1
vote
2answers
584 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
1
vote
1answer
144 views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...
1
vote
0answers
109 views

Is there specific name for simple XOR with ADD/SUB encoding?

Several years ago a group of malware authors began using code like this: for (j = 0; j < length; j++) ptr[j] = (ptr[j] ^ VALUEA) - VALUEB; for encoding, and ...
1
vote
2answers
54 views

Are Anonymity and Authentication possible together?

Anonymity and authentication look to be seemingly contradictory but are both possible together ? I tried reading couple of papers but could not get the big picture. So what are the major approaches ...
1
vote
2answers
117 views

If I compute the SHA-1 of all possible 40 digits hexadecimal strings, will I get all possible sha1 hashes? [duplicate]

Wikipedia says sha1 produces a 160-bit (20-byte) hash value. So if I compute the SHA-1 of all possible SHA-1 values, which as far as I understand is at current time impossible both to calculate and ...
16
votes
2answers
2k views

Are common cryptographic hashes bijective when hashing a single block of the same size as the output?

It's been said that CRC-64 is bijective for a 64-bit block. It the corresponding statement true for typical cryptographic hashes, like MD5, SHA-1, SHA-2 or SHA-3? For example, would SHA-512 be ...
0
votes
0answers
37 views

Batch ElGamal Scheme

I know about ElGamal scheme and its key generation, encryption, and decryption methods. I'm not sure about what is meant by batch ElGamal. Can someone please clarify it. How it differs from ElGamal ...
1
vote
1answer
42 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
4
votes
1answer
63 views

Symmetric key in homomorphic encryption over the integers

Much like this question: Public key in fully homomorphic encryption over the integers I am also reading I'm reading Fully Homomorphic Encryption over the Integers, but I'm working on implementing the ...
1
vote
0answers
42 views

research on Encryption for master [closed]

I'm tring to choose an way for an Encryption mothod for my research? So,I want to choose one-layer encryption or multilayer encryption,and I want it to be easy to applicable. when I search about it, ...
1
vote
1answer
80 views

Chance to find HMAC key/salt when having knowledge of the hashed data?

I'm not sure how to word this... I'm working with a HMAC (I think of it being a "salted hash"). I know the entire string being hashed, I do NOT know the salt. I also know the first 8 characters of the ...
1
vote
1answer
69 views

Is this scheme to derive multiple keys secure?

I need a cryptographic scheme to generate a deterministic chain of private keys that look random to outside observer but can always be reconstructed from a single root key, also: Neither private ...
3
votes
2answers
56 views

Is there a standard format for compact 56-bit DES keys?

DES keys are traditionally stored as 8-byte blobs, with only the high 7 bits of each byte being meaningful to the algorithm; the low bit of each byte is set so that the population count of the byte is ...
6
votes
1answer
305 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
1
vote
1answer
44 views

What is the significance of the Period of a Steam Cipher [duplicate]

If we only know the period of a Stream Cipher, let's say 150-200 bit in length, how can we use this information to attack a stream cipher? Taking a look at this link, What is the period of a cipher? ...
11
votes
1answer
142 views

When did Kerckhoffs's principle become fully accepted in design and practice of modern ciphers?

Kerckhoffs's principle is named after a publication over 130 years old. Yet it is still something that is commonly misunderstood and challenged by newcomers to cryptography. This question from Open ...
1
vote
0answers
46 views

Blowfish and DES small block size and maximum message size

Would the following affect the maximum message size limititaion of Blowfish and DES due their small 64 bit block size? Let's take Blowfish for example. You take a 256 bit Blowfish key, quickly ...
1
vote
0answers
30 views

Are there any existing ASN.1 structures for transferring symmetric keys?

Is there any reasonable ASN.1 standard to encode symmetric keys? I found PSKC, but it seems extremely heavy, and I can't quite find any library (e.g. bouncycastle) that would simplify using it. If ...
1
vote
2answers
5k views

AES Algorithm processing time in Arduino vs Raspberry Pi

The Arduino employs an 8-bit ATmega series microcontroller whereas the Raspberry Pi is based around a 32-bit ARM processor, and the Arduino is typically clocked at between 8-16MHz and with 2-8kB of ...
4
votes
2answers
339 views

Secure method for encrypting 32 byte private keys

I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the ...
4
votes
1answer
71 views

Use of q-ary lattices in developing cryptosystems

Why q-ary lattices are used to most cryptosystems rather than lattices. In most of the papers q-ary lattices are used. Is there any advantage? and Given $$B=(v_1,v_2,v_3,.....v_n)$$ is the basis, ...
2
votes
1answer
44 views

Number generation for Fujisaki-Okamoto commitment scheme parameters

I need to implement the Fujisaki-Okamoto commitment scheme for a project such that I can demonstrate performance of various zero-knowledge proofs in relation to one another, for example Boudot's ...
3
votes
2answers
88 views

Homomorphic Encryption vs. Garbled circuits

I'm currently trying to understand all the differences between homomorphic encryption and garbeled circuits. As I understood the use of homomorphic encryption hides either the data or the computation ...
2
votes
0answers
80 views

Bobcat hash, trying to find a 48-bit hash collision for x

I am trying to find a collision with the Bobcat hash of the 48-bit hash. I am a beginner coder so please point out any flaws in my modification of the bobcat program. It does find a truncated 12-bit ...
3
votes
1answer
119 views

Encrypt a message with hash function, shared symmetric key, but no cipher

I am very new to Crypto and need some clarification or input. The question is: Suppose that Alice wants to encrypt a message for Bob, where the message consists of three plaintext blocks, $P_0$, ...
0
votes
0answers
26 views

why game based security definiton is used for ID CCA? [duplicate]

I have read many cryptographic encryption. In almost all schemes, security is defined with game based and simulation based definition. Can anybody give me the exact concept behind this game based ...
7
votes
2answers
120 views

Would it matter if my miner was hashing random vs incremental values?

I'm working on my miner for my "game" site that's basically a pre-image attack from a hash posted online. You submit a hash input, it's hashed, and your score is the hamming distance (the number of ...
5
votes
0answers
60 views

Elliptic curve point addition with $Z_1 = Z_2 = 1$

Elliptic curve point addition and point doubling operations using Projective and Jacobian coordinates require fewer field multiplication operations when considering $Z$ coordinates of input points ...
1
vote
3answers
145 views

How is a public/private key pair generated from a Diffe-Hellman key exchange?

I very well understand the DH key exchange. But what is the public key and private key at the end of the exchange. For example: Alice and Bob agree to use a modulus $p = 23$ and base $g = 5$ (which ...
3
votes
1answer
129 views

Why not use OAEP for signatures?

There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way. PSS seems to have the whiff of ...
5
votes
4answers
242 views

Computation indistinguishability questions

The definition I have is: Two probability ensembles $X = \{X_n\}_{n \in \mathbf{N}}$ and $X = \{Y_n\}_{n \in \mathbf{N}}$ are computationally indistinguishable if for every probabilistic ...
2
votes
1answer
51 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
4
votes
1answer
116 views

Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
3
votes
1answer
188 views

How can AES + cycle walking be used as an FPE?

I'm a bit confused after reading several articles that seem to provide conflicting information. Basically I was wondering if AES by itself can be used as an FPE? And if so is this something ...
2
votes
1answer
79 views

Practical benefit of using a KDF?

I see that KDFs should be used in systems that rely on PSKs, but what practical benefit does it provide? For instance, suppose the system relies on a shared secret for AES encryption and decryption. ...
3
votes
2answers
89 views

Extend OTP on random data?

If Alice and Bob both start with a shared OTP $P_0$, which is 256-bytes long, and Alice wants to send a 512-byte message, would it be secure to send the first 256 bytes with standard OTP (...
2
votes
1answer
152 views

Forward-secure static-ephemeral ECDH key agreement protocol

The question is whether the following simple key agreement protocol design has good security properties, and how it can or should be improved. Assumptions Alice is a persistent entity with a static ...
4
votes
1answer
94 views

Are shorter password hashes safe?

How much can I shorten a password hash before it begins to impact security? Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 ...
1
vote
2answers
72 views

AES S-Box Affine Mapping - how to do it?

For the byte substitution layer in AES how do we determine B(i)? I follow how to use the multiplicative inverse table and using that to get B`(i), but how do I actually calculate the affine mapping? ...
1
vote
3answers
92 views

Cryptographically linkable random tokens

Are there any algorithms/protocols that let you produce a specific length of random tokens/bits in such a way that you can cryptographically determine which 2 or more tokens/bitstrings where produced ...
3
votes
2answers
106 views

How does DSA provide non-repudiation in proving a document was properly displayed (not altered or displayed incorrectly)?

I am building an iOS app that allows the user to sign a document served to them by a web server. So that page of the app simply has a document in the top pane, and at the bottom pane, a place to sign ...
7
votes
4answers
945 views

Switching between AES and a highly performant algorithm

I want to de/encrypt several binary files rather frequently on a normally battery-powered device. My goal is to use AES-256 when the device is AC-powered and a highly performant algorithm when it's ...
2
votes
2answers
73 views

Using related pair of cryptographic keys to open/seal plaintext

I am using curve25519xsalsa20poly1305/fn.seal from sodiumoxide crate written in Rust language which is a wrapper over libsodium ...
1
vote
1answer
43 views

Lower bound of key space size with relaxed perfect secrecy

My apologies, I'm quite new to cryptography. If we relax the definition of perfect secrecy such that for cyphertext $c$, messages $m_0$ and $m_1$, and constant $E$: $P[c|m_0] \le E * P[c|m_1]$ ...
1
vote
1answer
43 views

Generating a 30-32-bit PRP

I want to generate a small 30 or 32 bit PRP. I am going to use that PRP in an open web service and anyone will be able to get any number of plaintext-cyphertext pairs. I've found an algorithm called ...
3
votes
1answer
87 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
3
votes
1answer
83 views

Do Curtmola et al.'s IND-CKA1/2 security definitions protect against search pattern leakage?

In the article Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions, Curtmola et al. propose adaptive and non-adaptive (indistinguishability and simulator-based) security ...
5
votes
2answers
135 views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
3
votes
1answer
71 views

How do I tack on “additional data” to libsodium's public-key authenticated encryption?

I note that libsodium provides AEAD when using symmetric cryptography. And yet, under section 8 (Public-key cryptography) there are no public-key methods described which allow for additional data ...
1
vote
0answers
34 views

If I know the hash function that produced a hash key, how easily can I generate an input to hash to the same key? [duplicate]

The title is pretty descriptive of my question. As an example, say I use the MD5 hash function to create a hash key of the word "hello": 5d41402abc4b2a76b9719d911017c592. There are two questions I ...

15 30 50 per page