6
votes
2answers
220 views

Where is the proof of security of Diffie's cipher?

There is an apparently provably secure cipher that was proposed by Diffie, but enhanced by R.A. Rueppel. The scheme, which was mentioned in Applied Cryptography, works like this: Measure the length ...
6
votes
1answer
2k views

How can I encrypt + authenticate short strings into similar short ciphertexts?

I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ...
6
votes
1answer
286 views

Is it safe to encrypt a public key alongside a message with AES?

If I have a message M and a public key P, and I encrypt them alongside one another: CIPHER = AES(M + P, aes_key) Is CIPHER now weakened if someone knows what P ...
6
votes
1answer
167 views

Are there any tools for expressing the cipher operations as a system of equations?

The first step In Algebraic-attack is expressing the cipher operations as a system of equations. Is there an automated tool to do this?
6
votes
1answer
63 views

SAT-Based Public Key Cryptosystem

I am researching post quantum cryptography and I've stumbled upon this article which presents a PKC with an np-complete (SAT) trapdoor. I was wondering if someone could help me understand the way the ...
6
votes
2answers
362 views

We can obtain “absolutely perfect CONFIDENTIALITY” using the one-time pad. Is there such a thing as “absolutely perfect INTEGRITY”? [duplicate]

The OTP (one-time pad) gives us perfect secrecy. This is the very best confidentiality available in this universe. (Although it does require large keys, which is beside the point of this question). ...
6
votes
1answer
138 views

differential cryptanalysis cipher for the final round

I have a problem to find the sub-key. The system is… For each round, we make the following stage: We add the round key $K_i$. Substitution : we have 8 blocks of 4 bits, and an S-box ...
6
votes
1answer
67 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
6
votes
1answer
131 views

What does the TLS 1.2 client finished message contain?

I am implementing TLS 1.2 and I'm stuck on the client finished message. My question is: what is the size and structure of a clients finished message in TLS 1.2 when using the ...
6
votes
1answer
71 views

Is the 'nonce' in bitcoin really a nonce?

Is the 'nonce' in bitcoin really a nonce? Reading definitions of nonce and salt it seems the number is used as a salt but the same value can occur in multiple blocks; there's no requirement or indeed ...
6
votes
1answer
77 views

Does “double RC4” exhibit the same weaknesses as standard RC4?

I know that RC4 is weak. However, I don't know if two RC4 streams XORed with each other can be attacked in the same way that one can, especially if $n$ bytes are dropped. Assume keys and IVs are ...
6
votes
1answer
117 views

Find collision in Ajtai's hash function using short vector

Background What is Ajtai's hash function? Given a matrix $A \hookleftarrow U(\mathbb{Z}_q^{n \times m})$ and a column vector $\vec{m} \in \mathbb{Z}_d^m$, the hash of the message $\vec{m}$ is given ...
6
votes
2answers
167 views

What may be causing conflicts in Whirlpool implementation versions?

I see by layman articles (e.g. at Wikipedia) that the Whirlpool hash function has seemingly three current versions. That is to say, they are referenced as ...
6
votes
2answers
94 views

Possible problems in using a hash algorithm to construct a stream cipher

I'll define an example hash-based stream cipher as such: $H: \{0,1\}^* \rightarrow \{0,1\}^{256}$ is the hash function. $K=\{0,1\}^{256}$ is the secret key. $N=\{0,1\}^{128}$ is the nonce. $C=\{0,1\}...
6
votes
1answer
85 views

Are CSPRNGs quantum-resistant?

It's fairly well known that Shor's algorithm kills RSA, DSA, ECDSA, DH, ... and that symmetric ciphers (AES and 3DES) and hashes (SHA-2, SHA-3) are safe as long as you double your key size / output ...
6
votes
1answer
112 views

Performing simple arithmetic operations on compressed, and both compressed and encrypted data

We all know it is possible to perform addition and multiplication operations on encrypted data by means of homomorphic encryption methods. My questions are: Is there any cryptosystem that is able to ...
6
votes
2answers
177 views

Hardware Random Numbers - How to convert Voltage signal into binary?

I have a physical unit, e.g. a resistor. I bias it with current and measure the voltage. Let us assume that the fluctuations ($\Delta V=V-<V>$) of this voltage signal are random. Now, $\Delta V$ ...
6
votes
1answer
122 views

Is there any reason not to use Single-Key EM with AES and a constant key?

I've read recently the paper "Minimalism in Cryptography: The Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is ...
6
votes
1answer
280 views

Is it possible to find a Mersenne Twister seed given only the first output?

Suppose I have a Mersenne Twister seeded with some unknown value, and I’ve been given the first output. Given only this first output, and no other information, is it possible to derive the unknown ...
6
votes
1answer
191 views

Why does GnuPG save an array of remainders when generating prime numbers?

In looking at GPG's gen_prime() function, found within the cyphers/primegen.c file of ...
6
votes
1answer
487 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
6
votes
1answer
132 views

Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality? In this question it would be allowed for the streaming mode to leak if ciphertexts ...
6
votes
1answer
268 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a co-...
6
votes
1answer
1k views

Using GMAC for Authentication without encrypting the message

I am pretty new to cryptography and have a sample of GCM mode of operation for AES. PFB the code ...
6
votes
2answers
208 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
6
votes
1answer
393 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
6
votes
1answer
446 views

Why is the polynomial in AES MixColumns multiplied modulo a reducible polynomial?

I know that the AES MixColumn step is calculated as follows $b(x) = (a(x)c(x)) \mod l(x)$ with $a(x)$ being the column to encode, $c(x)$ the fixed polynomial $c(x) = 3x^3 + x^2 + x + 2$ and $l(x) = ...
6
votes
1answer
283 views

Why does this square root algorithm work?

I've been doing some elliptic curve cryptography, and a library I'm using has this slightly bizarre algorithm for computing modular square roots: Let $x$ be some quadratic residue modulo $p$ for some ...
6
votes
1answer
526 views

Proof of storage scheme

I'm familiar with client puzzles, where the client performs some work and there is a way to prove to the server that the client has done so. Is there a way to do this, but where the client's resource ...
6
votes
3answers
4k views

Analogue encryption algorithms

I have a basic understanding of how strong encryption works on digital data. Bits can be changed so that they appear completely random and map one-to-one back to the original set, given the correct ...
6
votes
1answer
198 views

What does pseudo pre-image of a hash function mean?

So finding a pre-image means given the hash value, one tries to find a message that gives this value using the function's standard IV. What about pseudo-preimage?
6
votes
3answers
492 views

Slow one-way pseudo-random permutation?

I'm looking for a slow one-way pseudo-random permutation; or in other words a block cipher $E_K: P\in\{0,1\}^b\mapsto C\in\{0,1\}^b$ with moderate block size $b\approx 64$ bits, wide key $K$, ...
6
votes
2answers
432 views

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.
6
votes
1answer
785 views

Is the first version of the Message-Digest algorithm by Ronald Rivest publically available?

Diving into the history and evolution of the Message-Digest algorithm by Ronald Rivest, I have been able to track back papers from MD6 down to MD2. Yet, somehow I can not seem to be able to find any ...
6
votes
2answers
312 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
6
votes
1answer
1k views

Converting Ed25519 public key to a Curve25519 public key

I understand that: $$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$ Using the libsodium ed25519 implementation, I have tried to write the following: ...
6
votes
2answers
625 views

How do zero knowledge protocol with vertex-3-coloring work?

I'm currently not sure if I understood how the zero knowledge protocol with vertex-3-coloring works. I'll describe what I think I've understood and I'll write my questions in bold. Zero-knowledge-...
6
votes
1answer
677 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter $1^...
6
votes
1answer
253 views

Is there an existing AEAD scheme with minimal IV requirements?

Is there an existing AEAD scheme such that, for inputs with the same AD and IV ciphertexts are allowed to leak whether or not their plaintexts are equal, if the scheme can process the plaintext in a ...
6
votes
1answer
230 views

Did Merkle invent cryptographic hashing?

Chapter II of Merkle's 1979 PhD thesis is titled "One Way Hash Functions." The chapter appears to be the first reference to cryptographic hashing. The chapter has no references. Is there an earlier ...
6
votes
1answer
2k views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
6
votes
1answer
252 views

Is it OK to use a data-encryption key for key wrapping, too?

Our industry (area of cheap networked devices) has a standard that defines the usage of keys for both authentication and encryption using EAX mode of AES. This standard does not define key management, ...
6
votes
1answer
654 views

Goldreich-Goldwasser-Micali Construction

The Goldreich-Goldwasser-Micali construction allows to build a (cryptographically secure) pseudo-random function from of a (cryptographically secure) pseudo-random generator. More formally, let $G: \...
6
votes
1answer
1k views

Do Rabin Fingerprints have any advantages over CRC?

Background In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows: Rabin ...
6
votes
1answer
194 views

In a lattice, how can one define a good basis and a bad basis?

When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases. How does one define what a good basis is and what a bad basis is?
6
votes
2answers
569 views

Alternatives to FHE for secure function evaluation

As a followup to a previous question I asked which was more related to Fully Homomorphic Encryption (FHE), what other cryptographic methods are available for computing a private function on public and/...
6
votes
1answer
14k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
6
votes
1answer
1k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
6
votes
1answer
2k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
6
votes
2answers
1k views

Encrypt-then-MAC Confidentiality, Integrity and Authenticity

Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX? If yes, how do I go about using it? My current understanding is: E = encrypt(...

15 30 50 per page