0
votes
3answers
95 views

How to calculate plaintext from modpower cipher

Let $a$ be the plaintext message, $e$ be a small prime exponent (such as 11, 13, 17 etc.), $b$ be cipher text and $n$ be a large modulo (non-prime). Suppose that: $b \equiv a^e \space mod ...
9
votes
2answers
144 views

Is there a way to optimize a linear scan while preserving anonymity?

I've been wrestling with a problem, and I was hoping if someone else had a bright idea. Here's the problem: I have two sides, Alice and Bob. Alice has a single high entropy string $A$, and Bob has a ...
4
votes
1answer
25 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
3
votes
1answer
72 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
2
votes
1answer
250 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = ...
1
vote
1answer
157 views

Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
0
votes
1answer
62 views

Ciphers providing Deniable encryption?

I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario: Deniable encryption allows the sender of an encrypted message to deny sending that message. This ...
3
votes
0answers
58 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
3
votes
0answers
24 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
3
votes
0answers
33 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
3
votes
0answers
97 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
3
votes
0answers
30 views

Best Attack Against HFE cryptosystem

I am looking for the best know attack against HFE cryptosystem. Reading this paper DEGREE OF REGULARITY FOR HFE I found the next claim However, Faugere and Joux demonstrated that we can solve and ...
3
votes
0answers
47 views

Are there any crypography schemes which rely on Graph Isomorphism not being in P?

Are there any cryptography schemes having correctness relying on Graph Isomorphism not being in P? If I should ask this question in the CS Theory area, I will migrate it. Thanks.
3
votes
0answers
40 views

Can an analog of ChaCha with 64-bit words be defined, and would it be secure?

Blake2b has a lightning fast compression function with more-than-overkill security even against quantum attacks. It seems to be based on ChaCha, but with 64-bit words and different rotation ...
3
votes
0answers
37 views

Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
3
votes
0answers
83 views

Finding sum of two encrypted numbers

Let's consider such process: Two emitents emit two (integer) secret numbers independently They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. ...
3
votes
0answers
14 views

security of Even-Mansour scheme with keyed shuffle

I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful. What if a permutation that uses secret data like the ...
3
votes
0answers
27 views

Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
3
votes
0answers
28 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
3
votes
0answers
84 views

Unlinkability of Merkle-Damgård hash function results

Question: Are multiple outputs of a Merkle-Damgård hash function (or specifically SHA-256, if this can only be said for a specific algorithm) on unknown data unlinkable? If yes: Can this be formally ...
3
votes
0answers
30 views

What is the current encryption method used on GSM currently?

I am currently doing a mini project which sniffs GSM packets using gr-gsm and wireshark. I was wondering if anyone knows what is the name of the current encryption algorithm method used on GSM?
3
votes
0answers
26 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
3
votes
0answers
46 views

Perfect secrecy is maintained for other plaintext prob distributions?

Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution. Prove that perfect secrecy is maintained for any other plaintext probability distribution. ...
3
votes
0answers
66 views

How common are weak RSA keys?

There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith. How common are these RSA keys? If you generate primes randomly, ...
3
votes
0answers
20 views

Can GCM auth be bitsliced?

Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
3
votes
0answers
52 views

Difference between hierarchical and multi level secret sharing

In this paper, the definitions are simply as follows. Multi-Level secret sharing: Higher level participants can help lower participants to get the secret. Compartmented secret sharing: Each level ...
3
votes
0answers
35 views

DES_cblock and Key Recovery

I'm trying to get my hands on the key that OpenSSL uses for a DES encryption. The key is based off a random number generator with a seed taken as parameter. The code used is below, provided as part ...
3
votes
0answers
40 views

How to make a “zero knowledge” cache/key-value store

I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are: If the cache ever gets compromised it should reveal nothing about its ids or ...
3
votes
0answers
31 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin ...
3
votes
0answers
25 views

Can I get an explanation of HDCP's key exchange protocol?

I'm talking about HDCP v1.x. The specification is a too dense for me and easy-to-understand information about it on the net is scarce. What I've gathered is: that there is a master key that is a ...
3
votes
0answers
20 views

Would using a symmetric list of subkeys in a Feistel cipher make our messages vulnerable to oracle attacks?

Suppose I have a Feistel cipher structure that has $16$ rounds. I come up with $8$ subkeys $k_1,k_2,...,k_8$ to be used for the first $8$ rounds and then assign the rest of the keys so that ...
3
votes
0answers
74 views

What is the difference between mutual authentication and unilateral authentication both ways?

I am currently reading Engineering Security by Peter Gutmann, on page 7 he states: proper mutual authentication is quite different from unilateral authentication in both directions He ...
3
votes
0answers
32 views

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
3
votes
0answers
62 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
3
votes
0answers
64 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
3
votes
0answers
67 views

TPM's monotonic counters

I am reading the TPM Design Principles v1.2 §17 and do not feel I fully understand the example they give on how the counters would work. Apparently monotonic counters are used to prevent replay ...
3
votes
0answers
30 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key ...
3
votes
0answers
66 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
3
votes
0answers
51 views

Why SIVP Is Worst Case Problem?

I just started to study lattice cryptography. I'm now studying worst-case to average-case reduction for SIS. In previous question, "worst means any and average means random". And I wonder why ...
1
vote
0answers
20 views

Determining an encryption key when ciphertext and algorithm are known

I would like to know how I can tell that I have successfully performed an exhaustive search attack on an encrypted message. Here are the conditions: key is 40 bit I am aware of the cipher text and ...
1
vote
0answers
56 views

Is it possible to combine two hash functions in such a way that cracking the constructed hash would require cracking the constituent hashes?

Suppose A is some arbitrary hash function, for example BCrypt or MD5. And B be some other arbitrary hash function, maybe SHA256 or SCrypt. Let ...
1
vote
0answers
59 views

Why are hash functions like SpookyHash and MurmurHash so highly collision resistant?

Why are hash functions like SpookyHash and MurmurHash so highly collision resistant? I tried to test these hash functions using a few billion input messages and I found that there is no hash value ...
0
votes
0answers
3 views

Create composite group for pairing in JPBC

We use bilinear map S = (G, G_T , e(·, ·)) of composite order n = s*n' with two subgroups G_s and G_n' of G. Random generators w ∈ G, g ∈ G_s , and φ∈ G_n' are chosen. I want to code the above group ...
0
votes
0answers
7 views

Can anyone tell whether combinational has higher frequency of operation than sequential or vice-versa?

I have designed SHA3 algorithm in 2 ways - combinational and sequential. The sequential design is giving frequency of operation as 700MHz while the combinational one is giving 0.5MHz so i want to ask ...
0
votes
0answers
8 views

How much does using the same $H$ for all messages weaken GCM?

How much is GCM weakened by using the same MAC key $H = E_K(0^*)$ for all messages instead of using $E_K(N||0_{32})$ (which is different for each message)?
0
votes
0answers
32 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
0
votes
0answers
27 views

1-out-of-2 OT from Random 1-out-of-2 OT

Last week I came upon this problem in my h.w.: Let $OT^m$ denote 1-out-of-2 oblivious transfer of $m$ bit inputs. Let $RandOT^m$ denote the following primitive: The sender’s input ...
0
votes
0answers
26 views

Deoxys: disadvantages vs. AES?

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
0
votes
0answers
12 views

What are the advatages or disadvatages of using seperate chaining over linear or quadratic probing?

I was looking through different hash methods the other day and was curious as to what the advantages or disadvantages of using separate chaining over linear or quadratic probing. I know that with ...
0
votes
0answers
54 views

What functional encryption scheme can be used to compute a linear function?

I am looking for a functional encryption scheme that can compute a linear function. I do not need to work with attributes. All I want is to compute the result of a function $y = a*x+b$, where $x$ is ...

15 30 50 per page