2
votes
1answer
170 views

Is $H'(M) = 5M + 9H(M) \pmod{2^n}$ a secure hash function?

theorem: For arbitrary $i≥0$ there exists $m,n≥0$ such that $35+i=5m+9n$. We can use this theorem for constructing simple hash function. Let $M$ be message and $H(M)$ be its hashed value with hash ...
-1
votes
1answer
82 views

Can we use merely permutation to hide a message?

This question is related to this: When all shares of a secret are given to adversary as a permuted matrix I think the below question is a simplified version of that. Assume we have a 40-bit ...
0
votes
1answer
75 views

RSA-OAEP: How does it work?

I was looking at this image about OAEP: ..and was wondering what was happening here. We have a data block DB which consists of: ...
4
votes
1answer
188 views

When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ (...
0
votes
0answers
29 views

Subset sum hardness

Hardness of a subset sum probleme depends on it's density. Is it possible for a subset sum problem to be intractable even if it's density is less than 0.9408 ?
1
vote
0answers
40 views

Compressing AES [duplicate]

I have this program which encrypts multiple files using AES then compress it using LZO into one single file. The problem is that the final file is almost equal in size than all the files which means ...
0
votes
2answers
97 views

Understanding the distinguisher for a PRG

Given the following definition of a psuedorandom generator, I'm having trouble understanding what exactly the "distinguisher" D is outputting, and when?
1
vote
0answers
19 views

Security issues with self encryption? [duplicate]

I'm thinking about the scenario of using a set of (potentially untrusted) hosts to store (potentially private) files. Think something like distributed backup where you contribute some disk space and ...
0
votes
0answers
81 views

Degrade in performance with SSL_OP_SINGLE_ECDH_USE?

We have used SSL_OP_SINGLE_ECDH_USE when setting up our SSL_CTX . This seems to be causing a degrade in performance. I'm not able to find proper documentation for it except that it generates new ...
1
vote
2answers
69 views

Single-algorithm authenticated encryption

Are there any authenticated encryption methods that combine encryption and authentication, rather than useing a separate cipher and MAC?
0
votes
1answer
105 views

Is this a good communication scheme?

I'm writing a wrapper for a chat program to allow for end-to-end encryption. I'm using Python and PyCrypto to accomplish this. I'd like to use a well known library to do this, but to my knowledge, ...
1
vote
1answer
59 views

Proof of Knowledge/Data Integrity using Hash Function

Objective: A verifier wants to ensure that a block of data M is also known to a prover. The protocol should exchange little information and should not leak information about the value of M. Proposed ...
3
votes
3answers
182 views

In interactive proofs, do we assume that the prover can always solve the problem?

I'm having a difficult time understanding a concept from interactive proofs: A trivial interactive proof for the graph isomorphism problem is having the prover just send a permutation that shows an ...
2
votes
2answers
96 views

How can a message encrypted with the public key be decrypted with the private key? [duplicate]

I've been reading about encryption and have a basic understanding of the concept. What I don't understand, however, is how a calculation with one key can result in a number that, through calculation ...
0
votes
0answers
49 views

Show that the shift, substitution, and Vigenere ciphers are all trivial to break using a known-plaintext attack

i think that we can use the notion of knwn plan text that we could have pairs of both cipher and plantext msg and try to find way from one to another to recover the key i dont knw how to make it with ...
0
votes
1answer
61 views

Function with no fast path and with fast proof

When a function is iterated and each time a previous result is used as input to the next iteration (feedback), so that there is a limited benefit from parallel computing, is there such function that: ...
0
votes
0answers
144 views

history of non secret cryptograph

Prior to the discovery of any specific public-key schemes, such as RSA, an existence proof was developed whose purpose was to demonstrate that public-key encryption is possible in theory. Consider ...
7
votes
2answers
609 views

What is an example of a secure sigma proof?

I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ...
5
votes
1answer
120 views

How to attack RSA-CRT with large public exponent?

Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message ...
3
votes
0answers
33 views

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
1
vote
1answer
141 views

AES key and block size

I am trying to understand $AES$ and I wondered what happens in the case of a $128$ bit block size and a $256$ bit key. All documents I read about $AES$ told me the key expansions algorithm for $128$ ...
3
votes
1answer
384 views

Is XOR adequate for encrypting truly random data? [duplicate]

It is well-known that the two-time pad is very insecure. However, it seems unexploitable in the case where the plaintext is indistinguishable from random (ex. symmetric keys). Is this property ...
3
votes
1answer
194 views

Difference between Pseudo Mersenne primes and Generalized Mersenne primes

The field prime numbers $p$ proposed by the NIST standards are referred to as Generalized Mersenne prime numbers [1] and as Pseudo Mersenne prime numbers [2]. Is there a difference between Pseudo ...
1
vote
1answer
57 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
3
votes
1answer
55 views

Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305?

I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ...
5
votes
1answer
91 views

Do Carter–Wegman MACs allow key reuse if the MAC tag is kept secret?

Poly1305 (and GHASH) are secure authenticators, but only for one use. Thus, nonce reuse in Poly1305-AES, ChaCha20-Poly1305, and AES-GCM all reveal the authentication key. However, my understanding ...
1
vote
0answers
18 views

Are there known practical attacks on RC4-dropN? [duplicate]

RC4 is known to leak information about the first few bytes of the ciphertext due to keystream biases. However, are there known attacks on RC4-drop[N] where N is large enough, that leak information ...
0
votes
0answers
29 views

Implementing cryptosystems with various programming langauges

I know that most cryptosystems are currently implemented in C/C++. Has there been any effort to implement cryptosystems in programming languages such as Agda where proofs can be written about ...
7
votes
2answers
153 views

Is TLS secure against VM reset attacks?

Is the TLS protocol secure against VM reset attacks? Background: Imagine running cryptographic software inside a virtual machine (VM). A VM reset attack is one where the the state of the software is ...
10
votes
3answers
211 views

Are there reasonably secure online voting implementations e.g. for student council elections?

Assume a university want to elect the student council. This was done via paper ballot and there is a need to reach more students for voting, so electronic voting is on the table. While researching ...
3
votes
0answers
69 views

LR-Oracle Experiment in Lindell and Katz

In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for ...
3
votes
1answer
67 views

Affine cipher and plaintext attacks, how to find the base modulo?

Last year, a question concerning plaintext attacks was posted at Mathematics.SE: “Plaintext attacks: affine cipher”. I have no problem to see how to solve it when we are given two ciphertexts and $(...
0
votes
1answer
71 views

Finding a secret cipher given the key and known plaintext?

Let $x,y,k$ be plain text, cipher text and key respectively. Also suppose $\operatorname{Enc}$ is the algorithm of encryption for block cipher with size $n$. So we have $$\operatorname{Enc}_k(x)=y$$ ...
1
vote
1answer
37 views

Adversarial Indistinguishability [closed]

I am trying to devise an encryption scheme such that an adversary can win the following game with probability at most $1/2 + \epsilon$. Adversary gives challenger two plaintext messages $m_1$ and $...
1
vote
2answers
122 views

How can comparision like (>=,==) be done using homomorphic encryption?

Since we know that Homomorphic encryption allow computation on encrypted data. Let two n-bit integers $(x,y)$ are encrypted using some LWE public key cryptography. For example - if $x'= HEnc(x,pk)$ ...
3
votes
1answer
77 views

Forward Secrecy when using non-ephemeral DH

In context SSL/TLS, reading up on various sites, I find forward secrecy in DH key exchange being linked to its ephemeral use i.e. DHE. I don't fully understand this link, where does following ...
0
votes
1answer
66 views

Encryption Oracle Avoidance

I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages,...
1
vote
1answer
39 views

Do any Identity-based Encryption Systems support messaging between domains?

Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE ...
5
votes
1answer
91 views

How is SSL secure?

if the client and the server need to exchange keys and I can sniff it, wouldn't I be able to decrypt the data transported?
3
votes
2answers
30 views

When is data origin authentication necessary but non-repudiation not?

I have been considering this question now for a week and I just cannot find an answer. I understand that non-repudiation cannot be provided without data origin authentication but I cannot think of an ...
6
votes
2answers
189 views

What is wrong in the following algorithm for computing a hash function using RSA?

I'm studying for a cryto exam and have run across this question which has stumped me. What is wrong in the following algorithm for computing a hash function? Take a message $M$, generate a random ...
6
votes
2answers
639 views

When would you increment a nonce and when not?

K is the shared key for encryption known by _Alice and _Bob. $N_A$ is a nonce created by Alice. The function f is the increment by 1 function. (1) Alice -> Bob: $E_K(N_A)$ So Alice encrypts a nonce ...
2
votes
0answers
57 views

Q: Relevance of physical layer security to cryptography

I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly ...
5
votes
1answer
323 views

Hamiltonian Path Zero Knowledge Proof using Commitments to a Series of Edges

Commonly, Zero Knowledge Proofs based on the Hamiltonian Path or Cycle problems are given as follows: The Prover has a graph $G$, for which he knows a Hamiltonian Path (or Cycle). $G$ is also known ...
5
votes
0answers
147 views

help with cryptanalysis of a sponge permutation

I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ...
14
votes
3answers
2k views

Is there any more information on this RSA backdoor?

Someone posted this on reddit a few days ago, and I haven't found much about it except for links back to the same page. Here's the article http://programmingpraxis.com/2016/01/19/rsa-encryption-...
1
vote
2answers
76 views

Role of Fermat's little theorem in the proof of correctness of ElGamal signature

In the Wikipedia article about the ElGamal signature scheme it is written, that Fermat's little theorem is used in the following proof of correctness: From the signature generation in ElGamal we can ...
8
votes
4answers
676 views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
4
votes
1answer
74 views

How to change the master password in a password manager

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf Since I don't exactly have ...
0
votes
1answer
48 views

Block cipher detect padding behaviour

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ...

15 30 50 per page