let $H_1$, $H_2$ be keyed hash functions (e.g. $H_i(x) = SHA_{256}(s_i||x)$ for pseudorandom $s_1$, $s_2$). Let $s_n = H_1^k(s_0)$, $k_n = H_2(s_n)$, where $s_0$ is a secret (pseudorandomly chosen ...
1
vote
0answers
406 views

how to find key matrix in hill cipher

I want to solve this problem but there are 3 known plaintext-ciphertext pairs. The key of Hill cipher is a 3*3 matrix as k=[k1,k2,3; k4,k5,k6; k7,k8,k9] where the unknown ki={0,1,...25}={A,B,......
1
vote
0answers
104 views

side channel attacks on AES

Say you have a web application that's performing AES encryption. What sorts of side channel attacks should one keep an eye out for? Timing attacks affect RSA more than symmetric ciphers in-so-far as ...
1
vote
0answers
88 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
1
vote
0answers
215 views

What does “nonlinear mapping” mean?

Page 15 of the Keccak reference (PDF) explains that the $Chi$ step mapping of the Keccak-f permutation in Keccak is defined to be “nonlinear mapping”. Without this, the complete permutation would be ...
1
vote
0answers
57 views

FEAL-4 Wrong outputs of Round Functions

On page 2 of this article, there is example of FEAL-4. At round 2, the input to F (Round Function) is 0x80800000. As F accepts only 4 bytes I divide the input by 2 so that (As I assume the result ...
1
vote
0answers
114 views

Which mathematical operations does secp256k1 point multiplication use?

To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used. Could I – theoretically – convert a private key to a public key just using the four arithmetic ...
1
vote
0answers
341 views

Serpent Cipher 128bits (Example rounds on any plaintext/key)

Is there are any possibility to see trace(example) of Serpent Encryption/Decryption on concrete plaintext/key example, (not code implementation) or at least animation of steps. During reading of ...
1
vote
0answers
439 views

What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
1
vote
0answers
44 views

Plaintext-aware encryption for symmetric schemes?

The notion of plaintext-awareness is well-known for asymmetric encryption, but the notion seems to make sense for symmetric encryption as well. Is this a known concept?
1
vote
0answers
76 views

exchanging private key between service and iPhone app - digital signing

I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally ...
1
vote
0answers
105 views

Is it possible (how difficult) to find MORE than one valid RSA signature?

Is it possible (how difficult) to find more than one valid RSA signatures for a given message m (after padded) and a public key e...
1
vote
0answers
113 views

Privacy-Preserving Protocols and Proofs of Security

While dabbling in privacy-preserving protocols (mainly using Semi-Homomorphic Encryption) and coming up with miscellaneous ideas for comparison tests or other similar primitives, based on obfuscation ...
1
vote
0answers
166 views

Complexity of verifying OTP secret

What is the minimum number of unique pairs of digests and inputs to a one-time pass needed to verify that a secret is equal to a ...
1
vote
0answers
93 views

Are partial hashes used in cryptographic protocols?

In my question (and answer) about a partial hash code used within a signature application I found out that partial hash codes are sometimes used within protocols with a relatively restricted security ...
1
vote
0answers
90 views

How to distribute symmetric key between $n$ entities?

If there are $n$ servers for broadcasting a symmetric key in such a manner that following holds: No server alone can find the key $K$ alone. Any two servers can pass $k_i$ and $k_j$ such that $K=f(...
1
vote
0answers
174 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...

15 30 50 per page