4
votes
1answer
199 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say $s=32$;...
4
votes
2answers
215 views

Are all stream-ciphers IND-CPA?

A stream cipher usually generates a stream of pseudo-random bits which get XORed with the plaintext to form the ciphertext. The stream is generated using a given IV / nonce and a secret key. CTR-mode ...
4
votes
2answers
4k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
4
votes
2answers
438 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
4
votes
1answer
852 views

ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
4
votes
2answers
146 views

Is there an asymmetric encryption algorithm where the public key cannot be derived from the private key

Is there an encryption algorithm that will produce a public key and a private key such that the public key cannot be generated using the private key. For example, if the private key is compromised ...
4
votes
1answer
733 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
4
votes
2answers
172 views

Encrypt-then-HMAC implementation - am I doing it right?

I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on ...
4
votes
1answer
178 views

Public key in fully homomorphic encryption over the integers

I'm reading “Fully Homomorphic Encryption over the Integers” by van Dijk et al. I wonder why $x_0$, which is a component of the public key, should be an odd number?
4
votes
2answers
343 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
4
votes
3answers
331 views

Cryptographic data structure: sparse array without membership test

I would like a data structure supporting two operations: $\mathsf{set}(k,v)$ and $\mathsf{get}(k)$, with the following properties: $k$ can be any number between $0$ and something impressively large, ...
4
votes
2answers
966 views

Is this a correctly formatted PGP session key packet?

RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ...
4
votes
1answer
2k views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
4
votes
1answer
132 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
4
votes
2answers
1k views

Why is the discrete logarithm problem assumed to be hard?

This might be a quite stupid question: since a naive brute force algorithm to solve the discrete logarithm problem will only take O(n) time for a group G with order ...
4
votes
1answer
192 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
1answer
91 views

Can I store the initialisation vector (IV) in the filename?

I'm encrypting a file and I'm using an initialisation vector. Given that the IV doesn't need to be a secret, is it secure if I add it to the encrypted file's name?
4
votes
1answer
187 views

Authenticate a short message with redundant encryption instead of using a MAC?

I have a short message that’s exactly 128 bits of length. The message serves as a time-limited authorization token for a database. It contains a permission profile ID (64 bits) and an issue timestamp (...
4
votes
1answer
316 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about b),...
4
votes
1answer
239 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in \lbrace1,2,\...
4
votes
1answer
248 views

Will hashing over and over eventually give the same hash?

There are many cases in maths where doing the same thing over and over again will bring you closer to a value. Derivation of polynomials is the striking example: no matter what you start with, you end ...
4
votes
1answer
97 views

Changing encryption key without revealing the original key

Say that Alice encrypts a $\text{plaintext}$ with $\text{key}_{m}$ and gives the $\text{ciphertext}_m$ to Bob. Alice wants to send several gigabytes of $\text{plaintext}$ to Eve but she is on a mobile ...
4
votes
2answers
2k views

Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?

The system requires to be as paranoid as possible regarding security. One of the few contemplated changes to the current design is to use multiple encryption. First proposal was to use Serpent on top ...
4
votes
1answer
164 views

CBC-MAC just to verify integrity

I have a message and I want to verify its integrity and authenticity. I have a shared secret (key) that is not used for other encryption. Is it safe to send a plaintext message containing all the ...
4
votes
2answers
144 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
4
votes
1answer
109 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
3
votes
1answer
302 views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
3
votes
1answer
52 views

Is there a problem in a PK cryptosystem if the plaintexts are very small compared to the ciphertexts?

I'm wondering, suppose we have a public key cryptosystem $P = (pk,sk)$ such that $$pk: \{0,1\}^n \to \{0,1\}^{n^2},$$ that is, the ciphertexts are $n$ times longer than the plaintexts (here, $n$ is ...
3
votes
4answers
133 views

If I am about to generate one-time pad, where should I generate my pads from?

If I want to generate a few one-time pads, is it OK to just read required number of bytes from /dev/urandom without weakening information-theoretical security?
3
votes
1answer
603 views

Is SHA-256 safe when used in this way?

I am wondering whether an attacker can gain any useful information from having several hashes of an unknown plaintext that differs in relatively few bits. For example, if provided with: ...
3
votes
1answer
70 views

Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...
3
votes
1answer
138 views

More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
3
votes
1answer
66 views

Making Pascal Paillier' output absolute

Can we make subtraction result of cipher texts encrypted by Pascal Paillier absolute. Just like we use method Math.abs() in Java ? For example, if we subtract 0 from 1: 1-0 = 1, it is positive but 0-1 ...
3
votes
2answers
158 views

Why does GPG ciphertext length differ with fixed plaintext length?

Thank you for your reply. Based on your inputs. I was investigated further, find details below Step 1) Input string for encryption is UUID format Input data = c0c6f311-a793-4d65-9374-1c0e45f5382c ...
3
votes
1answer
76 views

Combining secure hashes with insecure hashes?

Assuming I'm a bank which seeks for secure hash functions to use in the process of signing on digital contents. I'd like to explain / prove why using each one of the following hash functions might ...
3
votes
1answer
67 views

Is this transposition cipher information-theoretically secure for 1 message?

Given: $m = \{0,1\}^{n}$; a plaintext message of length $n$ encoded in binary $k = randomshuffle([0, 1, ..., 2n-1])$; A secret key consisting out of unique numbers between 0 and $2n-1$ in a true ...
3
votes
0answers
497 views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
3
votes
1answer
84 views

Question about HMAC with SHA1

I would like to make sure I understood HMAC. Wikipedia declares it like: $$\operatorname{HMAC}(K,m)=H((K\oplus\text{opad})||H((K\oplus\text{ipad})||m))$$ If I want to use HMAC-SHA1, am I correct to ...
3
votes
1answer
95 views

Salting Hash stored on RFID tag?

In my application, I am trying to prevent counterfeit widgets from being used on our gadgets; think HP ink-cartridges. I will be doing such with UHF RFID tags embedded in the widgets. Unfortunately, ...
3
votes
2answers
703 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
3
votes
2answers
176 views

Is there any relation between two strings with the same MD5 hash?

Is there any relation between two strings with the same MD5 hash? For example these two strings: ...
3
votes
1answer
54 views

How are the IVs of SHA512/256 and SHA512/224 calculated?

This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA512 and SHA384 are the first 64 bits of the fractional parts of the square roots of prime ...
3
votes
2answers
138 views

Small Quantum Signatures - Reality check needed

I've been thinking a bit lately about how to get quantum resistant signatures fast and (relatively) small. One idea I've been keen on exploring is finding a crypto PRNG that allows fast-forwarding, e....
3
votes
2answers
127 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
3
votes
1answer
69 views

Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
3
votes
1answer
54 views

Need help understanding this exercise's solution

We were given this exercise, which asks us to identify the types of keys used on this diagram: The solution was Kxa -> A's private key Kya -> A's public key KxB -> B's private key My question ...
3
votes
1answer
210 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
144 views

Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
3
votes
1answer
72 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
3
votes
1answer
360 views

Why pairing based crypto is suitable for some particular cryptographic primitives?

Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...

15 30 50 per page