All Questions

30k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
10 views

Creating disk image of encrypted disk [migrated]

I'm Fedora 21 user for some time and I'd like to create disk image to escape installing everything over again when something fails. I have encrypted storage and that fact makes me wonder. How do I do ...
66 views

ElGamal scheme attack when one message is known and ciphertexts are intercepted

Let $G$ be a finite cyclic group of order $p$ and let $pk = (g, h=g^a)$ and $sk=(g,a)$ be Bob's ElGamal public/secret key pair in $G$. To encrypt a message $m$, a random number $r$ is selected and a ...
31 views

Cryptographic Disk wiping with quantum random data?

I was thinking about using 4 Quantum Random Number Generators working at the same time to create a secure disk wiping system. Basically feed the random bits into to an approved DRBG then through an ...
83 views

Simulation aborted because the adversary doesn't use the random oracle

I'm trying to construct a proof for an encryption scheme in the Random Oracle model. This encryption scheme is like a PKE scheme but with an additional function that kind of "alters" ciphertexts ...
589 views

165 views

Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
8k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
42 views

Are covert and rational adversaries same?

Aumann and Lindell defined covert adversaries in 2009 which is informally adversaries which have a epsilon-deterrence to cheat. Some authors (for ex. John R. Wallrabenstein) have defined similar ...
64 views

Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
34 views

What is SRP-Z form?

The stanford license for SRP says: ...
119 views

Collision attacks on digital signatures

After reading this document about MD5 collision attacks, I still don't understand how collisions can make digital signatures insecure. In the paper, the researchers created two files with the same ...
67 views

Proving membership of a group without revealing identity

I have an interesting problem for which I've failed, so far, to find an elegant solution. Imagine that a user needs to repeatedly prove to public observers that they are a member of a trusted set ...
87 views

Double the key in block cipher - which approach is better?

Assume than you have a block cipher $E(k,m)$ for which the only attack exists has complexity of $2^{64}$. You consider to double the key size by either: $E'_1(k_1,k_2) := k_1 \oplus E(k_2,m)$ ...
3 views

Why do some programming language API's not support private key passwords? [migrated]

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
62 views

If I have an original file and a WinRAR password protected .rar file containing that file, than can I extract the password?
41 views

Fast mental encryption algorithm? [duplicate]

Are there any algorithms that exist to encode messages written with pen and paper such that the messages can be encrypted/decrypted mentally? For example, Bob thinks of the text "This is my ...
18 views

BKSQ Block Cipher implementation [on hold]

has anyone a working implementation of BKSQ block cipher? (preferably in c)
218 views

How many attempts does it take to crack a 32-bit password hash with this scenario?

How many attempts does it take to crack (match) a 32-bit password hash from a database of 4 million password hashes? Correct me if I'm wrong, but to crack a 32-bit password hash would take roughly ...
40 views

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
62 views

Ideas for non duplicate cryptographically secure numbers

My Boss asked me this today. I am not a math major. He needs to generate 50 billion non-sequential non-duplicate (no collisions) cryptographically secure random numbers. I work in GO. Any ideas?
94 views

EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient and I can't see how it adds any extra ...
80 views

Partial Homomorphic Schemes that are probabilistic

As mentioned in wikipedia there are many Partial Homomorphic Encryption(PHE) scheme like RSA, Elgamal, Pailler etc. Pailler encryption scheme seems to be probabilistic Are there any other PHE ...
157 views

Unblind a RSA blinded signature

I have blinded $m = 16$ with $r= 13$, $e = 7$ and $n = 209$. This resulted in $m' = 464$, which led to a $s' = 8$. Now, I want to unblind this $s'$ by using $s = s' \times r^{-1}$ but im stuck at ...
45 views

“AND” concatenation of two secure PRGs

Let $G: \ K \rightarrow \{0,1\}^n$ be a secure PRG. Define $G'(k_1,k_2)=G(k_1)\wedge G(k_2)$ where $\wedge$ is the bit-wise AND function. Consider the following ...
71 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
190 views

Adding tweak to a block cipher

I know there are XEX, XTS and other ways to add tweak to block cipher without modifying cipher itself. However they are quite slow and/or complex. If we assume we have a secure block cipher round ...
170 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
26 views

TLS encryption with a self-signed PKI and Python’s asyncio module

I want to enable TLS encryption with a custom / self-signed PKI for a self-contained distributed system built with Python 3’s asyncio. I’ve read Python’s ssl docs as well as several tutorials: ...
21 views

How to multiply two field elements generated by bilinear paring map? [closed]

I wish to clarify how to multiply two field elements generated by bilinear paring map. The following is an example where I need to multiply e1 and e2. is it possible? If yes, then how? FieldElement ...
61 views

Do all attacks against PKCS1 v1.5 encryption require an oracle

As far as I know, all attacks against RSA PKCS1 v1.5 require an oracle; is that true? Or are there any other attacks against it which are able to break it without an oracle? Background: I need to ...
185 views

Key derivation of public key without knowledge of private key

I'm looking for a convenient way to share a set of public keys across multiple services, while preserving privacy by preventing these services from tying the identity of these public key sets together ...
62 views

How to select parameters based on some condition

I am implementing a protocol for authentication where parameters need to be selected with $gcd(\mu,\phi)=1$ where $\phi=(p−1)(q−1)$. What is the best way to select the parameters while implementing
28 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
45 views

HMAC-SHA1( secret key ) with header of a transmitted file

Given: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random) Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file? Purpose: The receiver can then quickly ...
136 views

What is a “lattice” in cryptography?

There are some questions here concerning lattice-based cryptography and this kind of cryptography seems to be especially useful if quantum computers are assumed to exist. When reading such questions ...
32 views

Establish authentication

I have designed a basic authentication scheme where two nodes will mutually authenticate that other holds a shared secret. I have very limited RAM/ROM (its on uC) and bandwidth. Here it goes: ...
116 views