3
votes
0answers
23 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
3
votes
0answers
39 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
3
votes
0answers
22 views

Construct new SIS solutions from given ones

Assume we have a lattice SIS problem $A x = 0$, with $\Vert x \Vert < \beta$ and we are given $k$ solutions $x_1, \dots, x_k$ by, say an oracle. Is it then hard or easy to construct from there a ...
3
votes
0answers
81 views

Commutative Hash Function for Password Challenge?

I had an idea. Could anyone tell me if this is a thing, if they see any problems with it, and if they know of a commutative hash function that would make it work? Suppose you had a pair of ...
3
votes
0answers
36 views

Computing cost for a trillionaire to compute GNFS in RFC 3766

RFC 3766, Section 4.1 discusses picking $n$ to achieve some target cost for employing the GNFS, i.e., $T$ is known and $N$ is unknown in the below equation: $$T = \kappa \cdot \exp{\left(c \cdot (\ln{...
3
votes
0answers
25 views

Incorrect answers to queries in Waters' IBE proof by Bellare and Ristenpart

In "Simulation without the artificial abort: Simplified proof and improved concrete security for Waters' IBE scheme", Bellare and Ristenpart present a new proof for Waters' IBE scheme that does not ...
3
votes
0answers
43 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
3
votes
0answers
41 views

How subscriptions are managed in PayTV securely?

Since there are millions of subscriber for each operator in PayTV and each subscriber can subscribe to any of the package or individual channels, how operators transmit Entitlement management messages ...
3
votes
0answers
1k views

Cryptography behind the Turing Imitation Key (TIK)

When browsing the internet I found out about this amazing phone. Well, it would be amazing if it was actually obtainable. It's called the Turing Phone, and it is supposed to come with as good as ...
3
votes
0answers
61 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
3
votes
0answers
26 views

What are the practical impacts of Wassenar Arrangement to crypto development?

Wassenar Arrangement limits transport of high-grade crypto hardware/software since decades, if I don't err. What are its practical impacts in that direction? In particular, does it hinder in any sense ...
3
votes
0answers
33 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
0answers
32 views

How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
3
votes
0answers
54 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
3
votes
0answers
57 views

How does the Number Field Sieve find the target number for Diffie-Hellman?

I have read some papers relating to the Number Field Sieve, but I could not figure out how this algorithm helps in Logjam, or even what is meant by the number field. What is this? What is meant by ...
3
votes
0answers
102 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
3
votes
0answers
109 views

XTS and 256-bit data blocks

I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish). I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I ...
3
votes
0answers
46 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
3
votes
0answers
84 views

Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...
3
votes
0answers
38 views

About BGV Scheme Batching Technique

I am reading BGV12 about BGV homomorphic scheme right now.But I am being stuck to understand Batching technique in this paper. In Pack function (page 32),this paper feeds ciphertext $c_i$ and sk $s_1$...
3
votes
0answers
57 views

When to chose hardware accelerated crypto for Big Data

if you were to recommend a cipher/mode configuration that emphasizes performance for your customers, would you recommend a hardware based accelerated solution over one that isn't? For big data at rest/...
3
votes
0answers
45 views

Benchmarks for second round CAESAR competitors

I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only ...
3
votes
0answers
31 views

is accessing elements of an array in secret order vulnerable to timing attack?

Suppose there is an array containing bytes 0...255. Suppose this array is shuffled using a key for random data. Since this is indexing the elements of a table using secret data, is it vulnerable to ...
3
votes
0answers
44 views

Quantifying bit security for smart-vercauteren encryption scheme

I am working on project that requires to compare in terms of security between two encryption schemes, one of them is the SV scheme. However, I dont know what are the steps exactly towards quantifying ...
3
votes
0answers
80 views

How to attack polyalphabetic affine cipher with only ciphertext?

How to attack polyalphabetic affine cipher with only the ciphertext? A polyalphabetic affine cipher can be seen as the composition of an affine cipher ($p \mapsto c \equiv a \times p + b \pmod{26})$ ...
3
votes
0answers
64 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every sub-...
3
votes
0answers
41 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
3
votes
0answers
66 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
3
votes
0answers
32 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
3
votes
0answers
38 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
3
votes
0answers
110 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
3
votes
0answers
45 views

Can you give me a summary of cryptographic hardness assumptions?

Until recently, I had a link to a website which summarizes up-to-date cryptographic hardness assumptions. But, unfortunately I cannot find it. The webpage is categorized well problems such as, DL ...
3
votes
0answers
38 views

Best Attack Against HFE cryptosystem

I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim However, Faugere and Joux demonstrated that we can solve and ...
3
votes
0answers
55 views

Are there any crypography schemes which rely on Graph Isomorphism not being in P?

Are there any cryptography schemes having correctness relying on Graph Isomorphism not being in P? If I should ask this question in the CS Theory area, I will migrate it. Thanks.
3
votes
0answers
37 views

Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
3
votes
0answers
19 views

security of Even-Mansour scheme with keyed shuffle

I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful. What if a permutation that uses secret data like the ...
3
votes
0answers
33 views

Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
3
votes
0answers
29 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
3
votes
0answers
93 views

Unlinkability of Merkle-Damgård hash function results

Question: Are multiple outputs of a Merkle-Damgård hash function (or specifically SHA-256, if this can only be said for a specific algorithm) on unknown data unlinkable? If yes: Can this be formally ...
3
votes
0answers
31 views

What is the current encryption method used on GSM currently?

I am currently doing a mini project which sniffs GSM packets using gr-gsm and wireshark. I was wondering if anyone knows what is the name of the current encryption algorithm method used on GSM?
3
votes
0answers
32 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
3
votes
0answers
60 views

Perfect secrecy is maintained for other plaintext prob distributions?

Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution. Prove that perfect secrecy is maintained for any other plaintext probability distribution. Having ...
3
votes
0answers
73 views

How common are weak RSA keys?

There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith. How common are these RSA keys? If you generate primes randomly, ...
3
votes
0answers
22 views

Can GCM auth be bitsliced?

Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
3
votes
0answers
39 views

DES_cblock and Key Recovery

I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter. The code used is below, provided as part ...
3
votes
0answers
46 views

How to make a “zero knowledge” cache/key-value store

I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are: If the cache ever gets compromised it should reveal nothing about its ids or ...
3
votes
0answers
33 views

Can I get an explanation of HDCP's key exchange protocol?

I'm talking about HDCP v1.x. The specification is a too dense for me and easy-to-understand information about it on the net is scarce. What I've gathered is: that there is a master key that is a 40-...
3
votes
0answers
21 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that $k_9=k_8,...
3
votes
0answers
108 views

What is the difference between mutual authentication and unilateral authentication both ways?

I am currently reading Engineering Security by Peter Gutmann, on page 7 he states: proper mutual authentication is quite different from unilateral authentication in both directions He ...
3
votes
0answers
33 views

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...

15 30 50 per page