2
votes
1answer
126 views
Chaum undeniable signature - justification for probability of misleading the verifier?
Can anyone explain me in details why does the following statement hold true in Chaum and van Antwerpen scheme for undeniable signature?
The probability that a dishonest signer is able to ...
2
votes
1answer
172 views
Finding a solution to a (sort of) discrete logarithm by asking questions
Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded
by $log$ $n$. Let $g$ be a generator of the unique ...
2
votes
1answer
235 views
DGK Cryptosystem Encryption Speedup
Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem:
We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
2
votes
2answers
191 views
Order of hashing concatenation
A = hash("blue" + X);
B = hash("pink" + X);
If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()? ...
2
votes
1answer
207 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
2
votes
1answer
78 views
Educational videos for security topics [closed]
Is there anything like the famous "sorting out sorting" video in cryptography/security.
I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2
votes
1answer
60 views
Are there any signature schemes that protect against collusion by multiple parties?
Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
2
votes
1answer
128 views
RSA-OAEP versus RSA with Fujisaki-Okamoto construction
I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
2
votes
1answer
144 views
Is the SILC protocol still used?
I'm looking into implementing a private SILC server for friends (and possibly their friends).
And after visiting the Wikipedia entry for SILC protocol, it seems all the official pages linked at the ...
2
votes
1answer
534 views
What is Implicit Authentication?
What is Implicit Authentication, in the context of authentication methods?
I searched the Web but could not find any article that describes this. If anyone can describe, it would be a great help.
...
2
votes
1answer
169 views
How to construct a zero-knowledge proof of a number of the form $n=p^a q^b$
Let $n = p^a$$q^b$ where p and q are distinct primes and a and b are positive integers. How to construct a zero knowledge proof that n is of such form?
This is actually a homework problem with a ...
2
votes
2answers
610 views
How to attack a general polyalphabetic cipher?
I am able to decrypt vigenere cipher text using the index of coincidence and chi test.
However out of interested how do you go about attacking ciphertext that was encrypted using a mix alphabet ...
2
votes
1answer
298 views
Hash or encryption function for challenge-response protocol?
Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ...
2
votes
1answer
203 views
ElGamal signature - exploiting fallacious implementation
This question is related to ElGamal signature scheme as defined here
ElGamal signature without calculating the inverse
Show how one could exploit an implementation ElGamal signature scheme in which ...
2
votes
2answers
522 views
Using an RSA private key simultanously as an AES encryption key to generate random numbers?
Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the succesor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
2
votes
0answers
19 views
Clipper chip (SKIPJACK) key exchange protocol
According to the Wikipedia page for NSA (emphasis mine):
However, NSA's Fortezza hardware-based encryption cards, created for
the Clipper project, are still used within government, and NSA
...
2
votes
0answers
40 views
Key distribution and key exchange for simple secure FTP implementation [migrated]
I'm developing a simple secure file transfer protocol for a University project using openssl.
I have a Client (let be C) and a Server (let be S).
C will send to S messages like ...
2
votes
0answers
56 views
Questions about the ideal cipher model
I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ...
2
votes
0answers
40 views
Which version(s) of SRP are in ISO/IEC 11770-4:2006?
I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password.
This states that SRP is part of IEC 11770-4, ...
2
votes
0answers
105 views
More technical details on the ongoing (alleged) Chinese cyberattacks
Recently, there has been quite a lot of news about the Chinese compromising various US weapons systems and stealing military designs through "cyberwarfare". I am reading the news sources about these ...
2
votes
0answers
100 views
LT codes with Homomorphic hashing
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
2
votes
1answer
77 views
Addition with Shamir secret sharing
When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$.
I believe this would be the correct solution (correct me if I'm wrong):
Each party ...
2
votes
1answer
76 views
What's the probable usage of Interlock Protocol
I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir.
I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
2
votes
0answers
116 views
Correct way to truncate data to a range
2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm.
I want to take a stream of k trusted random ...
2
votes
0answers
72 views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
0answers
46 views
Relaxed trust criterion for mental poker server?
I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
2
votes
0answers
110 views
Single-purpose symmetric encryption scheme for single files
I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design:
...
2
votes
0answers
66 views
State of the art in zero knowledge proof compilers?
What is the current state of the art zero knowledge proof compiler ? I need one that can minimally handle double exponentiation by a known value E.g.
$$Pok\{(\alpha):h=g^{\alpha^b}\} $$
where b, ...
2
votes
0answers
22 views
Encryption with Deduplication [duplicate]
Suppose I have a file server running ZFS with file deduplication enabled, and I have two users that are sharing files: Alice and Carol. If Alice uploads huge_file.tgz to her www/ directory, and Carol ...
2
votes
0answers
85 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
2
votes
1answer
201 views
Are there any practical implementation of a homomorphic hashing or signature scheme?
A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that
$H$ is collision resistant, i.e. it is hard to find $x \neq ...
2
votes
0answers
77 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
2
votes
0answers
72 views
Why does the SRP6 calculation of B included a multiplier k = 3?
In SRP6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$?
(In SRP 6b, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP 6.)
2
votes
0answers
59 views
How do you construct a practical full-domain hash function?
I am looking for practical constructions for Full Domain Hash.
I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ...
2
votes
0answers
129 views
Creating colliding x509 certificates: Crafting RSA moduli step
I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7).
Now I have ...
2
votes
0answers
46 views
Encrypting or HMACing password digests
Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
2
votes
0answers
154 views
Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]
Possible Duplicate:
Using CBC with fixed IV
Forgive me if this has been asked before, I looked but haven't seen any answers that suit.
Is there any danger in using CBC, encrypting a ...
2
votes
0answers
113 views
Odds of false error detection in a randomness test using the chi-squared test?
Common Criteria classifies the requirements for true Random Number Generators, and specifies how these should be tested against failures (these can occur accidentally, or following deliberate attack, ...
2
votes
0answers
63 views
Differential Cryptanalysis of FEAL-4
I'm currently carrying out a differential attack on the FEAL-4 algorithm, however I have hit a bit of a wall.
Basically I attacked the final round first (K3) using the differential characteristic of ...
2
votes
0answers
98 views
Transforming simplest protocol into a Sigma-protocol
I have some questions from previous years exams, I hope you could help me with them. :)
Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
2answers
160 views
The security proof for Key Policy Attribute Based Encryption
My question relates to the original KP-ABE paper:
http://research.microsoft.com/en-us/um/people/vipul/abe.pdf
I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in ...
2
votes
0answers
148 views
Does Keccak have an eTCR mode?
On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3):
...
2
votes
0answers
104 views
Ring Signature - paper/code difference in trying to solve inverse trap door function?
there is a paper on ring signatures and a python implementation of it here.
The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
2
votes
0answers
167 views
Is there a practical zero-knowledge proof for this special discrete log equation?
We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:
Alice knows: ...
2
votes
0answers
190 views
How do I encrypt with the private key? [duplicate]
Possible Duplicate:
RSA encryption with private key and decryption with a public key
This wording is creeping everywhere (e.g. there): "I encrypt with the private key" and even sometimes, ...
2
votes
0answers
49 views
Are there any systems like SDSI / SPKI that are currently being developed?
SPKI / SDSI look interesting but appear to have fizzled out and died. Are there any modern competitors?
2
votes
0answers
79 views
How to properly format a PGP Message Block?
As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
2
votes
0answers
136 views
Safe generator for ElGamal signature
What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)?
I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ ...
2
votes
0answers
83 views
XSLT tranform in xmlsignature form, a part of xmldocument? [closed]
I have a HTML page(A Form) where user will enter his details. Details to enter are NameagesalarystateCity Now when user enters all details and click Button then I will create xml file containing the ...
2
votes
0answers
119 views
RSA reencryption scheme
Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user?
Basically, such an algorithm would probably be ...
