# All Questions

1answer
61 views

### RSA-OAEP: How does it work?

I was looking at this image about OAEP: ..and was wondering what was happening here. We have a data block DB which consists of: ...
1answer
185 views

### When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ ...
0answers
29 views

### Subset sum hardness

Hardness of a subset sum probleme depends on it's density. Is it possible for a subset sum problem to be intractable even if it's density is less than 0.9408 ?
0answers
40 views

### Compressing AES [duplicate]

I have this program which encrypts multiple files using AES then compress it using LZO into one single file. The problem is that the final file is almost equal in size than all the files which means ...
2answers
80 views

### Understanding the distinguisher for a PRG

Given the following definition of a psuedorandom generator, I'm having trouble understanding what exactly the "distinguisher" D is outputting, and when?
0answers
19 views

### Security issues with self encryption? [duplicate]

I'm thinking about the scenario of using a set of (potentially untrusted) hosts to store (potentially private) files. Think something like distributed backup where you contribute some disk space and ...
0answers
62 views

### Degrade in performance with SSL_OP_SINGLE_ECDH_USE?

We have used SSL_OP_SINGLE_ECDH_USE when setting up our SSL_CTX . This seems to be causing a degrade in performance. I'm not able to find proper documentation for it except that it generates new ...
2answers
62 views

### Single-algorithm authenticated encryption

Are there any authenticated encryption methods that combine encryption and authentication, rather than useing a separate cipher and MAC?
1answer
105 views

### Is this a good communication scheme?

I'm writing a wrapper for a chat program to allow for end-to-end encryption. I'm using Python and PyCrypto to accomplish this. I'd like to use a well known library to do this, but to my knowledge, ...
1answer
53 views

### Proof of Knowledge/Data Integrity using Hash Function

Objective: A verifier wants to ensure that a block of data M is also known to a prover. The protocol should exchange little information and should not leak information about the value of M. Proposed ...
3answers
108 views

### In interactive proofs, do we assume that the prover can always solve the problem?

I'm having a difficult time understanding a concept from interactive proofs: A trivial interactive proof for the graph isomorphism problem is having the prover just send a permutation that shows an ...
2answers
85 views

### How can a message encrypted with the public key be decrypted with the private key? [duplicate]

I've been reading about encryption and have a basic understanding of the concept. What I don't understand, however, is how a calculation with one key can result in a number that, through calculation ...
1answer
55 views

Let Alice pick $v_{1}$,$m_{1}$$\in \mathbb{P} and Bob v_{2},m_{2}$$\in \mathbb{P}$. Now Alice computes $v_{1}$$^{m_{1}} and so Bob does v_{2}$$^{m_{2}}$ Then Alice exchanges $v_{1}$$^{m_{1}} ... 0answers 45 views ### Show that the shift, substitution, and Vigenere ciphers are all trivial to break using a known-plaintext attack i think that we can use the notion of knwn plan text that we could have pairs of both cipher and plantext msg and try to find way from one to another to recover the key i dont knw how to make it with ... 1answer 61 views ### Function with no fast path and with fast proof When a function is iterated and each time a previous result is used as input to the next iteration (feedback), so that there is a limited benefit from parallel computing, is there such function that: ... 0answers 133 views ### history of non secret cryptograph Prior to the discovery of any specific public-key schemes, such as RSA, an existence proof was developed whose purpose was to demonstrate that public-key encryption is possible in theory. Consider ... 2answers 524 views ### What is an example of a secure sigma proof? I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ... 1answer 103 views ### How to attack RSA-CRT with large public exponent? Suppose we have (n,e) and the ciphertext c where the public exponent e is of the same length, 1023-bit, as the modulus n. It is also assumed that the factors of n are balanced. The message ... 0answers 32 views ### no speedup from preprocessing in blynn's PBC library I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ... 1answer 127 views ### AES key and block size I am trying to understand AES and I wondered what happens in the case of a 128 bit block size and a 256 bit key. All documents I read about AES told me the key expansions algorithm for 128 ... 1answer 383 views ### Is XOR adequate for encrypting truly random data? [duplicate] It is well-known that the two-time pad is very insecure. However, it seems unexploitable in the case where the plaintext is indistinguishable from random (ex. symmetric keys). Is this property ... 1answer 177 views ### Difference between Pseudo Mersenne primes and Generalized Mersenne primes The field prime numbers p proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ... 1answer 48 views ### Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle? I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ... 1answer 43 views ### Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305? I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ... 1answer 85 views ### Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret? Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ... 0answers 18 views ### Are there known practical attacks on RC4-dropN? [duplicate] RC4 is known to leak information about the first few bytes of the ciphertext due to keystream biases. However, are there known attacks on RC4-drop[N] where N is large enough, that leak information ... 0answers 24 views ### Implementing cryptosystems with various programming langauges I know that most cryptosystems are currently implemented in C/C++. Has there been any effort to implement cryptosystems in programming languages such as Agda where proofs can be written about ... 2answers 150 views ### Is TLS secure against VM reset attacks? Is the TLS protocol secure against VM reset attacks? Background: Imagine running cryptographic software inside a virtual machine (VM). A VM reset attack is one where the the state of the software is ... 3answers 191 views ### Are there reasonably secure online voting implementations e.g. for student council elections? Assume a university want to elect the student council. This was done via paper ballot and there is a need to reach more students for voting, so electronic voting is on the table. While researching ... 0answers 63 views ### LR-Oracle Experiment in Lindell and Katz In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme \pi = (Gen,Enc_K,Dec_K) is CPA secure for ... 1answer 65 views ### Affine cipher and plaintext attacks, how to find the base modulo? Last year, a question concerning plaintext attacks was posted at Mathematics.SE: “Plaintext attacks: affine cipher”. I have no problem to see how to solve it when we are given two ciphertexts and ... 1answer 65 views ### Finding a secret cipher given the key and known plaintext? Let x,y,k be plain text, cipher text and key respectively. Also suppose \operatorname{Enc} is the algorithm of encryption for block cipher with size n. So we have$$\operatorname{Enc}_k(x)=y$$... 1answer 37 views ### Adversarial Indistinguishability [closed] I am trying to devise an encryption scheme such that an adversary can win the following game with probability at most$1/2 + \epsilon$. Adversary gives challenger two plaintext messages$m_1$and ... 2answers 120 views ### How can comparision like (>=,==) be done using homomorphic encryption? Since we know that Homomorphic encryption allow computation on encrypted data. Let two n-bit integers$(x,y)$are encrypted using some LWE public key cryptography. For example - if$x'= HEnc(x,pk)$... 1answer 74 views ### Forward Secrecy when using non-ephemeral DH In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following ... 1answer 61 views ### Encryption Oracle Avoidance I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted ... 1answer 35 views ### Do any Identity-based Encryption Systems support messaging between domains? Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE ... 1answer 87 views ### How is SSL secure? if the client and the server need to exchange keys and I can sniff it, wouldn't I be able to decrypt the data transported? 2answers 24 views ### When is data origin authentication necessary but non-repudiation not? I have been considering this question now for a week and I just cannot find an answer. I understand that non-repudiation cannot be provided without data origin authentication but I cannot think of an ... 2answers 183 views ### What is wrong in the following algorithm for computing a hash function using RSA? I'm studying for a cryto exam and have run across this question which has stumped me. What is wrong in the following algorithm for computing a hash function? Take a message$M$, generate a random ... 2answers 627 views ### When would you increment a nonce and when not? K is the shared key for encryption known by _Alice and _Bob.$N_A$is a nonce created by Alice. The function f is the increment by 1 function. (1) Alice -> Bob:$E_K(N_A)$So Alice encrypts a nonce ... 0answers 56 views ### Q: Relevance of physical layer security to cryptography I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly ... 1answer 226 views ### Hamiltonian Path Zero Knowledge Proof using Commitments to a Series of Edges Commonly, Zero Knowledge Proofs based on the Hamiltonian Path or Cycle problems are given as follows: The Prover has a graph$G$, for which he knows a Hamiltonian Path (or Cycle).$G$is also known ... 0answers 140 views ### help with cryptanalysis of a sponge permutation I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ... 3answers 2k views ### Is there any more information on this RSA backdoor? Someone posted this on reddit a few days ago, and I haven't found much about it except for links back to the same page. Here's the article ... 2answers 64 views ### Role of Fermat's little theorem in the proof of correctness of ElGamal signature In the Wikipedia article about the ElGamal signature scheme it is written, that Fermat's little theorem is used in the following proof of correctness: From the signature generation in ElGamal we can ... 4answers 634 views ### Hashing a password before using for online accounts I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ... 1answer 67 views ### How to change the master password in a password manager For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ... 1answer 44 views ### Block cipher detect padding behaviour Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ... 2answers 85 views ### Discrete logarithm hash function Exercises I have a problem with this exercise: Let$G$be a group of order a prime$q$and let$g, h$, be two randomly selected elements of$G$, with$g,h\ne 1\$. Consider the following hash function on ...

15 30 50 per page