All Questions

501 views

Common Modulus Attack in a Lucas Group

I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ...
84 views

Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
48 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
27 views

Generating Polynomials for the MPQS

I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS. I'm a bit confused as to how the MPQS works, which is ...
99 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
83 views

Quadratic Sieve Bottleneck, Multiple Polynomials an option?

After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base. The way I implemented it ...
100 views

Computer appliance protocol

I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
98 views

Structure of encrypted office files

I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document ...
109 views

Is TOTP or a timestamp encryption a better timestamp-based authentication token system?

Are there advantages to using TOTP over encrypting a timestamp with a shared secret, in cases where the readability or ease of typing the token are not important?
88 views

Efficient zero knowledge proof of least significant bits either RSA or Rabin?

I need to reveal the log(n) least significant bits of $x^2 mod\ N$ or $x^3 mod\ N$ without revealing x. So far the best I have involves a Boudot range proof and is not a very nice construction
150 views

Proper formatting of symmetric algorithm secret key

Given this description from RFC 4880 sec 5.1: The value "m" in the above formulas is derived from the session key as follows. First, the session key is prefixed with a one-octet algorithm ...
92 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
65 views

In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
140 views

Most frequently used digital signature schemes in the recent years

I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today. I'm only really interested in what is employed recently (ie. last couple ...
101 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
55 views

how many bit flips current computers can carry per second? When brute force is hard?

How many bit flips the fastest current computers can accomplish per time unit? i.e per second. I am trying to find when brute force attacks are considered infeasible. The reason I chose bit flips is ...
85 views

Adding and multiplication in jacobian coordinates

How can I derive formulas for adding and multiplication of 2 points in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
55 views

How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code: ...
54 views

How fast can a wrong decryption key be detected using ECC?

When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that? ...
81 views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
80 views

Secure modulus length for Diffie-Hellman

What is secure modulus length for modular exponentiation so that finding discrete log is computationaly impossible?
54 views

What is the significance of i^Q mod P = 1 and are there any special properties to be aware of?

I'm studying UProve, and one of the fundamental components of this technology is based upon the relationship between i^Q mod P = 1 Lacking a specific name I can call this mathematical ...
60 views

Method and explanation for calculating difference in speed between DES and RSA

Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
78 views

computing inverses in truncated polynomial rings manually for NTRU encryption

Can someone explain how to find inverses in truncated polynomial rings manually (i.e. on pen and paper)? As an example from the tutorial: Example. Take $N=7$, $q=11$, $a=3+2X^2-3X^4+X^6$. The ...
37 views

Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
65 views

Use curve25519 for ElGamal crypto

DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
78 views

Why do we need to hash both the message and the $h$ value in ElGamal signature?

The professor left us a question on ElGamal signatures: Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
71 views

Strong RSA problem in $\mathbb Z^*_{n^2}$

Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
33 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows X, Z such that H(X || Y) = Z If bit-length(Y) < 60 then a brute force attack is possible. What if bit-length(Z) = 256 (such as in SHA-256) bit-length(X) = 128 ...
23 views

How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
40 views

SRP6a client server exchanged message order

In SRP6a, the public key of server is send after receiving the public key of client A. Its that okay that B send along together with s right after client send the username, and then later on client ...
37 views

ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
19 views

Kryptos : K3. What is the accepted transposition for a solution?

I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. It's understood that K3 is solved via transposition, but I have seen several solutions. Which is the best/accepted one?
39 views

How does padding in PMAC work? I have been told two stories: Firstly, I have been told that it works similar to CMAC padding, and secondly, I have been told that it does not need padding. I find the ...
32 views

Security of .net AES implementation and security of a hash MAC

Hello I wanted to ask if there is any review about the security of the AES implementation of the .net Framework? I found nothing concrete to that question, searching the Internet. And, but this is a ...
82 views

RSA and One Time Password (OTP) service

What is the expert cryptographic opinion on the following? Assume that there is a web server and a client on web page. User on the Client calls an OTP web service on the server which a) creates a ...
30 views

How to create a public-key certificate for RSA Web of trust?

How to create a public-key certificate for RSA Web of trust? I have (for exemple) two public / private key pair (obviously). They all need to sign each other certificate. How to create the ...
48 views

How compared encryption algorithm in terms of efficiency

I doing to compare two algorithm cryptography. first algorithm is RSA cryptography and second algorithm is El Gamal elliptic curve cryptography. now I want a way to compare between two algorithm by ...
40 views

elgamal based decryption mixnet

Can anybody help me to understand elgamal based decryption mixnet? Pure elgamal can be used in mixnet (re-encryption mixnet) and its very easy, and I have implemented decryption mixnet using RSA also. ...
154 views

Cryptographic Protocol using NaCL

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
77 views

Factorize RSA knowing several N and E

I did a CRT challenge yesterday and theres one problem I was unable to solve, probably due to my lack of understanding advanced crypto math. Its about RSA. There are ten given pairs of N and E ...
60 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
52 views

Timestamping services authorities, utilizing Linked, hybrid and other than PKI schemes

What are well respected Cryptographic Timestamping authorities utilizing more sophisticated than just PKI (RFC 3161) schemes, like Linked, Linked and signed, distributed hash trees (maybe P2P?), ...
47 views

What happens when you use Windows credentials to sign a message?

I'm trying to dig into the messages that are exchanged when you sign a message using Windows credentials. I've modified the default service that is provided when you create a WCF service to use the ...
73 views

Is this a secure multiparty protocol?

I am facing the following situation and i am trying to break down the problem into some specific cryptogrphic primitives. There is a function F that takes as input a bit string and produces a ...
57 views

Perfect secrecy Proof

A symmetric cryptosystem have perfect secrecy $\iff$ for all distribution over the messages space, $M$, and for all $m0$, $m1$ (messages) and any ciphertext $c$, $$P(c|m0) = P(c|m1).$$ I got ...
36 views

I am read the paper and I found the follow Lemma2 (pp. 13) Suposse that there exists, for any $Hash_z$ and any $Gen$, an algorithm $A$ ... My question is Why "for any $Hash_z$ and any $Gen$"? Are ...
34 views

sir,please suggest me an algorithm or method how can i improve the prediction based encryption method using randomization?

I am doing research on security for data migration in cloud computing. I have gone through many encryption algorithms to secure data for migration, but I want to create my own algorithm that could be ...
I like know Why $Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = 1/2$, when $\Pi$ is a One Time Pad. I trying: Pr[\mathsf{PRIV_{EAV}}(\Pi,A,n)=1] = Pr[b'=0|b=0]Pr[b=0] + ...