3
votes
0answers
57 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
3
votes
0answers
62 views

How to select corresponding ciphertext in anonymous Identity-based broadcast encryption

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part. User ...
3
votes
0answers
26 views

What are the practical impacts of Wassenar Arrangement to crypto development?

Wassenar Arrangement limits transport of high-grade crypto hardware/software since decades, if I don't err. What are its practical impacts in that direction? In particular, does it hinder in any sense ...
3
votes
0answers
32 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
0answers
30 views

How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
3
votes
0answers
47 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
3
votes
0answers
54 views

How does the Number Field Sieve find the target number for Diffie-Hellman?

I have read some papers relating to the Number Field Sieve, but I could not figure out how this algorithm helps in Logjam, or even what is meant by the number field. What is this? What is meant by ...
3
votes
0answers
81 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
3
votes
0answers
105 views

XTS and 256-bit data blocks

I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish). I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I ...
3
votes
0answers
45 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
3
votes
0answers
164 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
3
votes
0answers
84 views

Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...
3
votes
0answers
32 views

About BGV Scheme Batching Technique

I am reading BGV12 about BGV homomorphic scheme right now.But I am being stuck to understand Batching technique in this paper. In Pack function (page 32),this paper feeds ciphertext $c_i$ and sk $s_1$...
3
votes
0answers
57 views

When to chose hardware accelerated crypto for Big Data

if you were to recommend a cipher/mode configuration that emphasizes performance for your customers, would you recommend a hardware based accelerated solution over one that isn't? For big data at rest/...
3
votes
0answers
41 views

Benchmarks for second round CAESAR competitors

I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only ...
3
votes
0answers
29 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...
3
votes
0answers
44 views

Quantifying bit security for smart-vercauteren encryption scheme

I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
3
votes
0answers
79 views

How to attack polyalphabetic affine cipher with only ciphertext?

How to attack polyalphabetic affine cipher with only the ciphertext? A polyalphabetic affine cipher can be seen as the composition of an affine cipher ($p \mapsto c \equiv a \times p + b \pmod{26})$ ...
3
votes
0answers
64 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every sub-...
3
votes
0answers
40 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
3
votes
0answers
63 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
3
votes
0answers
31 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
3
votes
0answers
34 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
3
votes
0answers
107 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
3
votes
0answers
42 views

Can you give me a summary of cryptographic hardness assumptions?

Until recently, I had a link to a website which summarizes up-to-date cryptographic hardness assumptions. But, unfortunately I cannot find it. The webpage is categorized well problems such as, DL ...
3
votes
0answers
34 views

Best Attack Against HFE cryptosystem

I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim However, Faugere and Joux demonstrated that we can solve and ...
3
votes
0answers
52 views

Are there any crypography schemes which rely on Graph Isomorphism not being in P?

Are there any cryptography schemes having correctness relying on Graph Isomorphism not being in P? If I should ask this question in the CS Theory area, I will migrate it. Thanks.
3
votes
0answers
37 views

Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
3
votes
0answers
95 views

Finding sum of two encrypted numbers

Let's consider such process: Two emitents emit two (integer) secret numbers independently They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. ...
3
votes
0answers
17 views

security of Even-Mansour scheme with keyed shuffle

I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful. What if a permutation that uses secret data like the ...
3
votes
0answers
33 views

Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
3
votes
0answers
29 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
3
votes
0answers
40 views

Would LWE problem be still secure if error were like this $e=2e_1$?

In the Learning with error problem, if the error term $e$ from equation $b=<a,s>/q+e$ were of this kind $e=2e_1$, where $e_1$ is chosen according to the probability distribution for the LWE ...
3
votes
0answers
93 views

Unlinkability of Merkle-Damgård hash function results

Question: Are multiple outputs of a Merkle-Damgård hash function (or specifically SHA-256, if this can only be said for a specific algorithm) on unknown data unlinkable? If yes: Can this be formally ...
3
votes
0answers
31 views

What is the current encryption method used on GSM currently?

I am currently doing a mini project which sniffs GSM packets using gr-gsm and wireshark. I was wondering if anyone knows what is the name of the current encryption algorithm method used on GSM?
3
votes
0answers
31 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
3
votes
0answers
58 views

Perfect secrecy is maintained for other plaintext prob distributions?

Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution. Prove that perfect secrecy is maintained for any other plaintext probability distribution. Having ...
3
votes
0answers
73 views

How common are weak RSA keys?

There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith. How common are these RSA keys? If you generate primes randomly, ...
3
votes
0answers
22 views

Can GCM auth be bitsliced?

Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
3
votes
0answers
38 views

DES_cblock and Key Recovery

I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter. The code used is below, provided as part ...
3
votes
0answers
44 views

How to make a “zero knowledge” cache/key-value store

I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are: If the cache ever gets compromised it should reveal nothing about its ids or ...
3
votes
0answers
29 views

Can I get an explanation of HDCP's key exchange protocol?

I'm talking about HDCP v1.x. The specification is a too dense for me and easy-to-understand information about it on the net is scarce. What I've gathered is: that there is a master key that is a 40-...
3
votes
0answers
21 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...
3
votes
0answers
103 views

What is the difference between mutual authentication and unilateral authentication both ways?

I am currently reading Engineering Security by Peter Gutmann, on page 7 he states: proper mutual authentication is quite different from unilateral authentication in both directions He ...
3
votes
0answers
33 views

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
3
votes
0answers
69 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
3
votes
0answers
65 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
3
votes
0answers
86 views

TPM's monotonic counters

I am reading the TPM Design Principles v1.2 §17 and do not feel I fully understand the example they give on how the counters would work. Apparently monotonic counters are used to prevent replay ...
3
votes
0answers
34 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key (...
3
votes
0answers
90 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...

15 30 50 per page