3
votes
1answer
171 views

Can we develop a working asymmetric crypto message protocol without an asymmetric encryption algorithm?

Our crypto libraries have: DSA (4096, 512) DH (4096) AES (256) SHA (512) Let us say these are implemented directly in hardware so that trying to pull the pieces out is not possible, and the CPU ...
2
votes
1answer
59 views

One-wayness proof of Elgamal

Here in the proof of Elgemal one-wayness: Consider an adversary V that can invert random Elgamal encryptions with $ε$ probability. $V *$ : Adversary to compute the Diffie-Hellman function: ...
3
votes
1answer
72 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
3
votes
1answer
45 views

Is using a rolling code as a constantly-changing shared secret effective for signing?

I am your average developer looking for some crypto-related guidance. I am trying to have assurance that a received message is from a particular sender, but have no need for the message content to be ...
5
votes
1answer
33 views

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
8
votes
2answers
918 views

Why would Carter-Wegman-style message authentication not be broken by P = NP?

Researching about the implications of P = NP to cryptography I found someone say that the only cryptography left standing would be the one time pad and Carter-Wegman-Style message authentication. ...
4
votes
3answers
151 views

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt? I am thinking of a specific situation in which a server continuously receives encrypted messages ...
-1
votes
0answers
47 views

How do you do a linear feedback shift register?

I saw a video on YouTube by Daniel Rees. The video was about stream ciphers and showed how to do a linear feedback shift register. The example that was used to demonstrate how to do it is was like ...
1
vote
0answers
25 views

Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
7
votes
1answer
73 views

AES sbox security issue - power analysis attack?

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. I am new to power analysis attacks, so it is hard to ...
0
votes
1answer
26 views

The Encode algorithm of Garbling scheme is probabilistic or deterministic?

In general the garbling scheme works as follows: Garb(1^\lambda, C): on input the security parameter \lambda in unary and the circuit C, it outputs a garbled circuit \widehat{C} and a garbling key ...
0
votes
1answer
35 views

Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
5
votes
0answers
65 views

Distinguish two ciphers in Ring-LWE?

I am fairly new to this topic. so my question is: if I have $A=e_0a+e_1$ and $B=e_2a+e_3$ where $a$ is the agreed public parameter, $e_i \leftarrow \chi$ (drawn from the error distribution). if the ...
3
votes
1answer
34 views

What is many:1 and collision in MD5?

This is in reference to this answer on Stackoverflow. If you read the first paragraph of the answer, you'll find this line: It's always a many:1 mapping (meaning there will always be collisions) ...
1
vote
0answers
65 views

Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
2
votes
2answers
59 views

In what sense addition modulo $n$ ($n>2$) isn't linear in the field $\mathbb{F}_2$?

I've been reading the Reason why “XOR” is a linear operation, but ordinary “addition” isn’t? question, in which one of the answers states that addition modulo $n$ ($n>2$) is linear in $\mathbb{Z}_n$...
1
vote
1answer
23 views

Encrypt a small amount of data with a password derived from PBKDF2

I have a small amount of data (about 128 bits) to secured with a strong password. I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with ...
0
votes
0answers
24 views

Elgamal and Cramer-Shoup encryption: Given private key and ciphertext, can public key be determined?

I have a potential use case for Elgamal or Cramer-Shoup encryption which would effectively reverse the visibility of the public and private keys. The ciphertext and private key would be published and ...
3
votes
0answers
23 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
6
votes
1answer
73 views

Definition of secure computation with more that two parties

In Definition of secure computation in m-party case with respect to semi-honest adversary (Definition 7.5.1 in Foundations of Cryptography: Volume 2, Basic Applications by Oded Goldriech) we say ...
1
vote
1answer
42 views

Clarification on Key exchange approaches in TLS/SSL

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
3
votes
1answer
40 views

ZK Proof for SIS

Let $A x = 0 \bmod q$ with $\Vert x \Vert < \beta$ be a lattice SIS problem. Does there exist an efficient zero knowledge proof of knowledge for such a solution? My idea is to use it for an ...
0
votes
2answers
65 views

security of using digital signature as key derivation material

I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports ...
-1
votes
1answer
25 views

GIven Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM [duplicate]

Sorry for a simple curiosity, Given Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM ?
1
vote
0answers
25 views

Secure Communication Protocol Design using oblivious transfer?

I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it. Consider Alice as a sender who has $n$ strings which ...
3
votes
2answers
64 views

Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
0
votes
1answer
46 views

Is this ECDHE approach secure?

First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure. I'm developing a signed/encrypted ...
1
vote
2answers
47 views

substitution Box(s-box) for AES

can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes?for example ; if i have 100 different s-boxes. i want to pick any one which is secured ...
0
votes
1answer
28 views

XOR and bilinear form property

I know that $XOR$ is equivalent to modular addition in the field $\mathbb{F}_2 = \{0,1\}$ (is it right?), and thus should satisfy the following property of a bilinear form: $$\oplus(u+v,w) = \oplus(u,...
2
votes
0answers
39 views

Why is a LCG not suitable for use in a cryptographic primitive?

Two's complement addition (and multiplication) are non-linear with respect to XOR and AND. This means that for bit vectors over $\mathbb{Z}_2$, the operation $a + x$ cannot be expressed as the matrix ...
25
votes
2answers
3k views

In which cases should the IV be kept secret?

When must an IV be kept secret? There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places. Does this ambiguity suggest that there are, in fact, ...
2
votes
0answers
61 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
5
votes
2answers
90 views

Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
-1
votes
0answers
29 views

Can homomorphic encryption support the operation of exponentiation where both base and exponent are encrypted?

Does it exist some homomorphic encryption libraries or packages which can support the exponentiation where both base and exponent are encrypted? For example, $y = a^b$, where both $a$ and $b$ are ...
3
votes
2answers
89 views

Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
7
votes
6answers
2k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more

When an entity A wants to send a message to entity B, he can attach a MAC to the message. Entity B on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
1
vote
1answer
23 views

Why am I getting a wrong output when implementing Feige-Fiat-Shamir ID protocol?

I am trying to implement the Feige-Fiat-Shamir identification protocol. I've read another posting here on this site and I tried to adapt - however the end results always fail to match. Maybe because ...
1
vote
1answer
29 views

MICKEY 2.0: Mutual irregular clocking, register states

I'm trying to understand how MICKEY 2.0 works in detail. In [1], page 6, it says: ... the state of the generator does not repeat within the generation of a single keystream sequence ... What ...
0
votes
0answers
23 views

Proof of Integrity in authenticated identity-based encryption

In authenticated ID-based encryption by Benn Lynn, in proof of integrity in section 4.3,Meaning of guess-ID? Why is it assumed that $L_{s}$ is empty, then $B$ fails? If guessed ID, why encryption ...
0
votes
0answers
32 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...
3
votes
0answers
40 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
5
votes
2answers
623 views

What are some good examples of modifying crypto where flaws are not really obvious? [closed]

I run into some developers from time to time who sometimes try to modify crypto which I end up saying along the lines of "Don't modify crypto." Usually, the question I get is - "OK, tell me why is ...
0
votes
1answer
14 views

Decomposing a vector of random bits into constituent XORed vectores

Suppose I have N potential predefined, publicly known (pseudo?) random bit vectors: sequence 1: 1001000101010111001... sequence 2: 0100101011101010100... ... sequence n: 0101101010111010001... ...
2
votes
0answers
44 views

Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
0
votes
1answer
40 views

PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)? Assuming an adversary ...
-1
votes
1answer
78 views

Calculating $d$ in RSA?

I've looked in many places including here and can't get quite the answer... So I thought I'd post a question. I can't grasp how $d$ is calculated. Obviously the problem is that knowing $e$ and $n$ ...
1
vote
1answer
48 views

AES Key Generation based on database guid

I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
3
votes
1answer
39 views

Questions about SSL3 POODLE Bites

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
3
votes
1answer
46 views

SPDZ protocol: how expensive is it to generate the multiplicative triples?

I am currently reading the full version of the SPDZ protocol. I understand that the online phase does multiplication with computational and communication complexity $O(n)$ by using Beaver's ...
1
vote
1answer
27 views

Does Kasisky test for Vigenère cyphers assumption always hold?

In the notes from which I'm studying I read about Kasisky test: "Key observation: Two identical segments of $l ≤ L$ plaintext letters, will be encrypted to the same $l ≤ L$ ciphertext letters." ...

15 30 50 per page