0
votes
0answers
47 views

Key change and key derivation

there are two ways for key change: Key update and re-keying. Which of this methods use KDF (Key Derivation Function) for getting new keys.
1
vote
1answer
84 views

Why does a one-time-pad key have to be at least as long as a message? [closed]

I am studying one time pad and find it hard to understand. What happens if the key is one bit or 100 bits shorter than the message?
1
vote
2answers
354 views

Securely send public key from client to server in RSA?

I have a client and a server communicating with messages encrypted using RSA. Initially, the client knows server's public key, but the server does not know the client's public key. Is it possible to ...
3
votes
1answer
209 views

One-way permutation over a small interval?

I am wondering what concrete computable functions we know that are a permutation over an integer interval of parameterizable size $s$, for relatively small $s$ starting circa $2^{64}$, to perhaps ...
3
votes
1answer
221 views

Practical (and secure) PRGs

Does anyone know if there exists a PRG construction which takes as input an (RSA-sized) integer seed and outputs a fixed number of bits? There are number-theoretic PRGs such as the RSA, ...
0
votes
1answer
56 views

Bicliques for permutations

So I'm trying to understand the complexity of the biclique attack on Grostl and I have some questions: 1) The paper introduces sliced bicliques where on Grostl one constructs a biclique of dimension ...
1
vote
2answers
141 views

Game with symmetric key

Alice and Bob are playing Rock-paper-scissors. Alice chooses $a \leftarrow\{stone, paper, scissors\}$ and a nonce $R_A$ used as symmetric key for encryption $$A → B : A, R_A(a)$$ Bob chooses $b ...
1
vote
1answer
121 views

Hill cipher is not perfectly secure

I am on cryptography course and there is a homework question to show that Hill cipher doesn't have perfect security. So assume we have an cryptosystem $(P,C,K)$, where $P = C = \mathbb Z_{26}^N$ and ...
7
votes
1answer
206 views

Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
3
votes
1answer
452 views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
2
votes
0answers
107 views

On the Definition of a PRG and a CSPRG

I've been looking at the definition of a PRG, here. This is a broader notion than a cryptographically secure PRG ("CSPRG"), which is described here. I am realizing that I am very confused by this ...
1
vote
0answers
76 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
3
votes
1answer
75 views

Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
1
vote
1answer
109 views

Public-Key Deterministic Encryption : Why does not provide perfect security?

I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon . Any ...
5
votes
2answers
177 views

Can passwords be stored securely so that a similarity comparison can be made?

On the Pro Webmasters StackExchange site, someone asked a question about a webapp (in this case cPanel) that refused to allow a password change because it was too similar to a previous password. I ...
5
votes
1answer
178 views

Is MD5 second-preimage resistant when used only on FIXED length messages?

I fully realize that MD5 should not be used in any new project, but in my particular situation I have severe CPU performance issues, so MD5 is convenient. I have read a lot about MD5 security for this ...
11
votes
3answers
1k views

Is 80 bits of key size considered safe against brute force attacks?

I came across KATAN Family of Ciphers for small domain input blocks . They cipher arbitrary block lengths 32,48,64 but their key size 80 bits only. Is 80 bits of key size considered safe with ...
2
votes
2answers
193 views

What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
1
vote
2answers
110 views

Proof for exponentiation in modular arithemtic

If $e$ is a natural number, then this is true: $$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$ This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, ...
0
votes
0answers
119 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
4
votes
1answer
560 views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
0
votes
1answer
104 views

DES-encrypted cipher

Suppose that you knew that a plaintext was encrypted with DES and consisted only of 16-bit Unicode letters, numerals, and punctuation marks available on a standard English-language QWERTY keyboard. ...
0
votes
2answers
151 views

Encryption of a number with RSA bigger than $n$

I'm having trouble understanding why encrypting a number $m$, which is larger than $n=p\cdot q$. I've looked into the following threads: Why RSA can't handle numbers above 76? Why does plain RSA ...
4
votes
1answer
138 views

Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
2
votes
1answer
103 views

Why is CBC based on AES malleable in blocks other than the first block?

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient. If I want to change the first block and I ...
1
vote
1answer
92 views

Cracking Stream Cipher

I need to crack a stream cipher. I have a set of plain text and encrypted text pairs. The hint to the question asks me to use entropy analysis and look at the hex dump of the encrypted text. However, ...
5
votes
5answers
472 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
0
votes
2answers
129 views

Can you prove the existance of a PRG $G$ s.t. for each even $k$: $G(k)=G(k+1)$?

In one of the exercises in [KL] Book I need to tell whether an encryption scheme is secure under an eavesdropper of only one message. Given a PRG $G: \{0,1\}^n \rightarrow \{0,1\}^{n+1}$. The ...
2
votes
1answer
202 views

Homomorphic encryption for vector addition

Building on the question and answer from Addition-only PHE in F# which ponders homomorphic cryptosystems to navigate, relatively, a single dimension without revealing absolute position (an encrypted ...
2
votes
1answer
337 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
4
votes
1answer
137 views

Why does a perfect secrecy can be achieved when decryption correctness is not totally required?

By Shanon theorem, a perfect secrecy encryption scheme must use a key space of equal size as the message space. But when the correctness requirement is weakened such that $Pr[Dec_k(Enc_k(m))=m]=1/2$ ...
1
vote
1answer
185 views

Insecurity in Needham and Schroeder protocol?

I've been studying specifically the authentication algorithm Needham and Shroeder, and understand the idea in general of the message exchange. But, researching on the subject, I found a question that ...
5
votes
2answers
423 views

Computationaly hard detokenization algorithm for credit card numbers

I am designing a vault that tokenizes credit card numbers (a plaintext that consists of 16 decimal digits), with the following requirements: Given some plaintext, the vault returns an index. If ...
1
vote
1answer
106 views

Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
1
vote
1answer
84 views

Is knowing the distribution of input domain only way to do cipher text only attacks?

Imagine there is a $n$ bit block cipher. The attacker has harvested some how all possible $2^n$ cipher texts for some given key. Without the knowledge of the distribution of input domain as in ...
1
vote
1answer
67 views

Addition-only PHE in F#

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
2
votes
3answers
498 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
1
vote
1answer
65 views

Using cryptographic hash to match AES key size

I am making a tool for myself where I intend to store cipher text. I wish to use AES together with arbitrary sized keys to create these cipher text strings. The idea is to use a cryptographic hash ...
1
vote
1answer
170 views

How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... ...
3
votes
2answers
160 views

Best way to get 32 bytes from PBKDF2

Use the PBKDF2 output as an HMAC key, hashing two different inputs - once for 20 bytes and once for 12 : ...
2
votes
1answer
158 views

ASCII: weakness

Suppose I have an encryption function $e$ of a symmetric cipher with plaintext space $$\mathcal{M}=\{1,2,\ldots,2^{24} \}.$$ Now, consider a list $L$ of integers: $$67, 114, 121, 112, 116, ...
1
vote
1answer
38 views

Logarithm in Private Set Intersection

Is the logarithm in the private set intersection protocol mentioned in Section 3.4, Step 5 of http://www.ece.umd.edu/~danadach/MyPapers/set-int.pdf, a base 10 or 2? How do we find this out?
1
vote
0answers
45 views

ElGamal Homomorphic Encryption Formula Question [duplicate]

With Pubic Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
0
votes
1answer
121 views

Homomorphic Encryption Notation Question

What does the following notation mean in a homomorphic encryption scheme? ENC(x;r) What does x and ...
8
votes
1answer
132 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: ...
1
vote
1answer
159 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
0
votes
1answer
83 views

Efficient Robust Private Set Intersection Questions

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ...
2
votes
1answer
73 views

Can you explain the counter in the Key derivation function of PACE?

I try to understand the PACE-Protocol, especially the Key Derivation Function in ECDH on page 33. Can someone explain me, what the Counter is good for? Often there are iteration counters in KDF - but ...
1
vote
2answers
212 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
1
vote
1answer
108 views

Usage of Fermat primes in RSA

Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption? I understand why $2^n+1$ primes are useful, because they would simply be ...

15 30 50 per page