All Questions
30,317
questions
3
votes
1
answer
1k
views
Breaking a small-scale Example Diffie-Hellman?
I started to read about Diffie-Hellman exchange and I encountered a problem which I don't know how to solve.
Given $g=3$, $p=131$, $g^x\bmod p=112$, $g^y\bmod p=74$, compute $g^{xy}\bmod p$
$113$
$...
3
votes
1
answer
458
views
ECIES: ECDSA with Kmac and without MAC
I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
3
votes
1
answer
662
views
Key equivalence across different elliptic curves
Is it possible to prove key-equivalence across elliptic curves of different order? Specifically:
Suppose I have a key $x$ valid for both curves listed below
On curve $g$ (for example, Curve25519) it ...
3
votes
1
answer
305
views
SSH sequence number validity?
Looking at RFC4253, I came across the notion that the MAC is applied the encoded packet concatenated with a sequence number which acts as a counter.
However, I couldn't find any information on how ...
3
votes
2
answers
2k
views
Generating secure short activation code for offline applications
My application is as follows
User has a hardware system (with an unique ID) that does not have
connectivity but has a keypad for input.
To make the hardware operational, the user has to go to central ...
3
votes
1
answer
427
views
Does adding a random number to my data make it secure?
Say I have some real valued data that i want to keep secure. Now I have to pass on some modified version of the data to a second party for some computation, but i do not wish to reveal my data to the ...
3
votes
2
answers
217
views
Discrete Logarithm in a specific group
I am considering a setting similar to the one of the Paillier cryptosystem, where we sample two distinct odd primes $p,q$, we set $n=pq$, we generate $a \leftarrow \mathbb{Z}_{n^2}^*$ and finally we ...
3
votes
1
answer
3k
views
What is the maximum message size when using ECDSA (specifically secp256k1?
I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
3
votes
1
answer
69
views
How to decrypt using public key?
Can anyone decrypt ciphertext using a public key? I always thought we can only decrypt using a private key. In that case, what does this line in the RLPx documentation mean?
...
3
votes
1
answer
9k
views
Attacks on Aes (128-192-256) [duplicate]
I have a direct question
Is there any practical attacks on the AES cryptosystem (128-192-256 keys)
3
votes
1
answer
198
views
Does an EC signature preserve entropy?
Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable).
If I make a signature with this unknown private key on a ...
3
votes
1
answer
394
views
aWallet Password Manager
After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like ...
3
votes
1
answer
152
views
Security implications of slow-by-design hashes on relative security vs. hash size
Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design?
Example: let's say you want 128-bit hashes. This is ...
3
votes
1
answer
4k
views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
3
votes
1
answer
2k
views
Would it be safe to store GCM nonce in the encrypted output?
I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM.
Would it be adequate/safe to ...
3
votes
1
answer
519
views
Verifying signature of plaintext using encrypted message only
I'm looking for an algorithm which allows verifying a signature of a plaintext message but while only having the encrypted message.
The requirement is for Alice to send Bob a plaintext message (M) ...
3
votes
1
answer
1k
views
Varying ECDH key output on different ECC implementations on the secp256k1 curve
Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
3
votes
1
answer
2k
views
Matyas–Meyer–Oseas for super-fast single-block hash function
Is it basically safe and correct to use the Matyas–Meyer–Oseas construction to turn a fast block cipher like AES into a really fast single block hash function?
By single block hash function I mean ...
3
votes
4
answers
158
views
secretKey ⊕ (secretKey ≪ 1), is randomness lost?
A truly random secret key is run through a cipher
secretKey ⊕ (secretKey ≪ 1)
is randomness lost? As in, is the computational cost to guess the ciphertext from <...
3
votes
1
answer
842
views
Differential privacy of "randomized responses"
We define randomized responses as follows:
In a question that can be responded with a "Yes" or "No", a respondent is asked to flip a fair coin, in secret, and answer the truth if it comes up tails. ...
3
votes
1
answer
187
views
Matsui's paper on linear cryptanalysis - unexplained formula in Lemma 2
How does he end up with this result in his article ?
3
votes
2
answers
214
views
Fully homomorphic encryption with polynomials
I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea.
Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
3
votes
2
answers
810
views
Schnorr identification protocol security proof
I read about security proof of Schnorr identification protocol against impersonation attack. For the sake of comprehensibility let me sum up the protocol: Given group $G$ with generator $g$. Verifier ...
3
votes
2
answers
241
views
Winternitz-OTS+ with Poly1305
Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is ...
3
votes
2
answers
322
views
Are there any misuse-resistant asymmetric encryption schemes?
The notion of misuse-resistant authenticated encryption (MRAE) was defined in the symmetric setting by Rogaway and Shrimpton, along with the SIV mode that achieves it. The idea being that modern ...
3
votes
1
answer
1k
views
What is the difference between these two TLS suites?
I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is ...
3
votes
2
answers
109
views
Encrypting a pseudorandom message
Does encrypting a pseudorandom message need the same requirements from a block cipher?
For instance, can we decrease the number of rounds of AES if we want to cipher a random block, without any ...
3
votes
3
answers
3k
views
On what basis are block sizes chosen?
Sha1/0 (160 bits output), md5(128 bits output) has block size of 512 bits.
Gost has 256 bits.
What is the reason behind having it specifically 512/256/1024 bits?
What are the various factors which ...
3
votes
1
answer
224
views
Complexity leveraging in case of exponentially many hybrids
Complexity leveraging is a proof technique in cryptography where the reduction algorithm runs in super-poly time. (see this). Many papers use complexity leveraging when there are exponentially many ...
3
votes
1
answer
4k
views
Why do we use multiple rounds of encryption?
I understand that DES and AES use multiple rounds of encryption to secure the cipher text output, what is the real reason this is carried out?
Is there a certain point performing multiple rounds ...
3
votes
1
answer
131
views
Why don't we use an Extendable Output Function to efficiently store the public key of Regev's LWE-based encryption scheme over standard lattices?
In LWE-based schemes the public key is generated by choosing a random matrix (or polynomial) $A$, and outputting the pair $(A, b = A\cdot s + e)$, where $s$ and $e$ are vectors/polynomials with ...
3
votes
1
answer
429
views
Role of lHash field in RSAES-OAEP
The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message.
Does ...
3
votes
1
answer
490
views
Independently choose lanes and threads param on Argon2
I'm researching on using Argon2 on a JavaEE server-side application.
I'm a bit reluctant to set the parallelism parameter larger than 1 on a JavaEE environment where threads are supposed to be ...
3
votes
1
answer
289
views
Safety of using GPG's libgcrypt prime generation for generating ephemeral Diffie-Hellman primes?
My company wants to generate new primes for every Diffie-Hellman key exchange. We are thinking of using the prime generation scheme in GPG’s libgcrypt library.
The code documentation says that the ...
3
votes
1
answer
161
views
Why is variable rotation uncommon in cryptographic primitives?
Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though:
For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
3
votes
1
answer
9k
views
Feistel cipher key generation and round function algorithms
I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All ...
3
votes
1
answer
665
views
What is gpg2 algo 1 and 8 concerning its signature-procedure?
While signing a test-file, gpg2 creates a file test.sig which contains this:
...
3
votes
1
answer
167
views
What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?
It is mention in the paper "
Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
3
votes
1
answer
1k
views
Is the following a PRG?
Let $G: \{0, 1\}^n → \{0, 1\}^m$ be a PRG. We construct a function $G': \{0, 1\}^{m + n} → \{0, 1\}^{2m}$ defined as follows
$G'(x || y) = x || (G(y) ⊕ x)$
for all $x ∊ \{0, 1\}^m$ and $y ∊ \{0, 1\}^n$...
3
votes
1
answer
1k
views
Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?
Note: This is not the same as Multiple iterations of AES for key derivation?.
Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to ...
3
votes
1
answer
794
views
How can I split a packed Ed25519 public signing key into its X and Y coordinates?
I'm using the Curve25519 code (from http://www.dlbeer.co.nz/oss/c25519.html), and trying to convert from a public signing key (Edwards form) to a public key-exchange key (Montgomery form). There's ...
3
votes
1
answer
8k
views
AES-ECB known ciphertext/plaintext attack
i'm new to crypto and am working on a little exercise to understand the weakness of ECB mode encryption. Here is the scenario.
I have the plain text
...
3
votes
2
answers
1k
views
Downsides of not using deterministic ECDSA signatures for blockchain validation?
I've noticed that in many Bitcoin wallet implementations, as well as other blockchains, deterministic ECDSA signatures are being used (generally based on RFC 6979).
There seems to be some benefits to ...
3
votes
1
answer
534
views
Simulator Transcript in ZKP
I need a bit of clarification about the definition of transcript of a simulator in Zero-Knowledge Proofs.
Basically, the way I understood it, the simulator is given access to the (potentially ...
3
votes
2
answers
516
views
Efficient way to combine collection of hashes into a single hash?
I have a system where each user will submit a set of data. The data will be hashed and their hash will be submitted to the server. My plan is to combine each users hash (converted to bytes XOR'd with ...
3
votes
1
answer
4k
views
AES-256 with random key generation instead of hash
In order to use AES256 encryption, we will need a 256 bit key, and 128 bit iv. We will need some kind of salt and hashing function to convert a password to the desired key.
However, let's assume the ...
3
votes
1
answer
182
views
Idiomatic description for an adversary in possesion of a quantum computer?
I was wondering what the "accepted" way is to describe an adversary who:
is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
3
votes
2
answers
350
views
Can GnuPG be used with a login system?
I was thinking about creating a proof of concept for the following type of website login system.
Instead of passwords being used, on account creation, a public GnuPG key is uploaded to the server, ...
3
votes
1
answer
400
views
Understanding pseudo-random functions (used in a Oblivious Transfer Protocol)
Given a family of pseudo-random functions
$$\{F_K:\{0,1\}^m\mapsto \{0,1\}^m | K \in \{0,1\}^t \}.$$
I want to understand how the elements behave.
Lets say we take some $F_{K_1}$ and evaluate at $x=...
3
votes
1
answer
571
views
RSA common protocol failure exam preparation
I am learning for the exam in cryptography and I have found an assignment about the common protocol failure in RSA.
Assignment:
Suppose Bob uses an RSA cryptosystem with modulus $n$ and encryption
...