# All Questions

0answers
81 views

### Adding parameters to sponge's capacity

Is it safe to XOR parameters like domain, length of the message or block counter into sponge's capacity or that gives attacker control over capacity? For example NORX XORs domain into capacity. Does ...
0answers
39 views

### Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
0answers
51 views

### How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
0answers
83 views

### Brute force attack multiple stream cipher

Assume that a scheme used to secure a specific system $Π=(Gen,Enc,Dec)$ which is thought have indistinguishable multiple encryption in the presence of an eavesdropper. For any adversary $A$ that can ...
0answers
54 views

### How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send ...
0answers
57 views

### Salary Negotiation Problem

Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for ...
0answers
59 views

### What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistal ...
0answers
47 views

### Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
0answers
58 views

### Additive homomorphic encryption scheme without change in operator

I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in ...
0answers
106 views

### Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
0answers
96 views

### Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
0answers
112 views

### Explanation of part of a visual cryptography algorithm

I have been working on a project involving visual cryptography and I am stuck with the following problem. My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET ...
0answers
81 views

### Better lower bound on min-entropy

In “Randomness Condensers for Efficiently Samplable, Seed-Dependent Sources” by Dodis, Ristenpart, and Vadhan (PDF), I have seen the statement that: any tuple of distributions $(X,Z)$ is $ε$-close ...
0answers
96 views

### Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
0answers
71 views

### Missing public exponent

Using LUC RSA, I have a list of 8 public keys $(R_1,n_1)$ through $(R_8,n_8)$, and a list of $8$ messages $M_1\dots M_8$. The messages have all been double encrypted. However, one of the public key ...
0answers
100 views

### Under what conditions did a Bletchley bombe stop?

I am trying to understand the conditions necessary for one of the Bletchley Park bombes to stop. Let me give an example. I have been experimenting with Enigma machine and bombe simulators to try to ...
0answers
129 views

### Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
0answers
70 views

### Are there any asymmetric composite order group bilinear pairings?

Are there any asymmetric composite order group bilinear pairings? Is there a drawback of asymmetric over symmetric bilinear pairings of composite order either in efficiency or in security ?
0answers
95 views

### Anonymisation resilient to key leak

Problem statement Elbonian citizens have been issued a card holding a random $B_j\in\{0,1\}^b$, $0\le j<2^n$, $b\ge n+20$ (representative example $b=64$, $n=28$). The habit has grown to use this ...
0answers
304 views

### Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
0answers
128 views

### What are the current limitations (and capabilities) of Functional Encryption used for access control?

I'm trying to make my way in Functional Encryption used for access control. I read a lot of papers such as "How to Run Turing Machines on Encrypted Data", "Functional Encryption: New Perspectives and ...
0answers
146 views

### understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
0answers
76 views

### Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
0answers
227 views

### Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
0answers
202 views

### Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
0answers
102 views

### What informal indicators exist for estimating the computational infeasibility of cryptographic problems?

When assuming a block cipher primitive is secure, or a number theoretic problem is hard, this assumption is usually based on how far we are from breaking the primitive or solving the problem using ...
0answers
987 views

### Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
0answers
162 views

### Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
0answers
177 views

### Does Keccak have an eTCR mode?

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3): ...
0answers
191 views

### Ring Signature - paper/code difference in trying to solve inverse trap door function?

there is a paper on ring signatures and a python implementation of it here. The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
0answers
13 views

### What happens to NORX if the same (key, nonce, header data) triple is reused

As I understand it, reusing a (key, nonce, header data) triple in NORX leaks the XOR of the initial common prefix (but this is zero, so only its length is leaked) the XOR of the first distinct ...
0answers
30 views

### no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
0answers
48 views

### LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
0answers
101 views

### help with cryptanalysis of a sponge permutation

I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ...
0answers
61 views

### Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
0answers
68 views

### Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
0answers
31 views

### compact rsa private key format

As shown in Why does my SSH private key still work after changing some bytes in the file? a typical RSA private key file contains. The public modulus $n$ and exponent $e$; The private ...
0answers
108 views

### Provable security of cryptographic hash functions

I am working on the following exercise question: Consider the following construction of a “keyed” hash function from Katz & Lindell (ex. 7.22 (1st ed.)/ 8.21(2nd ed.)). Gen : On input 1n ...
0answers
24 views

### Seeking an implementation of the Satoh algorithm for elliptical curve point counting

I would be very grateful if someone has an implementation of the Satoh algorithm (Fast Elliptic Curve Point Counting). Can someone point me to practical algorithm implementations or provide some ...
0answers
61 views

### How to compute projective cordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
0answers
38 views

### How does darkmail (DIME) work to hide email metadata?

While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver. There were several news ...
0answers
49 views

### How to force an adversary to call a certain oracle?

Consider there is a protocol in real world, which uses a random oracle $\mathcal{H}$. In the ideal world, after the calling of $\mathcal{H}$ by some parties, intuitively I want the simulator gets some ...
0answers
58 views

### Implementation specific differences between RDRAND and RDSEED

I've read Intel's The Difference Between RDRAND and RDSEED and Intel Digital Random Number Generator (DRNG) Software Implementation Guide, but I have some open questions that are specific to usage in ...
0answers
16 views

### StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
0answers
38 views

### User revocation in Identity Based Encryption

I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one ...
0answers
65 views

### Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
0answers
71 views

### Deletion in RSA Accumulator

I am studying RSA Dynamic Accumulator and I have a question: why is simpler to calculate the new accumulator value after a deletion if is known the secret ϕ(n)? Is possible to calculate the deletion ...
0answers
51 views

### What followed findings of A. Lenstra et al. concerning shared factors of practical RSA moduli?

A. Lenstra et al. had a paper in 2012 "Ron was wrong, Whit is right", in which one reads: "What surprised us most is that many thousands of 1024-bit RSA moduli, including thousands that are contained ...
0answers
38 views

### David Chaum's anonymous credential

I am a newbie in cryptography (I know the basic RSA, AES stuffs) and am interested in anonymous authentication systems. Looks like David Chaum is the godly figure in the field. I see lots of people ...
0answers
42 views

### Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...

15 30 50 per page