1
vote
1answer
47 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
6
votes
2answers
200 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
6
votes
2answers
182 views

What is wrong in the following algorithm for computing a hash function using RSA?

I'm studying for a cryto exam and have run across this question which has stumped me. What is wrong in the following algorithm for computing a hash function? Take a message $M$, generate a random ...
4
votes
2answers
126 views

Is there an asymmetric encryption algorithm where the public key cannot be derived from the private key

Is there an encryption algorithm that will produce a public key and a private key such that the public key cannot be generated using the private key. For example, if the private key is compromised ...
1
vote
2answers
120 views

How can comparision like (>=,==) be done using homomorphic encryption?

Since we know that Homomorphic encryption allow computation on encrypted data. Let two n-bit integers $(x,y)$ are encrypted using some LWE public key cryptography. For example - if $x'= HEnc(x,pk)$ ...
1
vote
0answers
18 views

Are there known practical attacks on RC4-dropN? [duplicate]

RC4 is known to leak information about the first few bytes of the ciphertext due to keystream biases. However, are there known attacks on RC4-drop[N] where N is large enough, that leak information ...
6
votes
4answers
2k views

Constructing a block-cipher from a hash function

It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it ...
5
votes
0answers
114 views

Homogenous and heterogeneous Unbalanced Feistel Networks

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ...
7
votes
5answers
291 views

Does frequent key change weaken encryption?

Following scenario: We are using OTR for communication between Alice and Bob which means after each successfull message exchange a re-keying happens for both parties leading to new AES-keys for the ...
0
votes
0answers
24 views

Implementing cryptosystems with various programming langauges

I know that most cryptosystems are currently implemented in C/C++. Has there been any effort to implement cryptosystems in programming languages such as Agda where proofs can be written about ...
1
vote
1answer
37 views

Adversarial Indistinguishability [closed]

I am trying to devise an encryption scheme such that an adversary can win the following game with probability at most $1/2 + \epsilon$. Adversary gives challenger two plaintext messages $m_1$ and ...
2
votes
1answer
2k views

DES Key Schedule Algorithm

Reading through the DES Specification it says that the keys are permuted with PC-1 initially and then shifted left both $C$ and $D$. However, before it gets ...
0
votes
1answer
60 views

Encryption Oracle Avoidance

I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted ...
0
votes
2answers
84 views

Discrete logarithm hash function Exercises

I have a problem with this exercise: Let $G$ be a group of order a prime $q$ and let $g, h$, be two randomly selected elements of $G$, with $g,h\ne 1$. Consider the following hash function on ...
5
votes
1answer
87 views

How is SSL secure?

if the client and the server need to exchange keys and I can sniff it, wouldn't I be able to decrypt the data transported?
5
votes
2answers
624 views

When would you increment a nonce and when not?

K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function. (1) Alice -> Bob: $E_K(N_A)$ So Alice encrypts a nonce ...
2
votes
3answers
106 views

Proving that a node is the only child

Say I have a graph of messages like this: A | B / \ C D By including the parent hash in the message to be hashed I can show that B is a child of A, ...
8
votes
4answers
632 views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
11
votes
2answers
5k views

Predicting values from a Linear Congruential Generator

I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form: ...
1
vote
0answers
608 views

Using RSA key pair for file encryption

I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server. A form of PK encryption seems ideal for this, as I can store the ...
2
votes
1answer
124 views

chacha20-poly1305 padding and length encoding

The AEAD construction for chacha20-poly1305 described in the IETF proposal encodes message lengths into the text that is to be hashed. The newer proposal goes further and pads associated data and ...
8
votes
2answers
974 views

Why do we implement a protocol?

In general, after we design a secure cryptographic protocol and make sure that it is efficient (e.g. through complexity analysis) we implement it. Questions: Do we implement it for proof of ...
1
vote
2answers
152 views

Recommendation for lightweight algorithm for partial message encryption

I have designed a specific client and server program, which sends a file from client to server in 32k chunks. I want to encrypt only part of the data. More specifically: in each 32k chunk passing ...
17
votes
4answers
1k views

How Brittle Are LCG-Cracking Techniques?

There are published techniques for cracking LCGs, but to my eye those techniques seem very brittle — very minor changes can add nonlinearity that renders techniques like the LLL algorithm unusable. ...
4
votes
1answer
66 views

How to change the master password in a password manager

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ...
0
votes
1answer
44 views

Block cipher detect padding behaviour

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ...
3
votes
2answers
114 views

Best attack on double DES followed by XOR with third key

What is the best attack here? $E_k(m)=DES_{k1}(DES_{k2}(m)) \oplus k3$
11
votes
1answer
2k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
0
votes
2answers
158 views

Secure Key exchange using javacard applet

I am working on a javacard applet project where i need... Secure communication between two applets let say there is applet A and applet B. Let say both applet has their own RSA key pairs. Now I ...
1
vote
1answer
77 views

Encryption that could have multiple decryption key

The title looks strange but it is to deal with this situation. The data we have should only be accessible by our end user and data administrators, not anyone else. Ideally, each user should have ...
4
votes
1answer
101 views

How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
1
vote
1answer
90 views

What happens if a nonce is reused in ChaCha20-Poly1305?

In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair. However, is security affected for those messages encrypted ...
-3
votes
1answer
80 views

How to encrypt a number using AES?

How to do padding to input giving to encrypt using AES algorithm if the input is less than 128 bits? I need to encrypt a decimal number such as 10.
4
votes
1answer
84 views

How to generate fingerprint for PGP public key

I would like to know how to generate a fingerprint for an openPGP public key. To be clear, I'm interested in how the fingerprint is generated. I'm aware that I can get the fingerprint with a ...
2
votes
1answer
83 views

Plaintext and ciphertext block sizes

How can you determine the largest plaintext block size and smallest ciphertext size if you used RSA with $n=59768553302699443$ using an alphabet with $27$ characters?
1
vote
1answer
84 views

Degree of M and Max Sequence Length for LFSR

For the LFSR mod 2, determine the degree of m and maximum sequence length s_(i+3)≡ s_i+s_(i-2)+s_(i-4) mod 2 determine the degree of m and the maximum ...
0
votes
1answer
53 views

How does a user register his verifier at host in SRP (Secure Remote Password) protocol?

I read RFC 2945 and 5054 describing SRP, but there was no mention of registration. How should user registration happen in SRP? Is there a standard or paper describing it?
10
votes
1answer
404 views

Status of Algebraic Eraser key exchange?

Algebraic Eraser™ is a relatively new asymmetric key agreement protocol (also designated the Colored Burau Key Agreement Protocol), based on a simultaneous conjugacy search problem in a braid ...
4
votes
1answer
84 views

Why are obfuscators generally defined to be probabilistic algorithms, rather than deterministic ones?

One possible explanation is, randomness is not going to hurt you, so might as well use it. Also, if we are hoping to prove impossibility, it only makes the result stronger. One other explanation is ...
2
votes
1answer
71 views

Preserving Confidentiality and Integrity in a Public channel

Let's say I've got two people that are trying to talk in a public channel $A$ and $B$ and they want to preserve their confidentiality and integrity. Which cryptographic algorithm would they want to ...
1
vote
1answer
66 views

How to split up $GF(2^{128})$ into smaller fields?

I've heard that it's possible to split up $GF(2^{128})$ into copies of several smaller fields like $GF(4)$ so as to make the math easier in some cases. How do you do that? I know how it works for ...
4
votes
1answer
151 views

Understanding ransomware – What makes plain-text-attacks or brute-forcing so hard?

Say I have four files. Two are completely unencrypted, while the other two are the exact same files other than that they have been encrypted with (apparently) the same public key (via a ransomware ...
2
votes
1answer
113 views

State of the art techniques for Anonymous Authentication?

What are the state of the art techniques for Anonymous Authentication? What are the most popular ones? The problem domain I am considering is with respect to different users accessing cloud content; ...
2
votes
1answer
116 views

Are there any successful preimage attacks?

Are there any successful preimage attacks on any serious cryptographic hash algorithm or at least on serious-looking non-cryptographic hashes (like MurmurHash)?
5
votes
0answers
40 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
0
votes
0answers
42 views

Solving ADFGVX decoding with only ciphertext

Hi I'm new to the world of crypto and I'm trying to decode a message. I know it is encrypted using the ADFGVX cipher. I also have a ciphertext, but I have no other information given to me. My question ...
0
votes
1answer
35 views

Lagrange Coefficients & Polynomial in KP-ABE

My question is how these concepts relate in ABE. I am assuming that the attributes are used to share the master secret key and only a user with the right attributes for a particular access tree is ...
0
votes
1answer
30 views

What does this advantage statement signify?

In many Attribute Based Encryption papers I see this line... The advantage of an adversary A in this game is defined as Pr[b' = b] − 1/2. Can someone explain what it means to me? I assume it means ...
4
votes
0answers
140 views

Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
1
vote
1answer
79 views

Perfect Secrecy in Symmetric Key Systems

For symmetric key systems does perfect secrecy imply that all ciphers in the cipher space are equiprobable? I would think not, but I am finding it hard to come up with a counter example.

15 30 50 per page