2
votes
1answer
54 views

are ideal hashes possible to create?

In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ...
1
vote
0answers
174 views

What would make it impossible to deny that decryption of a package has taken place?

I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ...
6
votes
2answers
317 views

Can the XOR of two non-collision-resistant hashes be collision resistant?

Suppose I have two hash functions, of which neither (or only one) is collision resistant, and I want to create a new hash function by taking the bitwise exclusive or (XOR) of the results of those two ...
1
vote
0answers
38 views

TCR hash functions from MD5

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ...
5
votes
1answer
142 views

Can homomorphic encryption filter?

Often in articles homomorphic encryption is praised as the holy grail of encryption for cloud storage. This is done by suggesting that it can do any computation, and as such could be used for ...
4
votes
1answer
152 views

Homomorphic Encryption and Semantic Security using Lattices?

I've been reading Brakerski and Vaikuntanathan's "Efficient Fully Homomorphic Encryption from (Standard) LWE" and I'm still digesting pieces at a time. Under section 1.1, "Re-Linearization: Somewhat ...
0
votes
0answers
82 views

becoming a cryptographer after math studies [duplicate]

after studying philosophy and being a philosophy teacher, I took back studies 4 years ago and I did a bachelor in maths. I'm in maths grad school now (I'm 32), and I would like to work in ...
3
votes
1answer
119 views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
0
votes
2answers
207 views

Convert a number to sha-1

I have a task to find a the message for which the SHA-1 hash's last 11 symbols in hexadecimal presentation corresponds to an 11-digit number. I have been given the following example solution: For ...
2
votes
1answer
72 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen thet ...
2
votes
1answer
110 views

Reusing PGP key when generating SSL Certificate Authority?

Does it make sense to reuse some of the keys from my PGP (gnupg, gpg) keyblock when generating my own SSL Certificate Authority (a toy one for myself and a few web services of mine)? In an ideal ...
1
vote
0answers
24 views

Why does a joint leakage MPC protocol not directly apply to a disjoint leakage requirement?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage" on pg. 1239 the footnote at the bottom points out the difference between $joint$ leakage and $disjoint$ leakage. The ...
1
vote
1answer
65 views

How do you prevent the risk of damage to the security of Fully Homomorphic Encryption?

In this paper on pg. 1248 in the "preprocessing phase" section the authors say: In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the ...
1
vote
0answers
116 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
0answers
137 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
1
vote
1answer
74 views

Adversary to Any Collision Resistance Hash Function

I'm reading a notion Any Collision Resistance for Hash Functions. In the lecture define a collision finder CF. CF is said to $(t,\epsilon)$-break the family of hash functions $F_K$ if the ...
2
votes
2answers
93 views

Speed up modular exponentation with fixed base and modulus

Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed? ...
3
votes
1answer
140 views

How can Shamir's method for secret sharing work in the GF(256)?

I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ...
1
vote
2answers
210 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
0
votes
1answer
132 views

Tamper-evident audit logs

I want to be able to detect tampering in a log file that is under the control of an untrusted party. I am not interested in secrecy, only the integrity of the contents in the file - so I want to ...
0
votes
1answer
185 views

Why does WPA2-PSK use 4-way handshake instead of 2-way handshake

I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps: First party sends Nonce1 to the other party Second party sends to ...
2
votes
1answer
104 views

password generation: random length or max length

In short: Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible? Does the ...
2
votes
1answer
103 views

Upper bound Linear Feedback Shift Register

It is clear that when we have any output stream $x_0,x_1,...$ produced by linear feedback shift register than this output has to be periodic. Now I was wondering if we can find an upper bound for ...
2
votes
3answers
276 views

Is it possible to attack RSA with a WalkSat derivative?

We consider a large $n$-bit number $N$. We want to find a factor, if it admits any. For $m$ taking values from $1$ to $n$, perform the following three steps (actually, for each $m$, perform many ...
1
vote
0answers
95 views

Unblind a RSA blinded signature

I have blinded $m = 16$ with $r= 13$, $e = 7$ and $n = 209$. This resulted in $m' = 464$, which led to a $s' = 8$. Now, I want to unblind this $s'$ by using $s = s' \times r^{-1}$ but im stuck at ...
23
votes
0answers
764 views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
1
vote
2answers
204 views

Shamir's Simple Sharing Scheme - preventing partial recovery of data

In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ...
1
vote
0answers
45 views

AES and Known-plaintext attack [duplicate]

Can you help me to finding some papers that shows AES is secure against known-plaintext attack?
1
vote
1answer
179 views

Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
2
votes
3answers
141 views

Help me about Advanced Encryption Standard (AES)

Suppose $E_k$$(a, b, c)$ is encryption of values $a, b$ and $c$ with key $k$ through encryption algorithm AES (AES-128) and each $a, b$ and $c$ are 300 bits integer values. Also Suppose this ...
1
vote
1answer
90 views

What is adaptive zero-knowledge?

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
4
votes
3answers
161 views

Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...
3
votes
1answer
130 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
2
votes
1answer
183 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...
0
votes
1answer
51 views

applying HKDF at both the client and the server

I have two keys (K1 and K2) at both the client and the server. I hope to use HKDF in both client and server side to concatenate the keys. I will use the same salt value at both the client ad the ...
0
votes
0answers
53 views

Example of CL PKC

I am trying to solve the example of algorithms of Certificateless Signature by manually and solving the mathematics of Algorithms but not succeed while doing mathematical calculations. Please ...
1
vote
1answer
333 views

Why does plain RSA not work with big messages ($m>n$)?

From what I can remember, RSA is something like this: Generate 2 distinct prime numbers $p$ and $q$ that have similar bit length. Compute $n=pq$ and $\phi(n)=(p-1)(q-1)$ Compute $e$ such that ...
2
votes
1answer
112 views

Bit commitment with 1-out-of-2 oblivious transfer

I know a protocol for bit commitment using regular OT (Bob has 1/2 chance of learning the bit Alice transferred to him) which goes like this: COMMITMENT PHASE Alice chooses a bit $b$ For ...
0
votes
1answer
46 views

Asymptotic Hash Function and Concrete Hash Function

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they say that its formalization is non-asymptotic. Why is the formalization non-asymptotic? What is an example of hash ...
2
votes
1answer
46 views

How to pronounce RIPEMD 160?

Do I pronounce it as a word or do I make it sound like "R-I-P-E-M-D" like by pronouncing each individual letter.
0
votes
0answers
40 views

Merkle-Damgard transform: necessity of the Length block [duplicate]

The Merkel-Damgard transform append the message length (in blocks) to the message itself and then computing the 'chained hash' algorithm. Does the last block (which contains the length of the ...
2
votes
1answer
183 views

Why is this MAC based on secure PRF with ordering and randomization insecure?

Is this MAC secure: To authenticate a message $m=m_1||\ldots||m_l$ where $m_i \in \{0,1\}^{n/2}$, choose $r \leftarrow \{0,1\}^n$ at random, compute $$t:=F_k(r)\oplus F_k(\langle 1\rangle || ...
0
votes
1answer
185 views

XOR cipher Pseudo-random key strength

When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or ...
0
votes
0answers
28 views

Finding ECDSA public key from signature samples [duplicate]

How many plain ECDSA signature samples are needed to guess the corresponding public key from it like RSA? Otherwise, is it impossible to guess public key from ECDSA signature/encryption messages?
3
votes
1answer
82 views

What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
3
votes
1answer
169 views

Is $q(n)=1/n$ a negligible function?

By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$ : $q(n)<1/x^c$ So for the function $1/x$, if we ...
1
vote
1answer
65 views

What is the difference between a bijective random oracle and a random permutation?

Assume $S$ be a finite set $O$ be a random oracle from $S$ to $S$, such that $O$ is bijective $f$ be a random permutation of $S$ Is there any difference between $O$ and $f$? Does it makes any ...
3
votes
3answers
414 views

Is there a cryptographic method to add noise to a plaintext instead of actually encrypting it?

I'm looking for a cryptographic technique that instead of permuting a cleartext, would add noise to the cleartext to obfuscate the true text among a bunch of garbage. For example, a list of 10 ...
5
votes
2answers
181 views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
4
votes
1answer
424 views

Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...

15 30 50 per page