1
vote
0answers
56 views
Perfect secrecy and change of plaintext probability distributions
How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions?
Do ...
1
vote
0answers
84 views
Known-plaintext attack on Blowfish in ECB mode
The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
1
vote
0answers
48 views
Predicate Encryption supporting disjunctions
I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
1
vote
0answers
36 views
Can a LIRA system work with cjdns or other decentralized meshnets?
LIRA (Lightweight Incentivized Routing for Anonymity) is a scheme to incentivize participants in Tor to contribute resources, in particular bandwidth.
The paper talks about it being used for Tor. Can ...
1
vote
0answers
84 views
One-time pad and perfect secrecy properties
I have a homework problem:
Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$
where P is probability and k is chosen uniformly.
I do not know ...
1
vote
0answers
67 views
How to represent point-at-infinity in affine coordinate
In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate.
Whether x=0 and y=0 can be considered as point-at-infinity in ...
1
vote
0answers
56 views
Prevent/minimize replay attacks in public message board
Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
1
vote
0answers
35 views
How to create a public-key certificate for RSA Web of trust?
How to create a public-key certificate for RSA Web of trust?
I have (for exemple) two public / private key pair (obviously).
They all need to sign each other certificate.
How to create the ...
1
vote
0answers
44 views
Generating non-supersingular elliptic curves for symmetric pairings
I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
1
vote
0answers
85 views
Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?
Can hash trees can provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
1
vote
0answers
85 views
Determining the algorithm used to generate a digital signature
I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature.
From the signed string, is it possible to find out what ...
1
vote
0answers
48 views
P-Complete hashes, hashing to a larger set
Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits).
Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
1
vote
0answers
27 views
Generating Polynomials for the MPQS
I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS.
I'm a bit confused as to how the MPQS works, which is ...
1
vote
0answers
100 views
Sigma-protocol for 3SAT problem
I have some questions from previous years exams, I hope you could help me with them. :)
Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
1
vote
0answers
85 views
Quadratic Sieve Bottleneck, Multiple Polynomials an option?
After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base.
The way I implemented it ...
1
vote
0answers
102 views
Computer appliance protocol
I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
1
vote
0answers
103 views
Structure of encrypted office files
I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document ...
1
vote
0answers
114 views
Is TOTP or a timestamp encryption a better timestamp-based authentication token system?
Are there advantages to using TOTP over encrypting a timestamp with a shared secret, in cases where the readability or ease of typing the token are not important?
1
vote
0answers
92 views
Efficient zero knowledge proof of least significant bits either RSA or Rabin?
I need to reveal the log(n) least significant bits of $x^2 mod\ N$ or $x^3 mod\ N$ without revealing x.
So far the best I have involves a Boudot range proof and is not a very nice construction
1
vote
0answers
155 views
Proper formatting of symmetric algorithm secret key
Given this description from RFC 4880 sec 5.1:
The value "m" in the above formulas is derived from the session key as
follows. First, the session key is prefixed with a one-octet algorithm
...
1
vote
0answers
94 views
Setting protocol parameters to achieve concrete security
Background
One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
1
vote
0answers
66 views
In S/MIME, are the same certificates always used to sign and encrypt messages?
My assumption is that S/MIME almost always utilizes certificates as follows:
My certificate can be used to allow people to encrypt messages and send them to me.
My certificate (the same ...
1
vote
0answers
143 views
Most frequently used digital signature schemes in the recent years
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.
I'm only really interested in what is employed recently (ie. last couple ...
1
vote
0answers
101 views
Security of stream cipher based on Matrix multiplication GF(256) with randomized padding
The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components:
The keyed function ...
0
votes
0answers
38 views
Can two cipher letters per plaintext letter easily defeat character frequency analysis?
For a class 5 years ago I wrote a paper about defeating character frequency analysis by using two cipher letters per plaintext letter. I didn't get much feedback from the professor so I wonder if ...
0
votes
0answers
25 views
Reverse engineering from known ID inputs and 19/20-digits outputs
I am currently having few samples of a hash encryption function as per following
ID Hash
542591 6896202108404922949
3210 7693203936755907764
2455 14877541378540063734
2275 ...
0
votes
0answers
27 views
BAN Logic, Problem to Idealize the protocols
I'm studying the BAN logic.
In the application of it, there is a step,where I have to idealize the protocol
that I'm analyzing.
I have problems to make this.
Anyone that has expertise in BAN logic ...
0
votes
0answers
40 views
How can I tell what symmetric algorithm my browser is using?
I'd like to learn more about how hard it is to break and decrypt stored HTTPS (SSL) traffic. Apparently it depends on which symmetric algorithm was chosen during the SSL handshake. How can I find out ...
0
votes
0answers
53 views
Can any one explain Circuit Privacy using fully homomorphic encryption from Gentry's thesis?
Craig Gentry's thesis talks about circuit privacy being straight forward from fully homomorphic encryption in the last chapter.
Can somebody explain in simpler terms what that means ? I have read it ...
0
votes
0answers
45 views
Password checking algorithm
I'm trying to reverse engineer key exchange protocol and faced with the following problem:
Protocol is based on Diffie-Hellman key exchange method:
g - generator
m - modulus
Alice:
a - private key
$A ...
0
votes
0answers
48 views
Complex Numbers on Elliptic Curves & Usage in Tate Pairing
I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of ...
0
votes
0answers
50 views
RSA vs El Gamal digital signature. Which is more secure?
I'm reading about the notions of security concerning digital signatures and I can't understand whether RSA is more secure than El Gamal digital signature. Well, they are both prone to forgery, but I ...
0
votes
0answers
31 views
Hardware implementation of pairing
I would like to design a hardware-based accelerator for a pairing algorithm to make it faster. I know that I need to do arithmetic over a base and an extension field.
Could anyone would suggest which ...
0
votes
0answers
30 views
Conditions for proving that a signcryption scheme is secure
If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?
0
votes
0answers
64 views
how many bit flips current computers can carry per second? When brute force is hard?
How many bit flips the fastest current computers can accomplish per time unit? i.e per second. I am trying to find when brute force attacks are considered infeasible. The reason I chose bit flips is ...
0
votes
0answers
87 views
Adding and multiplication in jacobian coordinates
How can I derive formulas for adding and multiplication of 2 points in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
0
votes
0answers
67 views
How do I generate decryption keys for the IDEA algorithm from the 128 bit key?
I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code:
...
0
votes
0answers
57 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
0
votes
0answers
83 views
Secure modulus length for Diffie-Hellman
What is secure modulus length for modular exponentiation so that finding discrete log is computationaly impossible?
0
votes
0answers
55 views
What is the significance of i^Q mod P = 1 and are there any special properties to be aware of?
I'm studying UProve, and one of the fundamental components of this technology is based upon the relationship between
i^Q mod P = 1
Lacking a specific name I can call this mathematical ...
0
votes
0answers
69 views
Method and explanation for calculating difference in speed between DES and RSA
Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
0
votes
0answers
84 views
computing inverses in truncated polynomial rings manually for NTRU encryption
Can someone explain how to find inverses in truncated polynomial rings manually (i.e. on pen and paper)?
As an example from the tutorial:
Example. Take $N=7$, $q=11$, $a=3+2X^2-3X^4+X^6$. The ...
0
votes
0answers
42 views
Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?
I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
0
votes
0answers
70 views
Use curve25519 for ElGamal crypto
DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
0
votes
0answers
80 views
Why do we need to hash both the message and the $h$ value in ElGamal signature?
The professor left us a question on ElGamal signatures:
Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
0
votes
0answers
71 views
Strong RSA problem in $\mathbb Z^*_{n^2}$
Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
0
votes
0answers
35 views
How hard is a known prefix hash preimage attack?
Suppose the attacker knows X, Z such that
H(X || Y) = Z
If bit-length(Y) < 60 then a brute force attack is possible.
What if
bit-length(Z) = 256 (such as in SHA-256)
bit-length(X) = 128
...
0
votes
0answers
28 views
How can I validate generated session keys in SRP-6a protocol
I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys.
On the client I generated a SHA1 ...
0
votes
0answers
44 views
SRP6a client server exchanged message order
In SRP6a, the public key of server is send after receiving the public key of client A. Its that okay that B send along together with s right after client send the username, and then later on client ...
0
votes
0answers
41 views
ElGamal signature: Forging a signature of a specific form
I have a question I can't solve from one of the courses I'm currently taking:
Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker
can compute a signature ...
