3
votes
2answers
194 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
1
vote
0answers
19 views

Proving an encrypted message contains (but does not 100% consist of) a plain-text message? [duplicate]

I have keypair (u,r), and two pieces of data, X and Y. I reveal X publicly but keep Y secret. Y has high entropy. I then combine X and Y, into c(X,Y) = Z. I encrypt Z, into "encrypt(Z,u) = Q". r ...
2
votes
1answer
65 views

Formula for the number of expected collisions

Say we have a hash function that produces $n$ bit outputs. From the birthday problem that after around $\sqrt{2^n}$ different inputs to the has function, we can expect a collision. Say instead that ...
0
votes
2answers
81 views

DES hardware implementation of substitution lookup table [ ReWorked ]

I'm a crypto enthusiastic and student of cryptography. I'm developing a project with other students titled "A hardware implementation of a DES cryptography for educational purposes", our idea was to ...
4
votes
1answer
65 views

Why do we truncate the hash when using DSA?

All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the ...
3
votes
0answers
32 views

Size of encrypted AES CEK in CMS block

When I run openssl cms -encrypt -aes256 -in sample.der -out wrapped.der -outform DER -recip ecc.crt -keyopt ecdh_kdf_md:sha512 the part of the CMS output which ...
2
votes
1answer
80 views

Calculating $\mathbb F_{p^2}$-rational points of an elliptic curve defined over $\mathbb F_p$

How can I calculate points on an elliptic curve defined over $\mathbb F_p$, for example $y^2 \equiv x^3 + 1 \pmod p$, with coordinates in $\mathbb F_{p^2}$? (points might have complex number format in ...
1
vote
0answers
14 views

Is there any equivalent to the apache xml security library for JSON? [closed]

I'm talking about org.apache.xml.security(santurio) Is there any equivalent library that works with JSON and provides the same set of features? (mostly AES-128 with KEK support)
2
votes
2answers
44 views

Privacy and Integrity in Public Cryptography

I'm trying to figure out which is the best way to get privacy and integrity together in public cryptography. Alice needs to send multiple files $f$ (may be big) to Bob. I've thought: Alice computes ...
4
votes
1answer
139 views

Are ideal hashes possible to create?

In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ...
25
votes
2answers
1k views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
0
votes
0answers
32 views

In DGHV FHE, why noise $r$ can be in $(-2^{\rho'}, 0)$?

"Fully Homomorphic Encryption over the Integer" described a simple FHE scheme based on the GACD assumption. Its encryption function (on page 6) has the form $c \leftarrow (m + 2r + 2*\sum_{i \in S} ...
2
votes
1answer
30 views

RSA - PKCS#1 padding - overall correction of algorithm

From PKCS#1, page 24: After we create the EM byte string and convert it to an integer, we then encrypt that integer with RSAEP (page 10) to get the ciphertext (as an integer). My question arrives ...
5
votes
3answers
367 views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
2
votes
1answer
125 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, ...
0
votes
0answers
44 views

Are there any cryptosystems that use multiple keys to perform encryption instead of one or two? [closed]

Are there any cryptosystem that uses multiple keys (3 or more) to perform encryption rather than one (symmetric-key cryptography) or two (RSA, public-key cryptography, etc)?
1
vote
1answer
54 views

Ensuring integrity and confidentiality together with symmetric encryption

I've been required to answer a question: As usually, we have Alice and Bob. Suppose Alice wants to send a file F to Bob, ensuring integrity and confidentiality. They share a symmetryc key ...
1
vote
1answer
27 views

One time pad- XORing or substitution

I have come across 2 versions of otp while reading it and want to confirm it. they have taken a plain text consisting of alphabets where they are shifted and replaced by alphabets itself. XORing of ...
1
vote
0answers
36 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
4
votes
1answer
45 views

Hitting a counter example in homomorphic encryption over the integers

The paper Fully Homomorphic Encryption over the Integers talks about a super simple symmetric key implementation on page 1 and 2. It says that to generate a key, you pick a random odd number between ...
8
votes
1answer
340 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
2
votes
1answer
18 views

Exchanging keys via third party

In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages ...
5
votes
1answer
213 views

Can iterated hashing be used to mitigate collision and preimage weaknesses?

How much security does double hashing add regarding collisions and preimages? Is it helpful to iterate a hash function even more times than two? For example, can MD5 be fixed (in practice) by ...
1
vote
0answers
10 views

Encipher the following plaintext message using the Vignere method using the key K = [4,2,3] [closed]

Encipher the following plaintext message, Exotic, using the Vignere method using the key K = [4,2,3] Can anyone help me get the ...
4
votes
4answers
493 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
6
votes
1answer
109 views

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick F1(B, C, D) = (B ...
3
votes
4answers
130 views

Cryptography and FPGA

I see a lot of papers about FPGA implementations. For what kind of "concrete" application should we implement cryptographic algorithms on FPGA ? Which secured application require such a huge data ...
1
vote
1answer
24 views

Clarification of RFC2246 with regards to Finished Message

I'm working on a client handshake finished message for a TLS client, and I'm reading through the RFC 2246 spec. The spec states (in section 7.4.9): The hash contained in finished messages sent by ...
9
votes
6answers
399 views

Choose a random number that is different from a bunch of other secret numbers

I'm looking for an algorithm where n participants each have a different secret number between $[0..x]$ (and where $x$ is known) and where the participants then select randomly another, non-secret, ...
-2
votes
1answer
59 views

Having plaintext and ciphertext, how can I learn more about key/encryption?

I have an OLD work database that seems to have a simple encryption on the PW. I have one users whose pw is 7777 the cipher text is ...
2
votes
1answer
41 views

Symmetric key in homomorphic encryption over the integers

Much like this question: Public key in fully homomorphic encryption over the integers I am also reading I'm reading Fully Homomorphic Encryption over the Integers, but I'm working on implementing the ...
6
votes
1answer
62 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
4
votes
4answers
62 views

Shamir Secret Sharing: Why cannot we recover polynomial's root if we have $t-1$ shares?

Imagine we have $t-1$ shares in $(t,n)$ shamir secret sharing. So at least $t$ shares are needed. Question: Why cannot we use $t-1$ shares to find a root of the polynomial and then recover the ...
3
votes
0answers
24 views

Safe generation of $k$ points on a curve such that the mutual discrete logs are hard?

I have a multiplicative group $G$ of prime order $p$ implemented using a twisted Edwards curve (similar to Ed25519). I want to compute a set of $k$ distinct points $P_1,...,P_k$ that generate $G$, ...
3
votes
1answer
43 views

What is matrix branching program?

Recently I am reading something about order-revealing encryption (by Boneh at al. in EuroCrypt 2015) and encountered "matrix branching programming". It seems like it took me forever to understand ...
1
vote
0answers
36 views

Ciphertext size of any CPA-secure public-key encryption scheme

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ...
7
votes
2answers
450 views

How feasible would it be to generate 300 million public key pairs in 8 hours?

Assume there is a hypothetical situation where one would need to generate hundreds of millions of public key pairs of reasonable strength in a limited time. What would be required in terms of ...
-1
votes
1answer
48 views

Hiding and Binding key in Groth-Sahai NIZK proof system

In context of Groth-Sahai NIZK proof system, I have a couple of doubts on Hiding and Binding keys. In case of hiding keys (highlighted in red), how is it ensured that $\tau(A) \subseteq \langle ...
1
vote
1answer
48 views

Chance to find HMAC key/salt when having knowledge of the hashed data?

I'm not sure how to word this... I'm working with a HMAC (I think of it being a "salted hash"). I know the entire string being hashed, I do NOT know the salt. I also know the first 8 characters of the ...
1
vote
1answer
51 views

In $\mathbb Z/p\mathbb Z$, is $(a+b\cdot r)$ a random value for fixed $a,b$ and random $r$?

Let $p$ be a prime number. Consider two fixed values $a,b\in\mathbb Z/p\mathbb Z$, where $b\neq0$, and a uniformly random value $r\leftarrow \mathbb Z/p\mathbb Z$. Is $v=a+b\cdot r$ a uniformly ...
0
votes
2answers
145 views

Assemble RSA keys from components [closed]

I'm studying openpgp cryptography and struggling to understand some things. I can't use pgp tool for generating keys and ecryption, but have to write a simple app to generate keys, encrypt and decrypt ...
2
votes
2answers
32 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote ...
3
votes
1answer
119 views

Is it possible to track down copies of WW2-era codebooks?

I've got an academic curiosity regarding some of the old Japanese naval codes used during World War II specifically. I'm wondering if any of the codebooks from this era have been made available, or ...
1
vote
1answer
37 views

Random Function size

I am new to cryptography. I have question regarding the size of the set of random functions. I found the text from "Introduction to modern cryptography" by Katz and Lindell, in another thread which ...
2
votes
2answers
78 views

Client login without sending a password

I would love to have a system where the password is never send in plaintext (even with TLS) to authenticate a user. I've come up with this protocol, but I'd rather use something proven. Registration: ...
0
votes
0answers
23 views

Complement of information on software usage [closed]

I recently asked this question on cryptography S.E. and was kind of surprised that the answer didn't contain technical explanations (what software to use, etc) that would have solved it. One user ...
5
votes
1answer
258 views

ECC considered secure in OpenSSL?

If I perform the following command: openssl ecparam -list_curves using my OpenSSL version (1.0.1f), it spits out the following supported curves: ...
3
votes
4answers
2k views

Why is RSA encryption significantly faster than decryption?

I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
1
vote
0answers
20 views

Is there an existing AE protocol with forward secrecy for embedded devices?

I'm working on an embedded device that is connected to a computer over an untrusted channel. According to my threat model I need authentication and encryption on the wire with perfect forward secrecy. ...
1
vote
0answers
36 views

Email: Degrees of Security [closed]

It has been explained to me by IT that there is no such thing as totally secure email - but rather a spectrum. If systems are secured via https and SSL what degree of encryption/security are we ...

15 30 50 per page