0
votes
1answer
176 views

Find private exponent in RSA

The other answers for this confuse me, I know the principle of d in terms of the equation it has to satisfy. However I'm not sure how I would go about finding the private exponent without trial and ...
-1
votes
1answer
127 views

Best hash-algorithm [closed]

What is the most secure hash-algorithm. Can you also give the second best and the third best like this: 1. Test 2. test 3. TEST I dont care about the performance
-4
votes
1answer
135 views

Alternative encryption algorithm

I need a alternative encryption alcorithm to AES. It shouldn't be AES, Twofish or Serpent and it must be very strong. I dont care about the performance.
0
votes
1answer
61 views

Post-quantum hybrid encryption

Assume the following simplified protocol: seed = curve25519SharedKey(theirPublicKey, myPrivateKey) sharedKey = scrypt(seed, salt, sufficientlyHardWorkFactors...) cipherText = aes256(sharedKey, ...
1
vote
2answers
799 views

How can a cryptosystem be unconditionally secure?

The definition of an unconditionally secure cryptosystem states that the cryptosystem cannot be broken even with infinitely computational ressources and time. However, since most books define the ...
3
votes
2answers
178 views

Which multiplicatively homomorphic encryption scheme supports encryption of 0?

I want a multiplicatively homomorphic encryption scheme that supports encryption of 0 (e.g. Elgamal doesn't support). I also want the multiplication to be operated on the ciphertext of 0, i.e., if ...
3
votes
1answer
104 views

Formal relationship between encryption and random number generators?

Cryptographically secure random number generators seem to have similar properties to symmetric encryption: initial seed is permuted to produce a random numbers (key and ciphertext) given the seed, ...
1
vote
1answer
63 views

Protecting a short password

I figured that a really secure password would be an AES 128 key. If this key were to be base 64 encoded, I could replace 4 random bytes in it in order to make it unusable unless you know which bytes ...
2
votes
1answer
132 views

How to use ElGamal to encrypt zero?

ElGamal encryption algorithm is as follows: To encrypt a value $m$, it chooses a random value $r$, and calculates $c_1=g^r$ $mod$ $q$ $c_2=m*h^r$ $mod$ $q$ where $g$ is the group generator, $x$ is ...
2
votes
1answer
105 views

OpenSSL des-ede3 not producing same output as test vector implies it should be

I'm encrypting one of the standard TDEA/3DES/DES-EDE test vectors with openssl: ...
2
votes
1answer
105 views

How to implement homomorphic multiplication for Elgamal?

I want to add the homomorphic property to Elgamal in libgcrypt. This is the core code I added to the library. ...
1
vote
1answer
109 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
1
vote
1answer
110 views

what are the plaintext's for the RC4 stream cipher test vectors in RFC6229?

https://tools.ietf.org/html/rfc6229 has stuff like this: ...
1
vote
0answers
55 views

What is the fixed point attribute of DES (when used with weak-keys)

I've heard in some lecture that the weak keys in DES implies the existence of $2^{32}$ fixed points in the algorithm, i.e. that $DES_k(x)=x$ for $2^{32}$ such $x$'s. I couldn't find anything about ...
2
votes
0answers
58 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
1
vote
0answers
40 views

The purpose of the final xor in Davies–Meyer scheme [duplicate]

In Davies–Meyer hash construction scheme each block is xor'ed with the previous block cipher text. Why? The only obvious flaw I see in a scheme without this xor is the possibility to reconstruct a ...
0
votes
0answers
40 views

Memory requirement in light weight block ciphers cryptanalysis

If we have a light weight block cipher where the block length is different than the key length. Let's say the block has a length of 64 bits while the key is 80 bits. For an attack to be successful, ...
1
vote
1answer
103 views

Attacker in a key exchange

I'm having trouble with the following question: $X(A) \rightarrow B:(A,N_X)$ $B \rightarrow X(S):(B,((A,N_X,T_B),K_{BS}),N_B)$ $X(A) \rightarrow B:(((A,N_X,T_B),K_{BS}),(N_B,N_X))$ ...
0
votes
0answers
53 views

How does SafeNet MobilePass calculate the counter for following passwords?

Original Question: How does SafeNet MobilePASS generate passwords? The algorithm to calculate passwords was implemented by the author of the original question here: ...
2
votes
1answer
73 views

Security of DES P_BOX

I'm curious about the design of the P_BOX of DES. I found a paper on this topic, but it dates back to 1989. This means the effect of p-box values of the cipher immunity against Differential ...
3
votes
1answer
92 views

Secure multiparty computation of conjunction

Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
1
vote
1answer
75 views

Perfect secrecy of a crypto system

Suppose we have the following crypto system: $P = C = K = \{0, 1, . . . , n − 1\}$, $E_k(x) = (x + k) \bmod n$ and $D_k(y) = (y − k) \bmod n$. Prove that the crytosystem has perfect secrecy. Perfect ...
3
votes
2answers
283 views

Does RSA operate over a Finite Field (Galois Field)?

Is it correct to say that RSA operates over a Finite Field (Galois Field)? In this case GF(p)? I do understant that the modulo in RSA is not itself a prime number, but all the operations ...
0
votes
2answers
158 views

Possible hashing scheme

Plaintext(binary) : 10101100 //very short for easy understanding Suppose we have 4 predefined schemes/functions, rotate (101 -> 011) flip (1101 -> 1011) exchange (11011 -> 10111) stretch (1100 -> ...
1
vote
2answers
108 views

How does SafeNet MobilePASS generate passwords? (TOTP Variant)

This question is similar to How does SafeNet MobilePASS generate passwords? The question and answer there is related to the HMAC Variant of SafeNet Mobilepass. I'm looking for details on the TOTP ...
16
votes
5answers
727 views

Why are primes important for encryption

Why are primes so important? Why can't we just use a random number? My guess is that it's because finding a random prime require more computing power, than finding a random number. Can anybody confirm ...
5
votes
1answer
248 views

Dancing confusion with Daniel J. Bernstein's stream ciphers

I know of Salsa20 which won the ESTREAM competition. This is dated of 25 Dec 2007. There is also the ChaCha20 stream cipher (cr.yp.to/chacha.html). This claims to increase the amount of diffusion ...
1
vote
1answer
86 views

one time pad regarding

If I had two ciphertexts $$c_1 = m_1 \oplus y_1 \text{ and } c_2 = m_2 \oplus y_2$$ will it be possible to obtain $$z_1= (m_1 \lor m_2) \oplus y_1 \oplus y_2 \text{ and } z_2= (m_1 \land m_2) ...
7
votes
1answer
202 views

Why is authenticated CFB mode insecure?

I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it: Let $P_1,P_2,\ldots P_n$ be the ...
3
votes
1answer
83 views

Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume ...
5
votes
2answers
233 views

Extending pseudorandom generator by one bit using exclusive-or of previous bits

Is it possible to have a pseudorandom generator that extends its output by 1 bit by simply appending the exclusive-or of all the previous bits? I know the output of a pseudorandom generator is ...
2
votes
1answer
91 views

How do we find the subkey out of a differential cryptanalysis?

I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we ...
0
votes
1answer
66 views

“Kernel attack” on MinRank — why do we guess $\left\lceil \frac k n \right\rceil$ vectors?

The kernel attack on MinRank is described here (page 5). My question refers to this line: Note that if $m = \left\lceil \frac k n \right\rceil$, the system essentially has only one solution ...
8
votes
3answers
673 views

What is the difference between uniformly and at random in crypto definitions?

Very often in the description and analysis of a cryptographic protocol there is a need for a an element $k$ that is sampled uniformly AND at random. Is there a redundancy in the definition with ...
0
votes
0answers
65 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
2
votes
1answer
186 views

How to customize a standard encryption algorithm?

I want to modify and customize AES encryption algorithm and develop a variant of it. What factors should I consider so that it does not become weaker? What skill sets would be required to undertake ...
1
vote
1answer
105 views

Malleability of homomorphic encryption

El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable? Thanks!
0
votes
2answers
213 views

What would be the best plain text Cryptography method without the use of a computer? [closed]

What would be the best Cryptography method without the use of a computer? This could be a list of the current options available, that could be used without the use of a computer ...
1
vote
1answer
118 views

Polynomial division hardware implementation

I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ...
1
vote
1answer
92 views

RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
1
vote
1answer
124 views

N way collision of hashes

For a collision $H(A_1) = H(A_2)$, the number of queries is $T^{1/2}$ where $\log_2(T)$ is length of hash output. Then, what would be the number of queries requried to find an $n$-collision ($H(A_1) = ...
0
votes
0answers
37 views

How to determine which key derivation function used for password?

Suppose an attacker collected a password hash file. After performing rainbow tables/dictionary attacks they choose brute force attacks. So they try guessing as many passwords as they can by running ...
0
votes
0answers
102 views

Generate CA with aes256 passphrase protected DSA key

I want to create my own Certificate Authority with an DSA key. I figured out to create it with: ...
0
votes
1answer
141 views

Base64 with shuffled alphabet

I have a base64 'cipher' text, I know that in clear text is a hidden xml document (I do not know nothing about its structure), but the base64 aplhabet was somehow shuffled. Is there any smart way, how ...
0
votes
1answer
79 views

Looking for a secure PRNG that I can implement in hardware

I'm trying to implement a (sort of) simple PRNG in hardware for fun. My idea would be to allow a user to enter a key using a keypad (or some dip switch settings that can be set and hidden) and to ...
2
votes
1answer
195 views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
1
vote
1answer
93 views

Why do we have fixed output length in the algorithm SHA1

Why do we have fixed output length in the algorithm SHA1 . is there any explanation about that
1
vote
1answer
94 views

RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
1
vote
0answers
136 views

How does Schnorr signature actually work?

I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob ...
0
votes
0answers
51 views

Recovering a constant salt for MD5 [duplicate]

I have STRING and MD5(STRING+SALT) for any infinitely many STRING's. Is their any way that I can recover the SALT itself? (SALT is constant) I actually know SALT, but this is an intellectual exercise. ...

15 30 50 per page