# All Questions

24 views

### Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
63 views

### Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
62 views

### DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
51 views

### Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
32 views

### Proposed unidirectional authentication scheme

I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ...
59 views

### SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ...
59 views

### Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
62 views

### Energy necessary for brute-forcing or decryption

I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it. ...
173 views

### Is chaotic encryption secure?

I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) ...
71 views

### Pseudorandom Function Proof

Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: ...
39 views

### During electronic voting, how does one hide the choice from Voting device?

Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially ...
86 views

### How to calculate the non-linearity of an s-box?

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
64 views

### Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is this What I really need is basic explanation of the ...
79 views

### What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
62 views

### Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
80 views

### Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
98 views

### Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
63 views

### Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
44 views

### How exactly is the output of the XOR step in PBKDF2 used?

I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ...
81 views

### Are all binary-additive stream ciphers reciprocal?

I'm writing a thesis focused on Maurer's provably-secure stream cipher. Long story short, this cipher works by expanding a short key into a long keystream and then XORring this keystream with the ...
186 views

### Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
91 views

### Does the SSH protocol preserve integrity if an endpoint is cloned?

I am trying to find out if the SSH protocol preserves integrity of the transferred data in the following scenario: The SSH client is running on a virtual machine, at some point in the middle of the ...
146 views

### As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
72 views

284 views

### Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
151 views

### RSA encryption and signature padding flaw

This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...
126 views

### Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in Python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
99 views

### How can I make a message into a blocks for NTRU?

I have more bits than the degree of the NTRU polynomial. For example: $x^{11}-1$ message: Hello (I am using ascii, 8 bits for 1 symbol) got: ...
47 views

### Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
102 views

### Can I decrypt the message having it encrypted with different keys?

I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to ...
Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...