All Questions

Filter by
Sorted by
Tagged with
3 votes
1 answer
1k views

Breaking a small-scale Example Diffie-Hellman?

I started to read about Diffie-Hellman exchange and I encountered a problem which I don't know how to solve. Given $g=3$, $p=131$, $g^x\bmod p=112$, $g^y\bmod p=74$, compute $g^{xy}\bmod p$ $113$ $...
user avatar
3 votes
1 answer
458 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
sribin's user avatar
  • 248
3 votes
1 answer
662 views

Key equivalence across different elliptic curves

Is it possible to prove key-equivalence across elliptic curves of different order? Specifically: Suppose I have a key $x$ valid for both curves listed below On curve $g$ (for example, Curve25519) it ...
irakliy's user avatar
  • 969
3 votes
1 answer
305 views

SSH sequence number validity?

Looking at RFC4253, I came across the notion that the MAC is applied the encoded packet concatenated with a sequence number which acts as a counter. However, I couldn't find any information on how ...
Daniel B's user avatar
  • 347
3 votes
2 answers
2k views

Generating secure short activation code for offline applications

My application is as follows User has a hardware system (with an unique ID) that does not have connectivity but has a keypad for input. To make the hardware operational, the user has to go to central ...
am3's user avatar
  • 131
3 votes
1 answer
427 views

Does adding a random number to my data make it secure?

Say I have some real valued data that i want to keep secure. Now I have to pass on some modified version of the data to a second party for some computation, but i do not wish to reveal my data to the ...
Riddhi Ghosal's user avatar
3 votes
2 answers
217 views

Discrete Logarithm in a specific group

I am considering a setting similar to the one of the Paillier cryptosystem, where we sample two distinct odd primes $p,q$, we set $n=pq$, we generate $a \leftarrow \mathbb{Z}_{n^2}^*$ and finally we ...
Cip Baetu's user avatar
3 votes
1 answer
3k views

What is the maximum message size when using ECDSA (specifically secp256k1?

I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
JohnGalt's user avatar
  • 546
3 votes
1 answer
69 views

How to decrypt using public key?

Can anyone decrypt ciphertext using a public key? I always thought we can only decrypt using a private key. In that case, what does this line in the RLPx documentation mean? ...
Mahesh Uligade's user avatar
3 votes
1 answer
9k views

Attacks on Aes (128-192-256) [duplicate]

I have a direct question Is there any practical attacks on the AES cryptosystem (128-192-256 keys)
user58232's user avatar
3 votes
1 answer
198 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
asmiller's user avatar
  • 133
3 votes
1 answer
394 views

aWallet Password Manager

After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for Android to backup my passwords. I like ...
y2k-shubham's user avatar
3 votes
1 answer
152 views

Security implications of slow-by-design hashes on relative security vs. hash size

Would it be true to say that that one can get away with much smaller cryptographic hashes if the hashing algorithm is slow and expensive by design? Example: let's say you want 128-bit hashes. This is ...
Adam Ierymenko's user avatar
3 votes
1 answer
4k views

Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?

Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue? Practical example: ...
antak's user avatar
  • 133
3 votes
1 answer
2k views

Would it be safe to store GCM nonce in the encrypted output?

I'm looking to use AES-256 GCM to encrypt and authenticate a file containing sensitive information. I am a bit loss on where to store the nonce that is required for GCM. Would it be adequate/safe to ...
sdwmsn's user avatar
  • 33
3 votes
1 answer
519 views

Verifying signature of plaintext using encrypted message only

I'm looking for an algorithm which allows verifying a signature of a plaintext message but while only having the encrypted message. The requirement is for Alice to send Bob a plaintext message (M) ...
somdoron's user avatar
  • 115
3 votes
1 answer
1k views

Varying ECDH key output on different ECC implementations on the secp256k1 curve

Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
Josh Hernandez's user avatar
3 votes
1 answer
2k views

Matyas–Meyer–Oseas for super-fast single-block hash function

Is it basically safe and correct to use the Matyas–Meyer–Oseas construction to turn a fast block cipher like AES into a really fast single block hash function? By single block hash function I mean ...
Adam Ierymenko's user avatar
3 votes
4 answers
158 views

secretKey ⊕ (secretKey ≪ 1), is randomness lost?

A truly random secret key is run through a cipher secretKey ⊕ (secretKey ≪ 1) is randomness lost? As in, is the computational cost to guess the ciphertext from <...
lsh's user avatar
  • 41
3 votes
1 answer
842 views

Differential privacy of "randomized responses"

We define randomized responses as follows: In a question that can be responded with a "Yes" or "No", a respondent is asked to flip a fair coin, in secret, and answer the truth if it comes up tails. ...
Nikos Fotiou's user avatar
3 votes
1 answer
187 views

Matsui's paper on linear cryptanalysis - unexplained formula in Lemma 2

How does he end up with this result in his article ?
frkntrn's user avatar
  • 31
3 votes
2 answers
214 views

Fully homomorphic encryption with polynomials

I have read some texts concerning fully homomorphic encryption but didn't find the following simple idea. Let $p$ be a prime. We choose secret key $x_0$ in the interval $1\le x_0<p$. Let $\mathrm{...
Alexey Ustinov's user avatar
3 votes
2 answers
810 views

Schnorr identification protocol security proof

I read about security proof of Schnorr identification protocol against impersonation attack. For the sake of comprehensibility let me sum up the protocol: Given group $G$ with generator $g$. Verifier ...
jakob's user avatar
  • 185
3 votes
2 answers
241 views

Winternitz-OTS+ with Poly1305

Would it be safe to implement Winternitz OTS+ using Poly1305 as a parameterized MAC? It's very fast and apparently very secure but with the caveat that keys cannot be used more than once, which is ...
Adam Ierymenko's user avatar
3 votes
2 answers
322 views

Are there any misuse-resistant asymmetric encryption schemes?

The notion of misuse-resistant authenticated encryption (MRAE) was defined in the symmetric setting by Rogaway and Shrimpton, along with the SIV mode that achieves it. The idea being that modern ...
Neil Madden's user avatar
3 votes
1 answer
1k views

What is the difference between these two TLS suites?

I am comparing the security information of two different HTTPS connections in the Google Chrome (v63.0.3239.132) security tab in developer tools. The information for each of the two connections is ...
Luke Park's user avatar
  • 562
3 votes
2 answers
109 views

Encrypting a pseudorandom message

Does encrypting a pseudorandom message need the same requirements from a block cipher? For instance, can we decrease the number of rounds of AES if we want to cipher a random block, without any ...
Adam54's user avatar
  • 239
3 votes
3 answers
3k views

On what basis are block sizes chosen?

Sha1/0 (160 bits output), md5(128 bits output) has block size of 512 bits. Gost has 256 bits. What is the reason behind having it specifically 512/256/1024 bits? What are the various factors which ...
sourav punoriyar's user avatar
3 votes
1 answer
224 views

Complexity leveraging in case of exponentially many hybrids

Complexity leveraging is a proof technique in cryptography where the reduction algorithm runs in super-poly time. (see this). Many papers use complexity leveraging when there are exponentially many ...
satya's user avatar
  • 1,404
3 votes
1 answer
4k views

Why do we use multiple rounds of encryption?

I understand that DES and AES use multiple rounds of encryption to secure the cipher text output, what is the real reason this is carried out? Is there a certain point performing multiple rounds ...
Erdss4's user avatar
  • 135
3 votes
1 answer
131 views

Why don't we use an Extendable Output Function to efficiently store the public key of Regev's LWE-based encryption scheme over standard lattices?

In LWE-based schemes the public key is generated by choosing a random matrix (or polynomial) $A$, and outputting the pair $(A, b = A\cdot s + e)$, where $s$ and $e$ are vectors/polynomials with ...
Timo's user avatar
  • 33
3 votes
1 answer
429 views

Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
fgrieu's user avatar
  • 141k
3 votes
1 answer
490 views

Independently choose lanes and threads param on Argon2

I'm researching on using Argon2 on a JavaEE server-side application. I'm a bit reluctant to set the parallelism parameter larger than 1 on a JavaEE environment where threads are supposed to be ...
Kos Prov's user avatar
  • 133
3 votes
1 answer
289 views

Safety of using GPG's libgcrypt prime generation for generating ephemeral Diffie-Hellman primes?

My company wants to generate new primes for every Diffie-Hellman key exchange. We are thinking of using the prime generation scheme in GPG’s libgcrypt library. The code documentation says that the ...
Jonas Weber's user avatar
3 votes
1 answer
161 views

Why is variable rotation uncommon in cryptographic primitives?

Most cryptographic primitives I've seen rotate by a constant. RC5 did something different though: For a word size $w=2^n$, you can take the last $n$ bits of a value as a rotation amount. There's more ...
EPICI's user avatar
  • 359
3 votes
1 answer
9k views

Feistel cipher key generation and round function algorithms

I'm getting confused of what is the actual structure of the key generation and the round function algorithms that Feistel cipher uses. I have been reading many resources about block cipher. All ...
FSm's user avatar
  • 133
3 votes
1 answer
665 views

What is gpg2 algo 1 and 8 concerning its signature-procedure?

While signing a test-file, gpg2 creates a file test.sig which contains this: ...
user1511417's user avatar
3 votes
1 answer
167 views

What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
hardyrama's user avatar
  • 2,126
3 votes
1 answer
1k views

Is the following a PRG?

Let $G: \{0, 1\}^n → \{0, 1\}^m$ be a PRG. We construct a function $G': \{0, 1\}^{m + n} → \{0, 1\}^{2m}$ defined as follows $G'(x || y) = x || (G(y) ⊕ x)$ for all $x ∊ \{0, 1\}^m$ and $y ∊ \{0, 1\}^n$...
paddy's user avatar
  • 33
3 votes
1 answer
1k views

Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?

Note: This is not the same as Multiple iterations of AES for key derivation?. Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to ...
id01's user avatar
  • 141
3 votes
1 answer
794 views

How can I split a packed Ed25519 public signing key into its X and Y coordinates?

I'm using the Curve25519 code (from http://www.dlbeer.co.nz/oss/c25519.html), and trying to convert from a public signing key (Edwards form) to a public key-exchange key (Montgomery form). There's ...
Head Geek's user avatar
  • 133
3 votes
1 answer
8k views

AES-ECB known ciphertext/plaintext attack

i'm new to crypto and am working on a little exercise to understand the weakness of ECB mode encryption. Here is the scenario. I have the plain text ...
JohnnyHunter's user avatar
3 votes
2 answers
1k views

Downsides of not using deterministic ECDSA signatures for blockchain validation?

I've noticed that in many Bitcoin wallet implementations, as well as other blockchains, deterministic ECDSA signatures are being used (generally based on RFC 6979). There seems to be some benefits to ...
Duncan Jones's user avatar
3 votes
1 answer
534 views

Simulator Transcript in ZKP

I need a bit of clarification about the definition of transcript of a simulator in Zero-Knowledge Proofs. Basically, the way I understood it, the simulator is given access to the (potentially ...
BentBoolean's user avatar
3 votes
2 answers
516 views

Efficient way to combine collection of hashes into a single hash?

I have a system where each user will submit a set of data. The data will be hashed and their hash will be submitted to the server. My plan is to combine each users hash (converted to bytes XOR'd with ...
user49973's user avatar
3 votes
1 answer
4k views

AES-256 with random key generation instead of hash

In order to use AES256 encryption, we will need a 256 bit key, and 128 bit iv. We will need some kind of salt and hashing function to convert a password to the desired key. However, let's assume the ...
Rowanto's user avatar
  • 133
3 votes
1 answer
182 views

Idiomatic description for an adversary in possesion of a quantum computer?

I was wondering what the "accepted" way is to describe an adversary who: is in possession of a quantum computer with which they can efficiently run quantum algorithms such as Grover's or Shor's ...
user1870238's user avatar
3 votes
2 answers
350 views

Can GnuPG be used with a login system?

I was thinking about creating a proof of concept for the following type of website login system. Instead of passwords being used, on account creation, a public GnuPG key is uploaded to the server, ...
James's user avatar
  • 133
3 votes
1 answer
400 views

Understanding pseudo-random functions (used in a Oblivious Transfer Protocol)

Given a family of pseudo-random functions $$\{F_K:\{0,1\}^m\mapsto \{0,1\}^m | K \in \{0,1\}^t \}.$$ I want to understand how the elements behave. Lets say we take some $F_{K_1}$ and evaluate at $x=...
Marc's user avatar
  • 297
3 votes
1 answer
571 views

RSA common protocol failure exam preparation

I am learning for the exam in cryptography and I have found an assignment about the common protocol failure in RSA. Assignment: Suppose Bob uses an RSA cryptosystem with modulus $n$ and encryption ...
Zagatho's user avatar
  • 133

15 30 50 per page
1
178 179
180
181 182
607