-1
votes
1answer
73 views

Why does Paillier have poor performance?

Can anyone explain to me why Paillier crypto system does not provide good performance? I read here (pdf) that RSA and ElGamal provide better performance than Paillier algorithm.
5
votes
1answer
102 views

Does adding more characters to the Enigma rotors improve crypto strength?

This seems like an obvious question but I haven't been able to find it, so here goes: Enigma is based on an alphabet of A-Z (26 characters); obviously this directly affects message content (e.g. ...
17
votes
5answers
1k views

Can an Enigma-style cipher of sufficient complexity be considered secure today?

Regarding the German Enigma machines, if I recall correctly, the reason they were defeated was because the Allies were able to generate a massive database of possible rotor settings, and because the ...
6
votes
1answer
158 views

Least-weak way to authenticate using only AES ECB/CBC

I have an embedded application that needs to occasionally get secure updates from a server. The only crypto library I have available for the chip is an AES-256 cipher (ECB and CBC, encrypt/decrypt). ...
16
votes
2answers
1k views

GPG/PGP Verification of Revocation

How does one verify a key revocation? After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such: ...
1
vote
1answer
228 views

Intuition for random variables in cryptography

I have a simple question about the use of random variables for encryption schemes, to make sure my intuition is correct. We say $P(K = k)$ to represent the probability that a particular key $k$ is ...
2
votes
1answer
222 views

Encrypting the same message using different schemes

$E_1$ and $E_2$ are IND-CPA secure encryption schemes. $E$ is defined as: $k_1,k_2 \leftarrow K_1 \times K_2$ . $E_{k_1,k_2}(m) \leftarrow E_{1,k_1}(m)||E_{2,k_2}(m)$. Hope the notations are in an ...
0
votes
0answers
22 views

Differential privacy with oblivious transfer

I have the following scenario: A has encrypted text, with max length $L$; B wants to know if the decrypted text, which contains one or more words from a closed group of $X$ words; A is not to be ...
2
votes
1answer
22 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
3
votes
2answers
217 views

Can stream ciphers (usually) be “run backwards”?

Is it possible to reconstruct the previous output bits of a stream cipher, e.g. RC4, when only the current state is known, or is that computationally hard, or even impossible (due to ambiguous ...
8
votes
3answers
1k views

What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
6
votes
1answer
471 views

Difference between a circuit and a normal function

I've seen the word circuit used in many crypto contexts (for example, regarding FHE in this pdf). I've always thought of a circuit as another word for a program or function. But is there a difference -...
-1
votes
0answers
24 views

Assumption for security proof in the given scheme (identity based encryption)

In identity-based encryption schemes,mostly,assumption is used to prove the scheme. Using DBDH assumption,assume $T=aP,T1=bP$ and Given $[T,T1,rP,k]$ where $k \in e(T,T1)^{r}$ or not.Decide if $k=e(T,...
0
votes
0answers
28 views

How can I identify this (I think) symmetric encryption? [closed]

I'm working on a CTF and I'm trying to decrypt some cipher text. I've got a key and the cipher text, but I'm not sure how to determine the algorithm used. ...
0
votes
0answers
26 views

RC4 Encrypting Plaintext, Key of 3 Bytes [closed]

Good afternoon! I tried to Encrypt a Plaintext of length of 3 Bytes with the Key of length of 3 Bytes, but it gave a wrong Ciphertext as I can't receive same Plaintext during Decryption process. I ...
3
votes
1answer
44 views

Is using a rolling code as a constantly-changing shared secret effective for signing?

I am your average developer looking for some crypto-related guidance. I am trying to have assurance that a received message is from a particular sender, but have no need for the message content to be ...
3
votes
1answer
384 views

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. This multiple encryption is a pretty expensive process since public key encryption is so ...
2
votes
1answer
53 views

Random oracles and independence

I'm reading an unpublished paper in which the author makes the following conclusions several times: Assumptions: finite probability space, $H$ is a random oracle, $X$ and $Y$ are two (not necessarily ...
0
votes
1answer
47 views

Given a sequence of integers, would applying AES encryption to the sequence produce a unique set of strings?

Let us say that we take a sequence of the integers from a to a+n-1: (a, a+1, a+2, a+n-1), ...
5
votes
1answer
33 views

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
3
votes
1answer
170 views

Can we develop a working asymmetric crypto message protocol without an asymmetric encryption algorithm?

Our crypto libraries have: DSA (4096, 512) DH (4096) AES (256) SHA (512) Let us say these are implemented directly in hardware so that trying to pull the pieces out is not possible, and the CPU ...
4
votes
3answers
149 views

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt? I am thinking of a specific situation in which a server continuously receives encrypted messages ...
8
votes
2answers
916 views

Why would Carter-Wegman-style message authentication not be broken by P = NP?

Researching about the implications of P = NP to cryptography I found someone say that the only cryptography left standing would be the one time pad and Carter-Wegman-Style message authentication. ...
3
votes
0answers
25 views

Is there a sufficiently memory-hard asymmetric encryption available? [closed]

The Password Hashing Competition offers several memory-hard hashing algorithms that are aware of time memory trade-off and essentially try to make it hard for ASICs and FPGAs to brute-force hashes. ...
3
votes
1answer
71 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
3
votes
2answers
88 views

Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
1
vote
1answer
153 views

Why does a one-time-pad key have to be at least as long as a message?

I am studying one time pad and find it hard to understand. What happens if the key is one bit or 100 bits shorter than the message?
1
vote
0answers
65 views

Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
1
vote
0answers
25 views

Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
2
votes
1answer
59 views

One-wayness proof of Elgamal

Here in the proof of Elgemal one-wayness: Consider an adversary V that can invert random Elgamal encryptions with $ε$ probability. $V *$ : Adversary to compute the Diffie-Hellman function: ...
-1
votes
0answers
264 views

Please Help with the Problem [closed]

what kind of crypto or cipher text is these and does anyone has possible solution to it. yooxqsn.apn/BMVPfyaPbcxC
0
votes
1answer
35 views

Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
-1
votes
0answers
46 views

How do you do a linear feedback shift register?

I saw a video on YouTube by Daniel Rees. The video was about stream ciphers and showed how to do a linear feedback shift register. The example that was used to demonstrate how to do it is was like ...
7
votes
1answer
71 views

AES sbox security issue - power analysis attack?

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. I am new to power analysis attacks, so it is hard to ...
5
votes
0answers
63 views

Distinguish two ciphers in Ring-LWE?

I am fairly new to this topic. so my question is: if I have $A=e_0a+e_1$ and $B=e_2a+e_3$ where $a$ is the agreed public parameter, $e_i \leftarrow \chi$ (drawn from the error distribution). if the ...
-1
votes
0answers
22 views

EC-Council Certified Encryption Specialist certification [closed]

I'm currently an actuary and looking for new challenges. Cryptography is my top choice for a new career. I'm currently brushing off my programming skills and reading on cryptography. However, I'm ...
2
votes
2answers
58 views

In what sense addition modulo $n$ ($n>2$) isn't linear in the field $\mathbb{F}_2$?

I've been reading the Reason why “XOR” is a linear operation, but ordinary “addition” isn’t? question, in which one of the answers states that addition modulo $n$ ($n>2$) is linear in $\mathbb{Z}_n$...
0
votes
1answer
87 views

Key exchange problem

I've found the following problem in one of my courses. Any tips on how to solve this would be appreciated! Alice has the key pair $(pka,ska)$. Bob has the pair keys $(pkb,skb)$. They want to ...
0
votes
1answer
25 views

linear cryptanalysis: how are the subkey bits removed from the linear approximation?

I'm currently reading the tutorial on linear/differential crypta here: https://www.engr.mun.ca/~howard/PAPERS/ldc_tutorial.pdf End of page 14/Beginning of page 15: all the bits from the subkeys are ...
3
votes
1answer
39 views

ZK Proof for SIS

Let $A x = 0 \bmod q$ with $\Vert x \Vert < \beta$ be a lattice SIS problem. Does there exist an efficient zero knowledge proof of knowledge for such a solution? My idea is to use it for an ...
0
votes
0answers
37 views

Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$ C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
0
votes
0answers
24 views

Encrypted database examples [closed]

What are the different encrypted databases? I have heard about CryptDB, ZeroDB and SQLCipher. Which are the other secure database examples?
16
votes
2answers
2k views

Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
2
votes
1answer
283 views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
0
votes
1answer
25 views

The Encode algorithm of Garbling scheme is probabilistic or deterministic?

In general the garbling scheme works as follows: Garb(1^\lambda, C): on input the security parameter \lambda in unary and the circuit C, it outputs a garbled circuit \widehat{C} and a garbling key ...
6
votes
1answer
71 views

Definition of secure computation with more that two parties

In Definition of secure computation in m-party case with respect to semi-honest adversary (Definition 7.5.1 in Foundations of Cryptography: Volume 2, Basic Applications by Oded Goldriech) we say ...
1
vote
1answer
23 views

Encrypt a small amount of data with a password derived from PBKDF2

I have a small amount of data (about 128 bits) to secured with a strong password. I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with ...
3
votes
1answer
34 views

What is many:1 and collision in MD5?

This is in reference to this answer on Stackoverflow. If you read the first paragraph of the answer, you'll find this line: It's always a many:1 mapping (meaning there will always be collisions) ...
1
vote
1answer
143 views

justification for method to factorize n knowing RSA private exponent d

I know that knowing the private exponent $d$ corresponding to the private key $k_{pub}\langle n,e\rangle$ it is possible to efficiently factorize n. The procedure starts stating that: $ed -1 = s(p-1)...
2
votes
1answer
50 views

Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$?

DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart ...

15 30 50 per page