2
votes
1answer
199 views

SSL-like protocol with public-key hard-coded in the client

Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client. My question is: what happens if the server's private key is ...
-1
votes
1answer
247 views

How can I convert numbers into prime numbers?

I'm working with one-way accumulators, but I'm not knowledgable in cryptography. Is there an easy peasy way to hash numbers (or whatever) into prime numbers? Obviously I'd like it to be collision ...
3
votes
1answer
86 views

Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?

In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?
7
votes
1answer
200 views

Block cipher and parity of permutation

Can anyone explain the following text passage to me? Most real-world block ciphers build even permutations, because it's hard to build odd ones using small operations (32 bit) on larger (128 ...
-1
votes
1answer
53 views

Positioning of keys in encrypted text

I'm just looking at very simple encryption. I've noticed that the key is typically either at the front or at the back of the encrypted text. This is quite easy to break if you know the key. It can ...
1
vote
1answer
108 views

What is a 'secret key factory'? What precisely is it doing? [closed]

I have found a Java implementation of AES CBC mode that runs in Netbeans. The lines below appear to create the key from password and salt: ...
0
votes
1answer
226 views

Does IKEv2 protocol have two modes like IKE

IKE Protocol have 2 modes, that modes have different structure. Does IKEv2 protocol have two modes like IKE.
3
votes
2answers
248 views

Are there any elliptic curve asymmetric encryption algorithms?

RSA offers the functionality of encrypting (short messages, or symmetric keys) with a public key, and decrypting with a private key. However, RSA key generation is extremely expensive, especially for ...
1
vote
1answer
75 views

Exchanging Keyspace and Message space in PRF

Suppose there is a secure PRF $F: K \times X \to Y$. Then is $F': X \times K \to Y$, defined by $F'(x,k):=F(k,x)$, a secure PRF? In my opinion it should be because exchanging the keyspace with ...
3
votes
2answers
141 views

does re-encrypting the same value with multiple keys reduce security

I found myself wondering today, how much security is lost if you take a plaintext - assume that its content, including any metadata is unknown to an attacker, for example it may be random data - and ...
2
votes
2answers
243 views

Does AES-128 have the same strength as AES-256 with a padded key?

When I use the same 128-bit key for AES-128 and AES-256 with a known/public padding for the latter, is there some weakness in AES-256 that is not present in AES-128 with essentially the same key? ...
-1
votes
2answers
40 views

How to make sure the pre-agreed information safe for DH-Key Exchange

The definition of DH key exchange was given as the method let two authenticate each other & exchange the crypto key over an insecure channel. DH-key-exchange was innovated to defence ...
3
votes
1answer
78 views

In Pedersen Key Distribution, can the public key be persistent?

I am implementing a key distribution protocol described by Torben Pedersen in A Threshold Cryptosystem without a Trusted Party (EUROCRYPT'91). In the protocol, the $n$ parties distribute a public key ...
14
votes
2answers
825 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
1
vote
1answer
330 views

How to select $g$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...
-1
votes
1answer
67 views

How do they implement MAC in TLS?

I recently read questions about "MAC then Encrypt/Encrypt then MAC" which made me curious about how they actually use the algorithm. MAC only calculated once either case (according to what I read). ...
1
vote
1answer
120 views

Sequence of Encrypting RSA like Chaum Blinding scheme

I'd be a noob in cryptography but reading up a little on RSA, I do get some understanding and I want to specifically resolve this issue. UPDATED Lets say we have the following values in place: ...
2
votes
2answers
154 views

Perfect Forward Secrecy in TLS

I read that TLS does PFS using Diffie Hellman. However, DH can be used even without certificates - so how is DHE-RSA better than plain DHE? Is DHE a insecure algorithm, that DHE-RSA is needed?
1
vote
0answers
75 views

How we can said a crypto system have perfect secrecy?

For example: I have 3 plaintexts ($a$, $b$, $c$) and 4 keys ($K_1$, $K_2$, $K_3$, $K_4$), making a table map to the cipher text, key as row and plaintext as column $\begin{matrix} \ \ \ \ \ \ \ \ \ \ ...
1
vote
2answers
551 views

Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?

In Chapter 6, Question 6.8, of his book “Cryptography and Network Security Principles and Practices”, William Stalling asks: Why do some block cipher modes of operation only use encryption while ...
6
votes
0answers
271 views

Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
1
vote
0answers
99 views

El Gamal encryption scheme and symmetric encryption scheme

Consider the El Gamal encryption scheme, a symmetric encryption scheme (KG,E,D), and the following hybrid encryption scheme having an encryption algorithm that, on input a public key (G,q,g,h), where ...
2
votes
1answer
272 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
2
votes
1answer
142 views

Disadvantages of one-way accumulators?

One-way accumulators are built upon a (quasi)-commutative one-way function. With quasi-commutativity, I refer to the following property: For $f : X \times Y \to X$, it is true that $f(f(x, y_1), y_2) ...
4
votes
1answer
175 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
1
vote
1answer
50 views

Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
3
votes
1answer
163 views

Given a message and signature, find a public key that makes the signature valid (ECDSA)

This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over ...
3
votes
2answers
231 views

security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?
2
votes
0answers
179 views

implementing a cryptographic hash with a block cipher [duplicate]

How can a cryptographic hash function be implemented/created using the block cipher? I was wondering if we can use AES in cipher block chaining mode to implement it.
-1
votes
1answer
80 views

How to keep phi(n) secret in RSA?

As we know, RSA cryptosystem have both private key(a,p,q) and public key(b,n), by chinese remainder theorem and fermat's little theorem, we know that the importance of keep p and q secret, and from ...
1
vote
1answer
145 views

How do I express each element in a field F as a power of a primitive element?

I have a field $\mathbb F_{2^4}$, and it is represented as a residue ring of the polynomials over $\mathbb F_2$ modulo the polynomial $\beta^4 + \beta^3 + \beta^2 + \beta + 1$. I want to express ...
1
vote
0answers
88 views

How we transfer 128bits cipher to a 4x4 matrix for AES input?

Why the input cipher for AES encryption, can write in 4x4 matrix with 8 bits entires, and can said is 128bits? if each cell is 8bits in binary, how we said this matrix is represent 128bits?
2
votes
0answers
83 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
1
vote
1answer
149 views

Difference between plain AES CTR and “CCM-style” CTR

I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
6
votes
1answer
203 views

Why does this square root algorithm work?

I've been doing some elliptic curve cryptography, and a library I'm using has this slightly bizarre algorithm for computing modular square roots: Let $x$ be some quadratic residue modulo $p$ for some ...
1
vote
0answers
46 views

Index of coincidence for completely random text over k alphabets

I'm confused about /Friedman's method 2 (using a table with column of k size of key, and n/k rows, n is the total size for cipher text) \begin{equation} m = ...
5
votes
3answers
326 views

Leak-proof protocol: is such a thing possible?

Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol? Setting: Alice and Bob have a pre-shared secret ...
4
votes
1answer
191 views

Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
-1
votes
1answer
202 views

cryptography and use of python programming language [closed]

why is it recommended to write cryptography programs ,for example crypt-analysis projects with python programming language? what is the advantages of python? why not use c or any other language?
2
votes
1answer
225 views

Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?

We have a multiplicative cyclic group $G$ which is a subgroup of $(\mathbb{Z}/n\mathbb{Z})∗$. There are two parties, Alice and Bob: If: Alice knows: $b$ and $x$ such that $x^x = b$; Bob knows: $b$. ...
2
votes
0answers
174 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...
1
vote
0answers
78 views

Is this a correct understanding of Universal Hash Functions?

I'm studying universal hash functions and have been reading several papers but now i'm focusing on Wegman and Carters original paper from 1979 (Universal classes of hash functions) and the H1 class. ...
1
vote
1answer
182 views

AES-256 Shift-Rows Offsets

I am currently trying to implement a AES-256 cipher according to this sepcificaciton: http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf As well as on Wikipedia and in the document ...
2
votes
0answers
58 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
2
votes
0answers
124 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
1
vote
0answers
179 views

Hill cipher key space

Key space is the set of all possible keys that can be used to generate a key. We using the number of valid key to describe it. I've given a hill cipher of block size $k$ over alphabet of size $p$, ...
2
votes
1answer
123 views

Rotation table for 8 round DES

I'm trying to implement DES from scratch using the NIST paper and the Wikipedia article on DES. I got 16 round DES done, but I can't seem to get 8 round DES working. I figure it's because I got the ...
3
votes
1answer
145 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
0
votes
0answers
52 views

How to know private key is computed from specific partial private key?

In a certificate-less cryptography, I have learned that – to resolve the key escrow problem of IBE – the concept of a partial private key is used. Now, consider the following Scenario: After ...
6
votes
2answers
786 views

Will repeated rounds of SHA-512 provide random numbers?

If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers?

15 30 50 per page