1
vote
1answer
72 views

How can I map arbitrary group elements to unique integers without using Hash functions?

Let's say, I have a group $G$ of large prime order $p$. A set $S$ consists of $n$ random elements chosen from $G$. Without using a collision resistant hash function $H$, how can I map elements of $G$ ...
1
vote
0answers
49 views

Privacy-Preserving Protocols and Proofs of Security

While dabbling in privacy-preserving protocols (mainly using Semi-Homomorphic Encryption) and coming up with miscellaneous ideas for comparison tests or other similar primitives, based on obfuscation ...
1
vote
1answer
60 views

Isn't a simple Vernam cipher as secure as known symmetric key algorithms?

I have just read little about the Vernam cipher and the problems of implementing it. But, in practice, would not the key, if generated by a commonly used programming language's ...
4
votes
2answers
184 views

Are there valid attacks on full SHA-1?

Google today announced they are sunsetting SHA-1. Its fine by me. But that made me realize I am not keeping up with the research on SHA-1. The Wikipedia page only says Stevens' attack is the most ...
-1
votes
0answers
18 views

can Cocks-Pinch method apply to dual system encryption (HIBE and IBE)

can Cocks-Pinch method apply to dual system encryption (HIBE and IBE) Cocks-Pinch method build under composite order and Dual system encryption HIBE and HIBE also contructing using Lewko-Waters ...
3
votes
2answers
64 views

How do you create a large PRP from a small one?

How can you efficiently create a pseudorandom permutation with a large domain given a PRP with a small domain? Meaning: given an $n$-bit PRP, how can I create an $n k$-bit PRP? I'm only interested in ...
23
votes
1answer
4k views

No SHA-1 collision? Yet SHA-1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no than how can SHA-1 be considered broken?
3
votes
2answers
59 views

Why verify padding at all?

Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ...
0
votes
0answers
41 views

Is there a practical succinct interactive argument for fortress draws in chess endgames?

(In theory, it is known that collision-resistant hashing suffices for the type of protocol that I'm asking about: page 3.) Is there a known practical candidate protocol for succinctly (and ...
0
votes
0answers
39 views

Selecting a Bouncy Castle named curve for ECC [duplicate]

I have been tasked with implementing ECDSA and ECDH in Java using the Bouncy Castle library. However, I am unsure of what curve to use. I am aware of the named curves listed in BC, and I've done a ...
2
votes
0answers
85 views

“Practical” operations supported by functional encryption?

I'm curious about what operations have been developed into functional encryption schemes. What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic ...
2
votes
0answers
17 views

Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks?

As the question suggests, I wanted to get a sanity-check on this issue... is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay ...
2
votes
2answers
281 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly ...
3
votes
1answer
65 views

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...
16
votes
7answers
3k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
2
votes
1answer
67 views

Parallel variant of Carter-Wegman MAC with incremental property

Is there any variant of the Carter-Wegman MAC algorithm that is fast, parallel and has the property of incremental crypto?
2
votes
1answer
73 views

Generating S boxes that satisfy Coppersmith's criteria?

I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts: How many such S-Boxes are possible? Is there any ...
2
votes
1answer
67 views

Is this correct way to generate stream cipher using AES CTR mode?

We are implementing searchable encryption techniques proposed by Song et al in Java for a paper[1]. The schemes need a Stream Cipher for achieving search over encrypted data. The stream of random bits ...
3
votes
1answer
97 views

Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?

Which public key encryption scheme is re-randomizable? Is there any library for re-randomizable encryption scheme? If not, how can I re-randomize a given public key encryption scheme? I cannot find ...
0
votes
1answer
57 views

Perfectly secure shift cipher

Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that $P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ...
-1
votes
0answers
44 views

Fail-Stop Signature when Signer is Attacker

Is there a way to construct a signature scheme that would be fail-stop when the signer is the computationally unlimited attacker? I know that conventional fail-stop signatures work essentially by ...
1
vote
0answers
54 views

DES S-Box properties

Two of the properties that lead to the design of DES S-Boxes are: 1)For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result ...
3
votes
4answers
3k views

How does one calculate the scalar multiplication on elliptic curves?

I found this example online: In the elliptic curve group defined by $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$ what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
3
votes
1answer
70 views

Why does FIPS 186-4 require specific sizes for keys?

In FIPS 186-4, page 32, about FFC crypto it is required that the length of $p$ will be exactly 1024 bit and the length of $q$ will be exactly 160 bit. Why is the requirement not stated in terms of ...
0
votes
1answer
74 views

What does $\to$ mean in the following definition of a block cipher?

In the following picture $\kappa$ is the key length and $n$ is the block size. I understand that $\{0,1\}^\kappa$ means all possible combination of keys and $\{0,1\}^n$ means all possible combination ...
2
votes
1answer
46 views

Bit padding instead of PKCS#5 padding

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
2
votes
1answer
72 views

What's causing the poor randomness in this program: the LCG, or the program logic itself?

(Crypto Gods, I should begin by stressing that I haven't lost my mind: I'm not doing this in real life, I'm just trying to understand the theory behind what's happening. With your help, hopefully I ...
2
votes
2answers
361 views

Can I crack an AES string if I have all these parameters?

This is for a challenge at followthewhiterabbit.trustpilot.com: Knowns: The algorithm is AES (Rijndael) Blocksize: 128 Keysize: 256 You only need to find the first 6 bytes of the ...
1
vote
1answer
83 views

What is the most secure key expansion routine?

I am looking at G now, but is there a better, (in terms of security and speed), means by which a byte array can be expanded that doesn't involve another cipher, just a simple algorithm? I need to ...
1
vote
1answer
93 views

Privacy-Preserving relational databases: checking the existence of a record (or multiple records)

I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion: User $U$ wants to know whether a record is stored in the database. The primary ...
-1
votes
1answer
56 views

Base64 for a hash algorithm

May be a silly question, but I am really curious. If a hash algorithm uses Base64 in the process of hashing a string for example, it is still considered a hash algorithm, even though it uses an ...
2
votes
0answers
53 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
1answer
55 views

Hill Cipher question

Recently, I was given three ciphers to crack for my cryptography class. At this point, I have guessed that one of them is likely a Hill cipher (probably 3x3, as that is the most complex we have done ...
2
votes
1answer
114 views

Can Bitcoin HD public keys be used for symmetric encryption?

I asked this at bitcoin.stackexchange.com first, but it seems that this is more of a crypto-question anyway. I'm interested in using a Hierarchical Deterministic Bitcoin wallet branch as a "shared ...
0
votes
0answers
57 views

Higher residuosity problem, but with a known factorization [migrated]

Given two large primes $p$ and $q$, two arbitrary odd integers $a$ and $b$, $x \in Z_{n^2}^*$ where $n$ = $pq$, find whether there exists numbers $c$ and $d$ that are distinct elements in $Z_{n^2} ...
10
votes
1answer
336 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
3
votes
1answer
80 views

Is it possible to generate a secure permutation F over 32-bit integers even if F(0) … F(n) is public knowledge?

I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ...
1
vote
1answer
74 views

Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in {128, 160, 192, 224, 256} bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of 32). The rounds ...
7
votes
3answers
776 views

Change Salt when Changing Password?

Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
9
votes
1answer
697 views

Using SHA-256 with different initial hash value

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value ...
24
votes
1answer
2k views

Prevent double-spending with decentralized digital currencies without all transactions being public?

A recent approach to creating a decentralized online currency, called Bitcoin, has been generating some interest. The goal is to have a way to transfer currency without a central authority and without ...
6
votes
3answers
390 views

Is there some way to generate a non-predictable random number in a decentralised network?

Is there a way to generate a random number with given restrictions: It will be used in a decentralised network with a big number of peers (no central authority to generate it) Its generation should ...
4
votes
1answer
420 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
1
vote
1answer
195 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...
9
votes
2answers
3k views

How can I calculate the SHA-256 “midstate”?

Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here. The general concept is that Bitcoin ...
3
votes
1answer
126 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
4
votes
1answer
445 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
3
votes
2answers
437 views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two eliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
10
votes
3answers
597 views

Bitcoin Research

I have recently been assigned to advise a student on a senior thesis in math. She has taken linear algebra, introductory real analysis, basic cryptography, and abstract algebra. Her interest is in ...
1
vote
1answer
85 views

Timestamping using a hashed linked list and public known events

Let's say we have a timestamping scheme of the following characteristics, The hashes of the documents we are trying to timestamp are XOR'ed with "events" whose time of occurrence are very publicly ...

15 30 50 per page