-2
votes
1answer
57 views

moduli in SSL certificates [closed]

this is normally seen in a typical SSL certificate. For the modulus, I know that it is represented in hexadecimal form, but why is there a semicolon (:) after every group of 2 digits? ...
3
votes
1answer
93 views

Indistinguishable encryptions in the presence of an eavesdropper equivalence

I'm trying to prove that definition 5 and definition 6 in this document are equivalent. This is what I've done at the moment: Asume that the scheme has Indistinguishable encryptions in the presence of ...
1
vote
1answer
107 views

Large text file encryption per line

Some background: I receive data in text files of over 16 million records (lines). I need to be able to encrypt the first column in that file so that it cannot be deciphered. This process will be ...
2
votes
1answer
117 views

Is it possible to get better randomness by using multiple PRNGs?

I don't know if this question even makes sense, but: Is there be any benefit or impact to some sort of hierarchical (e.g. a PRNG drives the decision for which PRN to pull from a set of PRNGs) or ...
1
vote
1answer
75 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, ...
5
votes
1answer
1k views

What is Attribute Based Encryption?

Can someone explain what attribute based encryption is? I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing ...
3
votes
1answer
808 views

RSA example-calculation: Public Key = Private Key (e = d)

I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong. ...
3
votes
1answer
130 views

Is it a good idea to use Lagrange/Newtonian interpolation for encryption?

I see that Lagrange interpolation is commonly used for secret sharing, but could it be used for encryption? The goal is to reduce database I/O and compute new values on the fly. Suppose the use case ...
2
votes
3answers
150 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
2
votes
1answer
78 views

Exchanging session keys over symmetric-key channel?

I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key ...
5
votes
1answer
146 views

How come Shamir Secret Sharing uses Lagrange interpolation?

I've read that Newton polynomials have better computational complexity, but Shamir's uses Lagrange polynomials instead. Does anyone know if there are particular reason why Newton polynomials aren't ...
2
votes
1answer
110 views

LFSR Output Sampling for Berlekamp-Massey

Looking at the use of Linear Feedback Shift Registers in cryptographic algorithms, I have learned that the Berlekamp-Massey algorithm can be used to find the (shortest) LFSR that generates a given ...
1
vote
1answer
71 views

Pohlig-Hellman Algorithm: Adding up the solution via CRT

I have a question about the Pohlig-Hellman Algorithm for the discrete log problem. I understand the concept, but doing the exact calculations I get confused at one point; to illustrate, let's look at ...
1
vote
0answers
41 views

Minimum length of PKI key for signature [duplicate]

I am looking for data which shows how time it would take to brute force (or crack by any other method) different sizes of RSA/DSA keys used for a digital signature. I am looking to use as small a ...
2
votes
0answers
128 views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
3
votes
1answer
114 views

What is the quantum-resistant signature scheme with the smallest signature + pubkey?

After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant ...
4
votes
1answer
174 views

Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing?

Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ...
6
votes
2answers
112 views

Is there a way to compress multiple signatures of the same data?

So, I'm working with a system that allows individual users to each have their own private-public key pair. I would like to allow multiple users to use their private key to sign the same piece of ...
1
vote
0answers
61 views

A question or few about Mental Poker

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman -- ...
1
vote
1answer
448 views

Fastest random number generator

I just read High performance physical random number generator by K.H. Tsoi, K.H. Leung and P.H.W. Leong. It proposes a physical RNG of speed 400 Mbps. Is this the fastest random number generator at ...
1
vote
1answer
77 views

How to adjust scrypt parameters for Moore's Law?

I have been examining the scrypt paper, and I noted the claims in table 1. For 10 random ASCII characters, the cost at that time for scrypt set to $(2^{14}, 8, 1)$ is estimated to be $175T/yr. ...
0
votes
2answers
511 views

In public key cryptography, how many keys are required for secure communication between n parties?

In public key cryptography, how many keys are required for secure communication between n parties? In my view the answer should be $n^2$. Reason: There are ‘$n$’ Parties. Every Party has One (1) ...
5
votes
1answer
92 views

Are poly1305 authenticators distinguishable from random data?

Assume Alice authenticates a message $M$ with nonce $N$ and secret key $K$, creating authenticator $A$. She then sends $A$ across the network. The Poly1305 paper does not seem to specify whether it ...
1
vote
1answer
51 views

How to prove NIZK proof of knowledge?

Assuming we have an El-Gamal pk tuple $(G,q,g,g^s)$. Someone, knows only the first three parameters. In round $i$, I send him $X_i=(g^s)^{t_i}$ (the $t_i$ values are chosen randomly for each round), ...
1
vote
2answers
123 views

Deriving 2 keys using HKDF

I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly ...
2
votes
1answer
57 views

Is there a deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed?

I was just wondering, is there a type of deterministic number generator that allows me to share some (not all) numbers I've generated using a smallish seed? I have pairs of random numbers and need to ...
4
votes
1answer
127 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
1
vote
0answers
89 views

Modulo settings for successful encryption?

I saw this awesome video which shows how encryption works using "discrete logarithm". The example says: $3^x\mod17$. I understood that $3$ is called “generator”, because it has no "straight" root and ...
1
vote
1answer
89 views

DH “prime size” security in OpenSSL

There's a program that uses the following OpenSSL function... DH_generate_parameters(256, 5, NULL, NULL) ...to create DH parameters which are later used for ...
2
votes
1answer
67 views

What does it mean for an adversary to run in PPT?

I've been reading this question where a detailed description of mine is given, I've understood that a polynomial-time adversary is an adversary for which the only feasible strategy are those that take ...
3
votes
1answer
90 views

Is email an example of public-key cryptography?

It seems like email is at least analogous to public-key cryptography, the public portion of the key being your email address, and the private portion of the key being the password to the email ...
1
vote
1answer
88 views

How can I find the multiplicative inverse in the first transformation of the SubBytes() transformation in AES?

In FIPS-197 §5.1.1 , it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field $\text{GF}(2^8)$ described in Sec. 4.2; the ...
2
votes
0answers
81 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
-1
votes
1answer
85 views

Pseudo Random Generator with fixed Hamming Weight [closed]

I'm searching for way to generate secure pseudo random sequence with a fixed Hamming weight using a seed. I found below code but I need a seed to generate a sequence ... (and need know if is possible ...
1
vote
1answer
89 views

Public and private key lengths

I am generating RSA Public and Private keys with node.js instead of reading them from pem/crt files as I can hide them inside a private object using this module https://www.npmjs.org/package/private ...
3
votes
2answers
95 views

Could scrypt salts contribute to entropy if passwords & salts are only stored in human memory?

I'm unsure of how exactly the salt is manipulated by scrypt and its potential contribution if any to overall password entropy if passwords & salts are stored only in human memory for a ...
4
votes
1answer
267 views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
1
vote
1answer
134 views

Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA-256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the number of bits in $W(i)$ keep ...
-1
votes
1answer
106 views

How to calculate bit strength of Integer Factorization Cryptography (IFC) such as RSA using Python

I would like to know how to calculate the bit-strength of Integer Factorization Cryptography (IFC) such as RSA by using Python. I gathered it is based off the complexity of factorizing the modulus ...
1
vote
0answers
72 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
2
votes
1answer
62 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
3
votes
2answers
103 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
2
votes
2answers
193 views

Password-based encrypted key storage?

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
2
votes
1answer
90 views

User-specified PBKDF2 password, salt, and iterations limits

For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced? In other words, because none are ever stored by the ...
1
vote
1answer
73 views

Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
1
vote
1answer
116 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
4
votes
1answer
108 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
6
votes
2answers
170 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
1
vote
1answer
47 views

Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be ...
4
votes
2answers
102 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...

15 30 50 per page