0
votes
1answer
39 views

Reduction to cdp,dl or cdh?

Assuming a randomize encoding scheme that takes as input a secret key $\mathsf{sk} \in \mathbb{Z}_p$ for a large prime number $p$. Then the algorithm outputs $g^{\mathsf{sk}x}, x \in \mathbb{Z}_p^*$. ...
1
vote
1answer
164 views

Factorize RSA knowing several N and E

I did a CRT challenge yesterday and there`s one problem I was unable to solve, probably due to my lack of understanding advanced crypto math. It`s about RSA. There are ten given pairs of N and E ...
0
votes
1answer
98 views

PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
1
vote
1answer
33 views

Ephemeral key is held constant in ElGamal

Is there a known algorithm to recover the sender's messages in ElGamal $\mathbb{F}_p^*$ if the ephemeral key is held constant in two or more transmissions, assuming the messages are always distinct? ...
4
votes
1answer
190 views

Do Gap-CDH groups exist?

A Gap-CDH group is such that, given group elements $g, a = g^x, b = g^y$, it is hard to compute $g^{xy}$, but, given a group element $c$, easy to verify if $c = g^{xy}$. While such groups have been ...
9
votes
0answers
323 views

Is it possible to break enigma code with a todays laptop [on hold]

I have a 500 characters enigma encoded text. Random rotors were used (not the ones from wikipedia). I know of this flaw. I can guess some words that sould be in the text, but this probably doesn't ...
7
votes
1answer
2k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
5
votes
1answer
157 views

Fast attack on approximate GCD problem?

This question is about the approximate GCD problem which is defined as follows: Given any number of the approximate multiples $a_i = p \cdot q_i + r_i$ of $p$, where $p$, $q_i$ and $r_i$ are integers, ...
0
votes
0answers
26 views

CPA-security of a pseudorandom permutation encryption scheme

Let $F$ be a pseudorandom permutation, and define a fixed-length encryption scheme $(Gen, Enc, Dec)$ as follows: on input $m \in$ $\{0,1\}^{n/2}$ and key $k \in \{0,1\}^n$, algorithm Enc ...
3
votes
2answers
152 views

Can a 1 byte difference in AES 128 bit keys make huge difference in output?

If we take some randomly generated key of AES-128 and we change any random 1 byte of that 16 byte key, will this make huge difference in the AES cipher text generated over same input string? Does ...
3
votes
1answer
178 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
0
votes
1answer
38 views

Hiding and Binding key in Groth-Sahai NIZK proof system

In context of Groth-Sahai NIZK proof system, I have a couple of doubts on Hiding and Binding keys. In case of hiding keys (highlighted in red), how is it ensured that $\tau(A) \subseteq \langle ...
1
vote
0answers
86 views

Groth-Sahai proofs and hardness assumptions

I am learning Groth-Sahai NIZK proof system for Bilinear groups. While going through the literature, I am getting confused on how the proof system is related to Subspace Decision, SXDH or DLIN ...
3
votes
2answers
91 views

Why should one prefer Salsa20 over ChaCha?

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from ...
2
votes
0answers
101 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
1
vote
1answer
47 views

Can CFB mode of block cipher be used as a commutative encryption?

Can CFB mode of block cipher be used as a commutative encryption? Is it possible to use CFB mode of AES block cipher to create commutative encryption? With CTR it is possible but not secure.
0
votes
1answer
124 views

Assemble RSA keys from components

I'm studying openpgp cryptography and struggling to understand some things. I can't use pgp tool for generating keys and ecryption, but have to write a simple app to generate keys, encrypt and decrypt ...
-2
votes
1answer
76 views

Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem

Let $q$ prime number, $G$ a cyclic group with order $q$ and let $g \in G$ be a generator of $G$. Suppose that you have an algorithm $A$ who takes input the element $g^a$ of $G$ and gives as output the ...
2
votes
1answer
53 views

Is the ring of octonions “commonly” used in Cryptography?

I've recently read "Fully Homomorphic Encryption on Octonion Ring" by Yagisawa, which is based on octonion rings over finite fields. Personally I've never encountered octonion rings in cryptography ...
1
vote
1answer
50 views

Simulation Based Proof: What Can / Can not Simulator Do?

I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance: ...
2
votes
1answer
89 views

How to prove that a function is not pseudorandom?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I'm struggling with the exercies which ask for proofs, like the following one: Let G(k) be a PRG with ...
1
vote
1answer
59 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
-1
votes
0answers
32 views

Construction of ElGamal signature?

This month I am trying to study cryptography by myself. I started to read theory and problems on the internet. I found this problem on a cryptography site and I need your help for a solution or any ...
5
votes
1answer
73 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
3
votes
1answer
114 views

Image sharing without data overhead

The idea is to share $n$ images among $n$ persons so that all images can be reconstructed by someone in possession of all shares. However, there must not be any data overhead (which means the shares ...
6
votes
3answers
2k views

A timestamping authority (digital notary)

Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message ...
1
vote
2answers
39 views

Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...
4
votes
4answers
214 views

Computation indistinguishability questions

The definition I have is: Two probability ensembles $X = \{X_n\}_{n \in \mathbf{N}}$ and $X = \{Y_n\}_{n \in \mathbf{N}}$ are computationally indistinguishable if for every probabilistic ...
0
votes
1answer
36 views

Algorithm for factoring a number $n$ of a specific form given $n$ and $\varphi(n)$

Given the natural number $n$, which is in the form $p^2 \cdot q^2$ with $p$,$q$ prime numbers. Also $\varphi(n)$ is given. Describe a fast algorithm (polynomial time) that calculates $p$ and $q$. ...
2
votes
0answers
34 views

How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
0
votes
0answers
11 views

unable to create cms signed message [migrated]

So I'm trying to create a CMS signed message with OpenSSL and am having some difficulty. Here's what the OpenSSL docs say: ...
1
vote
1answer
54 views

Transforming Gaussian random bytes to uniform

I am not exactly sure if this is for math stackexchange or crypto: If a TRNG outputs a bit-string in the following format: $X_1,X_2,...X_N $ where each $X_i$ is a Gaussian Truly random BYTE and the ...
1
vote
1answer
72 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
2
votes
1answer
96 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
3
votes
0answers
24 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
-3
votes
0answers
36 views

Encryption of byte-array with specific range?

I have a small question regarding encryption. When transferring data through the internet, before transmitting data we should put it in an array of bytes and it will be in the range [0-256]. What is ...
1
vote
2answers
36 views

El-Gamal signature with two messages

Alice uses an ElGamal signature with base the group $Z^*_{107}$ and parameter $g=3$ of order $q=53$.The private key of Alice is some $x \in \{0,1,.....,52\}$ and the public key of her is $y=10$. To ...
3
votes
1answer
87 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
9
votes
2answers
228 views

Terminology: differences between the terms “pre-master secret”, “master secret”, “private key”, and “shared secret”?

Both crypto.SE and security.SE have excellent Q&As about how TLS generates session keys (I have linked some at the bottom). In reading these threads I'm having troubles with terminology since the ...
10
votes
3answers
211 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or ...
3
votes
1answer
121 views

How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
1
vote
0answers
19 views

Why is Chrome saying that “TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)” is an obsolete cipher suite? [migrated]

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite". For what reason is it ...
2
votes
1answer
41 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
1
vote
1answer
122 views

Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper ("RSA ...
3
votes
0answers
24 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
9
votes
1answer
4k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
1
vote
1answer
221 views

How does knowing the factorization of N help to obtain the secret?

Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?
3
votes
1answer
89 views

How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
2
votes
2answers
21 views

Why is Rabin encryption equivalent to factoring?

I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia). Here's my objection: let's say you have a Rabin decryption oracle that takes ...
5
votes
1answer
92 views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...

15 30 50 per page