# All Questions

105 views

### What scheme will allow merging and splitting the result of a function?

I am wondering if it's possible to have a scheme as follows. Here is the scenario: we have a set of objects (e.g. strings) {O1, O2, ..., On} we have a set of users {U1, U2, ..., Um} each user asks ...
111 views

### OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
64 views

### AES and Known-plaintext attack [duplicate]

Can you help me to finding some papers that shows AES is secure against known-plaintext attack?
144 views

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
67 views

### applying HKDF at both the client and the server

I have two keys (K1 and K2) at both the client and the server. I hope to use HKDF in both client and server side to concatenate the keys. I will use the same salt value at both the client ad the ...
165 views

### Example of CL PKC

I am trying to solve the example of algorithms of Certificateless Signature by manually and solving the mathematics of Algorithms but not succeed while doing mathematical calculations. Please ...
84 views

### Asymptotic Hash Function and Concrete Hash Function

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they say that its formalization is non-asymptotic. Why is the formalization non-asymptotic? What is an example of hash ...
114 views

### What is the difference between a bijective random oracle and a random permutation?

Assume $S$ be a finite set $O$ be a random oracle from $S$ to $S$, such that $O$ is bijective $f$ be a random permutation of $S$ Is there any difference between $O$ and $f$? Does it makes any ...
429 views

167 views

### Is it possible to decrypt an RSA ciphertext with only $N$ and $e$?

Is it possible to perform RSA decryption if one only knows $N$ and $e$? Failing that, what is the maximum key length where brute-force is still practically feasible?
778 views

### Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks CBC-...
318 views

### Why can we always assume that $Gen$ algorithm choose key uniformly?

Talking about a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ take the security parameter $n$ as input and generates a key $k$ of length $n$. Generally speaking we say that $Gen$ ...
399 views

### Why not just generate random strings for one-time password (OTP)?

http://en.wikipedia.org/wiki/One-time_password#How_OTPs_are_generated_and_distributed Why have so many methods to generate OTPs, why not just use just random strings?
165 views

### Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which they ...
2k views

### Has threefish successfully been attacked (practically or theoretically)?

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating: Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-...
87 views

### Is the following aggregation scheme private?

Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data Each party holds a secret key $k_i$ ...
124 views

### PPT eavesdroper able to output $m_{0}$ and $m_{1}$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...
325 views

### Bellovin 96' attack on IPsec ESP protocol on encryption only option

Can you explain the actual attack? Why does the attacker need to firstly send some arbitrary UDP packet? How can the attacker break the privacy between A and B? Link: The article of Bellovin I'm ...
85 views

### Why send a challenge with CHAP?

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP). Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash ...
125 views

### Can we build authenticated encryption using Feistel Networks?

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality . Can we build authenticated encryption using Feistel ...
277 views

### Any historical accounts of cryptanalysis of Jefferson's wheel cipher?

David Kahn in his book "The Codebreakers" wrote about Jefferson's wheel cipher, saying that To this day the Navy uses it… (the book was first published in 1967) Are there any historical accounts ...
162 views

### Efficient parameters for group Diffie-Hellman

I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. ...
105 views

### Biometric authentication [closed]

I see in some “Authentication schemes with biometric” papers that those authors wrote a phase as password and biometric update phase. My question is that why we may needs biometric update phase? Is ...
3k views

### What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
625 views

### Can you break a multi language code using Frequency analysis?

Let say that I wrote a 26 letter alphabet, each letter of my alphabet represent a letter from the latin alphabet. I'm writing in 3 languages, only I know which languages. Grammar is the one from my ...
2k views

### Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
590 views

### How practical is proxy re-encryption for AES?

In proxy re-encryption schemes, a proxy is given special information that allows it to translate a ciphertext under one key into a ciphertext of the same message under a different key. How ...
3k views

### Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs (\$\left[...
574 views

### Why xor the message into the state for sponge hashes?

Sponge hashes like Keccak(SHA-3) and CubeHash, xor a message block into part of the internal state. Why use a reversible operation like xor for that, instead of replacing that part of the state with ...
713 views

### Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
265 views

### I've got my private key compromised. How does CRL work?

How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL? Related: - How can ...