# All Questions

146 views

### As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
71 views

99 views

### Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
279 views

### Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
147 views

### RSA encryption and signature padding flaw

This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...
126 views

### Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in Python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
99 views

### How can I make a message into a blocks for NTRU?

I have more bits than the degree of the NTRU polynomial. For example: $x^{11}-1$ message: Hello (I am using ascii, 8 bits for 1 symbol) got: ...
45 views

### Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
101 views

### Can I decrypt the message having it encrypted with different keys?

I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to ...
521 views

### HMAC-SHA1 vs HMAC-SHA256 for data storage

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
100 views

### Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
76 views

### Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
65 views

### Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
44 views

### Delinearization in whitebox techniques

I'm reading through Chow et al.'s paper and Link et al.'s paper. There's a part I don't understand about Delinearization. They convert some steps of AES/DES into a Matrix, then divide the matrix in ...
175 views

### Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
91 views

### Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
81 views

### Timing attacks against RSA, DH and AES

I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, ...
178 views

### Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks

Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created). I would like to create an ...
57 views

### Why the same characteristics cannot be used to recover all FEAL4 keys

I am trying to understand how differential Cryptanalysis works. Here I read how to use differential cryptoanalysis for cracking FEAL4 cipher. The big gotcha with this process is that you cannot ...
84 views

### Is ecryptfs safe after unmounting but before turning off the computer

I've read that one of the vulnerabilites of ecryptfs is leaks to swap memory, and that the solution is to encrypt swap. But even if swap is encrypted, it's still open until I reboot. I've also read in ...
114 views

### encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
157 views

### File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
120 views

### Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
60 views

### How to generate initial vectors during DPA attack on stream cipher in real life?

I was trying to understand the procedure of the DPA attack on Stream cipher (like Mickey-128). I learned that, the attacker need to build hypothetical power consumption matrix with different initial ...
149 views

### Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
168 views

### Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , ...
148 views

### Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
75 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
133 views

### On the Definition of a PRG and a CSPRG

I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
207 views

### One-Time-Pad with key-reuse: Faster way of decrypting?

I know there are already of few questions about this and I'm working with the advices that were given but I still doubt my approach is the fastest, so I'd really appreciate if you helped me find a ...
Figure 1 on page 1249 of the “Multiparty Computation Secure Against Continual Memory Leakage” paper shows $m$ committees are elected in step 1 and then later in step 3 are each given a secret share. ...