3
votes
0answers
38 views

Best Attack Against HFE cryptosystem

I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim However, Faugere and Joux demonstrated that we can solve and ...
9
votes
1answer
273 views

Non-iterative cryptographic hash functions

Consider the following cryptographic hash function $H$ which maps a message $m$ of variable size to $b$ bits: $$H:\{0,1\}^{*} \mapsto \{0,1\}^b$$ $$y = H(m) = SPRP(IV||m||padding)\mid_{b}$$ , where: ...
4
votes
2answers
218 views

What is this “finite field cryptography”?

See RFC 5931 § 2.2.1 which talks about "finite field cryptography" as opposed to elliptic curve cryptography and it looks like it is describing the Diffie-Hellman protocol. But Diffie-Hellman is not a ...
3
votes
2answers
244 views

How to use the Extended Euclidean algorithm to invert a finite field element?

I was doing some practice on cryptography (I'm new to this topic) and was wondering what the following question even means or what it is asking me to find. I do know how to do Extended Euclidean ...
1
vote
1answer
82 views

How would an attacker perform an exhaustive key search on a block cipher using ECB mode?

Do you always assume from Kerchoff's principle, that the attacker has access to everything but the decryption key? That is, am I to assume that to perform an exhaustive key search, the attacker has a ...
2
votes
1answer
76 views

How is it possible that $g^q \equiv 1 \pmod p$ for a generator g?

The context of this question is coming up with the parameters for the ElGamal encryption scheme. One of the requirements for the parameters for ElGamal is that we have primes $p$ and $q$ such that $p ...
0
votes
0answers
10 views

What does prevent MITM in quantum cryptography? [duplicate]

One thing I really doesn't have understand, is how MITM is prevented in quantum cryptography. Lets say Alice sends to Bob a random sequence of photons organized in a specific way (vertical, ...
4
votes
1answer
43 views

Generate a random number $r \in \{1,2, \dots , k\}$, where $k$ is not public and is distributedly held

A set of parties can securely generate a random number $r \in \{1,2,3,\dots, k\}$ when $k$ is publicly known. However, can we generate the random number $r$ if $k$ is not publicly known and is held by ...
6
votes
2answers
180 views

Purpose of DES parity bits

DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits". What was the intended purpose of the party bits, and why are they no longer used in modern ...
3
votes
0answers
56 views

Are there any crypography schemes which rely on Graph Isomorphism not being in P?

Are there any cryptography schemes having correctness relying on Graph Isomorphism not being in P? If I should ask this question in the CS Theory area, I will migrate it. Thanks.
3
votes
2answers
83 views

A block cipher whose key changes after each block

I have been reading about various block cipher modes of operation, and all of them seem to treat the block cipher (including it's key and key schedule) as a sort of immutable black box. I would like ...
3
votes
1answer
165 views

Why doesn't this operation reveal the voter's message?

I am working my way through this paper. I am trying to figure out the OR zero knowledge proof in figure 2. The prover is verifying that she has correctly voted, and that her input satisfies $$\log_gx=\...
4
votes
2answers
131 views

For what does “Rcon” stand for in Rijndael/AES?

How do we expand the abbreviation “Rcon” used in the Rijndael key schedule? I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is "...
0
votes
0answers
26 views

If you receive a message with a digital signature, how do you know what verification key to use and the verification algorithm?

Really, I'm asking how do you know who sent it? My confusion has arisen from the following scenario... Problems with Signing-then-encrypting. If Alice digitally signed some data and then encrypted ...
3
votes
1answer
42 views

Reuse of TLS client key/certificate in challenge-response protocol

The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and ...
0
votes
1answer
22 views

CCA on PKCS#5 using error feedback

My question is about attacking PKCS#5 with CCA using the error feedback. What we learnt in class about PKCS#5: CBC requires padding to whole block boundary PKCS#5: standard padding If ...
4
votes
1answer
207 views

Discrete logarithm problem is easy in a cyclic group of order a power of two

Let $G=\langle g\rangle$ be a cyclic group of order $2^{k}$ and let $h\in G$. I have read that it is easy to find $\log _{g} h$, but I haven't been able to figure out how. Do you know why this can be ...
5
votes
2answers
99 views

What asymmetric key exchange algorithms are known besides DH?

On Wikipedia, a lot of the subjects that are said to be different key exchange methods are often just protocols that incorporate the Diffie-Hellman algorithm into them. The only other key exchange ...
1
vote
1answer
64 views

What are the possible security issues when exporting a plaintext database to a file like this?

Say I have plaintext database with key-value pairs of usernames and passwords. Then I iterate through the database, encrypt the passwords, and write the username and encrypted password pairs to file ...
1
vote
0answers
39 views

Can error correcting codes be used to guess this plaintext?

I pick a finite set of messages, perhaps the set of integers $M = \lbrace n \in \mathbf{Z} \, : \, 0 \leq n\lt10 \rbrace$, which you are then allowed to encode in any way you want (some form of error ...
0
votes
0answers
31 views

Is original DSA a TEGTSS-I scheme?

Brickell et al. define TEGTSS-I scheme in paper "Design validations for discrete logarithm based signature schemes" In this paper original DSA is generalized as DSA-I variant where $r = g^k \bmod p \...
4
votes
1answer
78 views

Password-based encryption with small typos allowed

I'm trying to write some software to encrypt and decrypt some messages with a password. I am trying to implement it using this post: How can I securely convert a "string" password to a key used in ...
0
votes
1answer
29 views

Partial-Message Collisions on Iterated Hash Functions

In Cryptography Engineering by Ferguson et al it says the following is a problem with iterated hash functions: Because hashing $m$ and $m'$ leads to the same value, $h(m||X) = h(m'||X)$... for all ...
4
votes
2answers
110 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
3
votes
1answer
146 views

Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?

So I have an implementation where by we have an $8$-byte random input (entirely random, not user defined) which we hash with $\text{SHA256}$. The hash is shared with many parties to the point that we ...
1
vote
0answers
37 views

How to provide mathematical proof of the security of a stream cipher against known attacks?

Suppose a person has invented a stream cipher and he/she wants to get it published. I have a few questions: In addition to providing detailed description of the algorithm, how would he/she give ...
0
votes
1answer
84 views

Storing RSA private key

Currently I'm developing an application where users generate their own pair RSA keys in order to achieve a secure communication with my server. Also clients are able to communicate directly, sending ...
1
vote
1answer
64 views

Why are there $q^2$ keys for each equivalence class in Pedersen-van Heyst Signature Scheme?

How do you know there are $q^2$ keys for each equivalence class in the Pedersen-van Heyst Signature Scheme? My textbook says this is "easy to see", however, I am not seeing it. Is it because in the ...
2
votes
1answer
63 views

A confusion on the proof of Yao's theorem (Yao 82)

I'm reading the proof of Yao's theorem on Boaz Barak's lecture, the main part of the proof is the following claim: My question is: How can we say "without loss of generality" here? Since $H^...
4
votes
1answer
479 views

Why is it a bad idea to use a UTF-8 derived symmetric key?

Given a cryptographically secure series of octets, it is often useful to display this information or store it in a database in a textual format such as hexadecimal. Why would it be incorrect to take ...
4
votes
1answer
72 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
3
votes
1answer
297 views

What's the safest TrueCrypt algorithm and hash?

I have an encrypted file container inside my NTFS pendrive. The root folder Write permission is blocked for everyone. A folder inside it has all permissions unblocked. The dummy file of TrueCrypt is ...
-1
votes
1answer
55 views

Collision-Resistance Hash Function PRF

I am trying to solve the following question with an example/proof. The question is from Introduction to Modern Cryptography by Katz and Lindell. Any help would be appreciated.
1
vote
0answers
50 views

Why need mapping to slots to embed bytes in AES-homomorphic encryption?

The encoding of each AES bytes $𝛼_𝑖$ is using CRT(Chinese remainder theorem). It means that there is an aggregate plaintext $H$ such that: $H \mod F_0 =𝛼_0(MappingData[0])$ $H \mod F_1 =𝛼_1(...
0
votes
2answers
68 views

In case M is small is it possible to recover the message

In the plain RSA encryption, suppose $N$ is 1024 bits and the public key $e = 17$. Is it secure to use this setting to encrypt very small message, say $3 \leq m \leq 9$? In other words, is it possible ...
2
votes
1answer
52 views

Are all self-synchronizing cryptosystems necessarily self-synchronizing stream ciphers?

I have a noisy communications link between two points that occasionally deletes a byte. By "self-synchronizing cryptosystem", I mean that the receiver attempting to recover the original plaintext ...
3
votes
1answer
91 views

Single public key for NaCL signing and encryption?

Bob wants to use NaCL (specifically the Python NaCL library) to both a) sign some publically available plaintext for anybody to authenticate as being written by Bob and b) encrypt some other secret ...
0
votes
0answers
21 views

Security Level Same or not in key extraction of identity-based encryption

In identity-based encryption, key generation is performed using ($s$) as a secret key for identity a as in (eq.1) $\bullet$ $Priv_{a}=s.H(ID_{a})$(eq.1) If key is generated as follows, $\bullet$ $...
-1
votes
1answer
151 views

Speed of a 16384-bit RSA key

I don't think it makes much sense to use RSA keys to authenticate the establishment of symmetric keys with strengths less than their own. From what I know, a 16384-bit RSA key's strength is roughly ...
0
votes
1answer
28 views

Symmetric : Generate new key from old ones

Symmetric keys should be refreshed regularly. Is is terribly wrong to first agree on $N$ independent keys and then generate the key $k_j$ with $j>N$ by computing some form of hash on the keys $k_{...
-1
votes
1answer
32 views

finding key from given ciphertext and open text

very new to crypto-stuff, i have to write a program in C that compute key(k) used in RC4 when I know open text(p) and ciphered(c) text so I have c_1=p_1 XOR k. How ...
4
votes
1answer
93 views

What is the recommended format/notation for crypto design?

Is there a recommended format or formal notation for documenting the combination of symmetric and asymmetric encryption, key derivation and other algorithms (and their inputs and outputs) that I think ...
1
vote
1answer
95 views

Shamir secret sharing: calculate rest of shares when you know secret and one share

Using Shamir secret sharing, one is starting with a secret and end up with a number of shares based on a polynomial. For example: INPUT: secret: 123456 Shares:4 ...
4
votes
1answer
72 views

Have I made any glaring mistakes in my use of Yao's garbled circuits?

I would like to use garbled circuits to provide a service that allows people to vote where they do not need to reveal their votes to my server or to anyone else. Let's assume that I have secure ways ...
-1
votes
1answer
82 views

What are the applications of sha3 algorithm? [closed]

I know it is used for digitally signing any data or message. It can be used for sending any message securely, but where is it applied in industries? Can anyone tell the practical applications of $\...
4
votes
0answers
47 views

Can an analog of ChaCha with 64-bit words be defined, and would it be secure?

Blake2b has a lightning fast compression function with more-than-overkill security even against quantum attacks. It seems to be based on ChaCha, but with 64-bit words and different rotation constants....
0
votes
3answers
121 views

About MAC and HMAC

I'm studying mechanisms of integrity and authentication in symmetric encryption scenarios. I want to propose some examples to see whether I got the point here: Let $m$ be the message, $c$ the ...
-1
votes
1answer
48 views

Which is the longest CSPRNG?

There are some PRNGs considered cryptographically secure. Which has the longest period among them?
1
vote
0answers
57 views

How to invert a linear hash function?

My friend is trying to convince me that his linear hash function (with a few bit operations) is secure. Is there a way to disprove this? (Or prove this, but I've read from multiple sources that this ...
11
votes
1answer
154 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] \...

15 30 50 per page