0
votes
1answer
93 views

CPA security of a stateless and deterministic encryption system

Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it?
0
votes
1answer
41 views

Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
0
votes
0answers
23 views

Kryptos K2 keyword derivation [duplicate]

So I've been doing some reading on Kryptos, and to be honest the keyword for K2, ABSCISSA, has a pretty weak derivation. (The method using the eee's). Isn't there a better way to come to that? I dont ...
0
votes
2answers
77 views

RSA generation of private key using public key

In RSA private key generation e*d ≡ 1 mod φ e is public, also n is public. How to prove mathematically, generation of ...
1
vote
1answer
104 views

PRF based on the GGM construction

What's the differences between the concepts “pseudorandom generator” and “pseudorandom number generator”? In fact, I want to implement a pseudorandom function based on GGM's construction at ...
0
votes
1answer
134 views

Noise bound in FHE over the integers

I'm studying the paper Fully Homomorphic Encryption over the Integers by Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan. I have questions about the proof of Lemma A.1. In page ...
0
votes
1answer
51 views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. $\beta$ and $\lambda$ are the values on the secp256k1 curve such that: $$\begin{align} \lambda^3 &= 1 ...
0
votes
0answers
99 views

Python implementation of a blind signature scheme which doesn't involve RSA

RSA seems a bit creepy after the Snowden revelations and i'm looking for a simple python based blind signature library to fiddle around with. So far i've been unable to find anything. What am i ...
8
votes
2answers
727 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
0
votes
1answer
177 views

What is the difference between a hash function and a pseudorandom function? [duplicate]

Read the title. I've seen in RFCs that some MAC functions are called "pseudorandom functions". What are those? How are they different than hash functions? Why can't a hash function be used instead?
0
votes
1answer
186 views

Why does the DES crypto algorithm NOT use 2 rounds?

Now, if we were to go round by round, you could give a distinct reason for not using a single round since after just one round, the right half of the text comes directly, as-is, to form the left half ...
19
votes
3answers
3k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
0
votes
0answers
54 views

Decrypt a message which is encrypted using XOR? [duplicate]

This is a puzzle asked in a contest. Given that encryption , decryption happens as per following rule/code: ...
0
votes
1answer
91 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
0
votes
1answer
92 views

Negative exponents in Shoup's threshold RSA?

I'm trying to implement threshold RSA operations, starting with decryption based on Peeters, R., Nikova, S., & Preneel, B. (2008). Practical RSA Threshold Decryption for Things That Think. ...
0
votes
1answer
92 views

Proof that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$

What is the proof for the fact that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$ Where: $N = P * Q$ where $P$ and $Q$ are both primes. $\varphi(N)$ ...
1
vote
1answer
75 views

Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
0
votes
1answer
65 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ...
0
votes
3answers
849 views

Kryptos : K1. What is the origin of the “palimpsest” keyword?

I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. I understand that the keyword "palimpsest" was reverse-engineered using the tableau (and brute-force computer processing), ...
5
votes
0answers
105 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
1
vote
1answer
242 views

Can public key be recovered from ciphertext & encrypted private key?

I'd like to implement something like a write-once public/private encrypted shared secret (no better quick description for the lack of terminology knowledge). I guess, I'm trying to implement HSM. The ...
0
votes
1answer
89 views

XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?

Let us say we have three different plaintexts (all alphabets, A-Z): $x$, $y$ and $z$, each of length $21$. Let the key, $a$, be also of length $21$. Now, what we have is $x \oplus a$, $y \oplus a$ ...
1
vote
2answers
119 views

The perfect way of using IV in CTR mode

I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret ...
0
votes
1answer
53 views

Why is it a quadratic equation?

In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in $\mathbb{Z}_n$ as shown below. But, my idea of quadratic equation was a second order polynomial equation in a ...
2
votes
2answers
61 views

One-way function definition

I cannot understand why a one-way function $f$ is defined in this way $\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$ and not $\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$ where $A$ is a ...
0
votes
1answer
88 views

One time pad probability

I'm trying to solve a question about one time pads but I'm not sure if my assumptions are correct. I am to assume that I have a one time pad with perfect secrecy. This one time pad is used to ...
1
vote
1answer
45 views

Do any stream ciphers with aperiodic keystreams exist?

Exactly what it says on the tin. I can imagine constructing such keystreams from: The binary expansions of irrational numbers Chaotic systems like the logistic map or the Lorenz attractor. The ...
-1
votes
1answer
12k views

Decrypt files with original file CTB-Locker [closed]

I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ...
2
votes
1answer
225 views

Merkle hash tree updates

It seems that merkle hash tree (MHT) traversals have been discussed somewhat in the literature, but there does not appear to be much written on inserting, deleting, and updating leaves. Is this lack ...
0
votes
0answers
25 views

Reducing key shares in Damgård-Dupont threshold RSA

I'm working on understanding and implementing Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC ...
1
vote
2answers
68 views

Usage of GF(p^m) fields, where p != 2

$GF(2^m)$ Galois fields are widely used in different cryptographic algorithms, for example, in Rijndael. However, $GF(p^m)$ fields are possible with any prime $p$, not only 2, but $GF(2^m)$ fields ...
2
votes
0answers
273 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
3
votes
0answers
187 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
2
votes
2answers
303 views

Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)?

I am exploring the use of Windows CNG to replace some OpenSSL-based code that takes advantage of AES in counter mode. From the outside, everything should look the same after the switch. The section ...
0
votes
0answers
27 views

Proving the complement property of DES? [duplicate]

I'm trying to show that for a given plaintext (P), key (K), and cipher (C) in the DES algorithm: ...
2
votes
2answers
608 views

DES Encryption Algorithm all 64 bits for key instead of 56 bits

Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ...
5
votes
1answer
5k views

What is Attribute Based Encryption?

Can someone explain what attribute based encryption is? I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing ...
0
votes
1answer
55 views

Is there a reference that prove that the AES Key Schedule generate random looking round keys?

Starting from uniformly random generated AES master key, is there a reference that prove that an specific roundkey can be considered as uniformly random generated as well ?
11
votes
2answers
11k views

Many time pad attack [duplicate]

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
3
votes
2answers
150 views

Achieving 32-bit verification code with 16-bit CRC? [closed]

I am programming an embedded chip that has a hardware 16-bit CRC module. I have to protect some data bytes $d_0,d_1,...,d_{n-1}$ against corruption caused by sudden loss of power; a 32-bit CRC would ...
5
votes
2answers
422 views

State of the art RSA key generation

I would like to know if there is an algorithm to generate a RSA key at the state of the art of the present cryptanalysis. Beside the key lenght I know there are some weakness in the choice of prime ...
5
votes
3answers
2k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
2
votes
1answer
111 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
1
vote
0answers
26 views

Any ideas on login using Digital Signature PKCS

I am curious to know about possibility to login into web application just by identifying the user based on digital signature in usb token. any reference in this direction?
2
votes
3answers
323 views

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
2
votes
1answer
231 views

2048-bit RSA Decryption

If a message is encoded with 2048 bit RSA. The ciphertext is $M^e mod N$. In some cases, the message is short, $ M \approx 10^{20} $. With a high probability, $M$ can be written as $M = ab$ with $a, b ...
0
votes
1answer
87 views

How do I communicate the value of the initialization vector to the end user? Should it be part of the encrypted message?

I am taking a cryptography class and our first homework is to implement a 32-bit block cipher. I implemented a simple block-cipher that uses CBC. Currently, my implementation reads both the 32-bit IV ...
2
votes
2answers
105 views

Is this a valid “fix” for deterministic encryption in encrypted databases?

It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
1
vote
1answer
80 views

x509 Certificate Signature

I've got a question about the signature of a CA. As I understand, the CA takes the public key of the client and signs it with his own private key by using "md5WithRSAEncryption" (like explained here: ...
0
votes
1answer
51 views

Applications of GF(p) polynomials

A Galois field of the type $GF(p)$, where $p$ is prime, is normally expressed as the ring of integers modulo $p$. If my understanding is correct, it is also possible to represent its elements as a ...

15 30 50 per page