1
vote
0answers
24 views

Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to ...
0
votes
2answers
45 views

Trying to understand MixColumns with Hexadecimal matrix

I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook has a final answer and it does not clarify how it got the result. I am trying to ...
4
votes
0answers
52 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
4
votes
2answers
106 views

Distribution of hash values

I was wondering if the uniform distribution of hash values is a generally required criteria for cryptographic hash functions. The english wikipedia article only mentions four main properties. But it ...
4
votes
1answer
53 views

How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
0
votes
0answers
22 views

Confidentiality then Integrity with different keys [duplicate]

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
1
vote
0answers
73 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
1
vote
0answers
45 views
0
votes
2answers
240 views
4
votes
1answer
167 views

great discovery in the field of elliptic curves cryptography?

Prof. Adi Shamir says in The Cryptographers' Panel 2016: i think that NSA has made a great discovery in the field of elliptic curves cryptography and NSA wants to avoid the increased use and ...
0
votes
0answers
11 views

Calculating inverse of transposition key cipher [duplicate]

I need some help on transposition cryptography. If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I tried googling but couldn't find any steps on the ...
0
votes
3answers
48 views

Getting inverse of a transposition key

I'm new to security stuff and I have some questions about the keys of transposition cryptography. If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I ...
0
votes
2answers
62 views

How to define order according to domain parameters in elliptic curve pairing groups

According to domain parameters, as an example Type 1 pairing domain parameters are ...
0
votes
1answer
78 views

Solving for a One-time pad cipher help ; crib dragging doesnt work (no surprise) [duplicate]

Basically we're given the text 7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B 73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B 64C6401BAF45F6A930435F3DF875C4E102F8742A45C824AFCA9B ...
1
vote
1answer
44 views

How to test an encryption against different attacks [closed]

For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to ...
2
votes
0answers
69 views

how to verify subset of hashes from hash list

I need to verify a couple hashed (SHA256) integers from a list of approximately 50 hashed integers in a message. The list can be divided into groups. The (plain) integer data is not in the message, ...
1
vote
1answer
56 views

Public-key encryption with associated data

In the symmetric-key world, we have authenticated encryption with associated data (AEAD). I'm looking for something similar, but for public-key encryption: public-key encryption with associated data (...
2
votes
0answers
34 views

Password hashing in embedded systems

Are there good options for password hashing in embedded systems? These systems often cannot afford slow has functions. I can think of a few approaches: Store the (hashed) passwords in a HSM that ...
0
votes
1answer
40 views

Attack being kind of completely puzzled?

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 4 the author wrote: Thus, after all, this belief about every attack being kind of ”completely ...
1
vote
0answers
33 views

Impact of Git's use of SHA-1? [closed]

Git uses SHA-1, and it is common to sign Git commit or tag hashes to authenticate a repo. Is this insecure now?
3
votes
1answer
120 views

Why does 0x00 make bcrypt weaker?

On the following site: https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence when talking about the dangers of using bcrypt it states: There is a nontrivial ...
1
vote
0answers
40 views

Is it safe to use a key as message in keyed hashing (HMAC)?

Scenario: User gives password. A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied. The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with ...
1
vote
2answers
92 views

How to show that this modification of CBC-MAC is insecure?

I'm working on some cryptography problems, found this and I'm not sure how to solve it: Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not ...
3
votes
2answers
700 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
21
votes
7answers
6k views

Why is OTP not vulnerable to brute-force attacks?

I saw this question on the book Understanding Cryptography. At first glance it seems as though an exhaustive key search is possible against an OTP system. Given is a short message, let’s say 5 ...
0
votes
0answers
40 views

Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
0
votes
3answers
133 views

Does RSA have two trapdoors?

I watched some videos from Khan Academy explaining the algorithm for RSA encryption/decryption. They explained that there are two trapdoors, modular exponentiation being one and prime factorization ...
0
votes
1answer
35 views

Probability of generating same master secret key in Identity-based Encryption

Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system ...
1
vote
0answers
63 views

Why is the compression function in Miyaguchi-Preneel scheme secure?

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I ...
1
vote
2answers
87 views

How to calculate entropy of output of a PRNG

Suppose the entropy of seed key is $H(n)$ which is $n$-bit long and random and the output bit length of the PRNG is $2^n$, which will be used as a long running key. Though it is obvious in that case, ...
1
vote
0answers
32 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
1
vote
1answer
52 views

Dangers of using CTR mode for encryption

I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file ...
0
votes
1answer
33 views

Is there an algorithm that allows verification that 2 encrypted or hashed bits of data are the same, given that I may only know half of the key/ salt?

We have an interesting problem. Currently, we store a salted hash of some secret key known only to the clients of our clients to allow us (and our clients) to find other records that were generated ...
0
votes
1answer
106 views

Key derivation using the main AES encryption key and some plain text

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
1
vote
1answer
33 views

The security of Hidden Field Equations - sentence

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 3 the author wrote: The random oracle paradigm would be to ignore that the function formulae ...
1
vote
1answer
33 views

Building multiple keys from the same input using a KDF [duplicate]

Let's say I have a single secret with high entropy, S, for the entire application. I want to generate keys K1, K2 for 2 ...
2
votes
1answer
61 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
5
votes
2answers
156 views

Is there a security problem with this prime generation algorithm?

I am facing the following algorithm to generate an RSA public key: ...
3
votes
1answer
50 views

Identity-based proxy re-encryption using different system parameters

I am wondering if there is an identity based proxy re-encryption scheme (such as the Green-Ateniese scheme https://eprint.iacr.org/2006/473.pdf) that converts an encryption computed with ID1, system ...
5
votes
1answer
127 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
0
votes
0answers
44 views

Best/average/worst-case complexity for cryptography

I understand that the complexity of a problem can be measured by it's best-case, average-case, or worst-case complexity. Am I correct in thinking that, for cryptographic purposes, each of these is of ...
2
votes
1answer
142 views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
0
votes
1answer
43 views

What about using AES-ECB with random IV?

Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it ...
17
votes
3answers
2k views

How to publish a cipher (concept)?

In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way. So ...
1
vote
1answer
43 views

How to deal with different setup in Multikey FHE?

The scenario : using a Multikey FHE scheme, let's say LTV-FHE scheme, parties delegate the computation of some function to the mighty cloud. In LTV-FHE scheme the parties generate their keys and ...
0
votes
1answer
50 views

Mathematical Proof for Key independence in Differential Cryptanalysis

How would you construct a proof that XOR difference of two cipher texts cancels the influence of the key? I started out with a simple cipher defined as follows: $C = \Phi( S(P\oplus K_{0}) \oplus ...
2
votes
1answer
64 views

Distinguishing two sets of pseudorandom values when their keys differ by one

Suppose we use a pseudorandom function $PRF$ and a random key $k$ to generate a set of pseudorandom values: $\forall i, 1\leq i \leq n: w_i=PRF(k,i)$ Now, consider instead of picking a fresh key, ...
-1
votes
1answer
39 views

Can shuffling plaintext produce a useable key?

If I 'shuffle' the characters in a long text, is there some number of shuffles that will produce apparent randomness approaching a cryptographically secure random number generator? A chapter in a ...
1
vote
0answers
29 views

Does SIV mode work for asymmetric crypto?

In ECIES and similar schemes, is it possible to use a hash of the plaintext as the IV?
0
votes
0answers
27 views

How does TLS differ from SSH from a strictly cryptographic perspective?

How does TLS differ from SSH from a strictly cryptographic perspective? I know that there are many non-cryptographic differences between them, but I would like to know the cryptographic ones.

15 30 50 per page