1
vote
2answers
320 views

How do I create a short signature? (e.g. less than 100 bytes)

I want to put information into a QR code and have it signed so that the authenticity of the information can be verified. But QR codes have limited storage capacity and when I used e.g. gpg I get ...
1
vote
3answers
284 views

What is h in this RSA variant?

I am trying to implement a proposed improved algorithm of RSA . Here the author has increased the number of exponents. However I am unable to understand what $h$ is in the Key generation step. Can ...
0
votes
1answer
405 views

Decrypt AES-128 with key file but missing IV? [duplicate]

I want to decrypt a file that has been encrypted using AES-128 in CBC mode using OpenSSL. I got the “.key” file – which is 32 digits – but when I try to decrypt with OpenSSL, the program asks me for ...
1
vote
1answer
143 views

Encrypting the same message using different schemes

$E_1$ and $E_2$ are IND-CPA secure encryption schemes. $E$ is defined as: $k_1,k_2 \leftarrow K_1 \times K_2$ . $E_{k_1,k_2}(m) \leftarrow E_{1,k_1}(m)||E_{2,k_2}(m)$. Hope the notations are in an ...
4
votes
0answers
112 views

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Define a commutative block cipher with keyspace the finite set $K$, and message space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto ...
0
votes
1answer
153 views

Demonstrating Diffie-Hellman key exchange using only p, A, B;

I'm trying to figure out how to demonstrate DH key exchange using what is given to me. I'm unsure of how to tackle the problem. Question: Demonstrate Diffie-Hellman key exchange. Given p=104933, ...
0
votes
3answers
283 views

Generating a number using SHA512 that users can later verify (once I publish secret seed)

I've wrote following C# method that basically takes 3 seeds and gives you number in 0-100 range. I then use that number for variety of purposes but for this question the most important one is the ...
2
votes
2answers
149 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
4
votes
1answer
280 views

Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?

Define a commutative block cipher with keyspace the finite set $K$, and data space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto E(k,x)\text{ ...
1
vote
0answers
55 views

Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist

To my understanding in a 1-n Oblivious Transfer the Sender has some Values $X_1...X_N$ and the receiver wants to retreave some $X_I$, with $1 \le I \le N$. Can one now somehow guarantee, that the ...
0
votes
2answers
57 views

Operation sequence authentication shared storage

Let's say there is a shared storage: USB flash drive, external HDD, or whatever you like. I'll refer to it as disk. Also, there are multiple parties, let's say Alice and Bob (may be thousands of them) ...
0
votes
1answer
69 views

Testing hardware random number generators? [closed]

I would like to know how to test hardware random number generators. What techniques, tools or tricks to solve the problem ? Any practical difficulties, implementation complexities etc.
0
votes
1answer
345 views

TLS/SSL's usage of Non-Ephemeral DH vs DHE

These questions revolve around DH and ECDH vs DHE and ECDHE. Specifically within the context of TLS/SSL. There are three ...
0
votes
0answers
51 views

Re-encryption mixnet

Can an Elgamal-based re-encryption mechanism be used in a free route mixnet topology? Until 2006 it was not possible, but I couldn't find the later research results or achievements. Can anyone suggest ...
4
votes
1answer
59 views

What is the Geometric Generalised T' Method?

This page by Nicolas T. Courtois mentions Geometric Generalised T' Method. It is described as an advanced geometric algorithm, never published, for finding extra linearly independent equations at ...
3
votes
0answers
139 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
2
votes
1answer
218 views

How is the curve equation used in ECC?

I have a hard time learning exactly how the elliptic curve equation is used in the ECC. $$y^2 = x^3+ax+b$$ If someone knows and could explain to me in simple steps how this is done or a link to it ...
0
votes
1answer
117 views

HKDF vs TLS PRF. Which of the one is better? [closed]

Which of the one (HKDF or TLS1.1+ PRF) is more secure and why?
5
votes
1answer
205 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
1
vote
1answer
40 views

Alert protocol in TLS

Assuming the alert protocol is encrypted AFTER a session has been established and the structure below, how does the client know whether to expect encrypted data or not? ...
2
votes
1answer
198 views

Why the need to hash before signing small data?

I’ve got two questions: I’m doing the following: Data : uuid + int + nonce Signature: ECDSA(sha256(Data) ) To verify the signature: ...
1
vote
0answers
69 views

Is Encryption without knowing the input directly possible at all?

I know the question is rather unusual, but let me clarify what I'm searching for: There is one person, lets call her $Alice$. $Alice$ has $n$ plaintexts $t_1..t_n$ and $n$ public keys $pk_1..pk_n$ of ...
3
votes
0answers
84 views

What might be assumed about a PRF if the key has been chosen?

The defining feature of a PRF $f:\{0,1\}^k\times\{0,1\}^s\mapsto\{0,1\}^*$ is that, if the first parameter is selected at random, it should be indistinguishable from a function ...
5
votes
1answer
266 views

Cryptographic system with double keys with reversible order

While reading Shamir, Rivest and Adleman's paper on "Mental Poker", I've met a mention of system such that $E_a(E_b(x)) = E_b(E_a(x))$, without however disclosing details on it, with $E_a(x)$ being ...
0
votes
0answers
33 views

Is it possible to weaken a bitcoin private key by 'using' it elsewhere? [duplicate]

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
2
votes
1answer
79 views

Generating shared secret random permutation

There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards. In ...
1
vote
1answer
76 views

Is it possible to encrypt data in such a way that it cannot be decrypted with the key used to encrypt it but can be decrypted with another key

I'm very new to cryptography and encryption so I apologize if the answer to this is well known, but I can't find anything in my research. The crux of the problem is the need to store data on an ...
2
votes
1answer
46 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
1
vote
1answer
72 views

Perl DES PCBC as protection against decryption/crypt analysis

Is error propagation in DES PCBC a good method to prevent decryption/crypt analysis by third parties? If I had a very large file encrypted with Perl's DES with the PCBC option, and then removed the ...
2
votes
1answer
70 views

Implementing AugPAKE over ECC

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about ...
1
vote
1answer
40 views

Can CBC encryption have separate keys for separate blocks of plain text?

Can we have separate key for separate blocks which we get while operating a plain text message using CBC encryption model? If yes, what are it's advantage? Please enlighten me.
2
votes
0answers
82 views

Use cases for “online” authenticated encryption?

What is the the point of an "online" mode for an authenticated cipher? I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from ...
0
votes
2answers
82 views

Times of nested algorithms in proofs of security

Proofs of security may be constructed such that an adversary $A$ is used to construct an adversary $A'$. The reduction/algorithm which uses $A$ has to perform a number of computations in order to ...
0
votes
0answers
66 views

How to make a crypto-currency robust to 51% attacks?

For Example: In Bitcoin it is theoretically possible to double spend if you control > 50% of the computational power in the network. Also it is possible to apply "selfish mining" with far less than ...
1
vote
1answer
69 views

Is it secure to choose d in a RSA key pair?

An RSA key pair consists of the private key $(n,d)$ and a public key $(n,e)$ such that $de \equiv 1 \bmod{\lambda(n)} $. Usually one chooses a small $e$ and computes $d$ by inverting it modulo ...
0
votes
0answers
84 views

Any field in a PKI certificate where some text info can be stored?

I want to store 5-10 lines of Text Info in a PKI Certificate. All I want is that when using common tools like openssl command line or certutil from Microsoft, this text info should be displayed as is. ...
1
vote
1answer
120 views

Why does Fortuna RNG use double SHA-256?

In the paper for Fortuna the authors say that you can use any good digest algorithm (obviously as long as its output is 256 bit) and then they recommend double SHA-256. Why? What's the benefit? What ...
1
vote
1answer
62 views

Near preimages, applicable to Bitcoin?

Bitcoin mining relies on generating a smaller hash than the so-called target (a function of the so-called difficultly), thus is vulnerable to a truncated preimage attack (you just need to obtain a ...
5
votes
1answer
123 views

Side-channel attacks against ECDH for Weierstrass normal form curves

I hear a lot about why Montgomery curves are used in ECC, and one reason is that the same algorithm can be used to do both point addition and doubling (this is not true for the Weierstrass normal ...
2
votes
2answers
103 views

Do we need symmetric cryptosystems?

One question I had to answer in my crypto exam today was: Do we need symmetric cryptosystems? As it stands, that's probably a debatable question, so I'd like to reformulate this as: Are ...
0
votes
1answer
94 views

Is substitution with random prefix codes secure? [closed]

The following paper interests me very much: D. W. Gillman, M. Mohtashemi, R. I. Rivest, On breaking a Huffman code. IEEE Trans. Inf. Th. Vol.42 (1996), pp 972-976. However, unfortunately due to my ...
0
votes
0answers
101 views

m ∈ Zn \Z*n, RSA works but not secure

If you happen happen to have a message m ∈ Zn \ Z*n, RSA works but not secure. How likely is it going to happen? |n|=1024 bits |p| = 512 bits |q| = 512 bits.
0
votes
0answers
44 views

Encryption of numeric value using playfair

I am studying in CSE and in my recent exam paper, A question was asked as: Construct a playfair cipher for Plaintext: semester5 and key:technology. Generally as we are taught yet, there is no ...
0
votes
1answer
128 views

AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
2
votes
1answer
193 views

Is there a time-space tradeoff attack for breaking symmetrical cryptos?

Is there any known techniques for using time-space tradeoff for speeding up symmetrical crypto breaking? Kind of like rainbow tables speed up breaking hashes by using huge precomputed tables. Is ...
2
votes
1answer
116 views

Security proof of FO(Fujisaki-Okamoto) hybrid encryption

The proof of FO hybrid encryption is hard to understand. $\:$ Especially, how does the challenger respond to the decryption queries when the challenger can only have some encryption queries? Can ...
2
votes
1answer
253 views

LFSR get output from characteristic polynomial?

Say you have a characteristic polynomial of an LFSR: $$f(X) = X^4 + X^3 + 1$$ How can I use this function f to get the output of the LFSR, given some initial state? Obviously I can create the LFSR ...
5
votes
3answers
221 views

How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
1
vote
0answers
118 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
4
votes
2answers
647 views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...

15 30 50 per page