All Questions

3answers
645 views

Does keeping a public key private or using multiple encryption help?

I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here. My friend said that when he used public key ...
0answers
14 views

Does the user need to know how the decryption scheme works in identity-based broadcast encryption [duplicate]

For example, in Delerablee's identity-based broadcast encryption scheme, decryption scheme is defined as $E(C_1,h^P)$ $E(\mathcal{SK}_{id},C_2)$. Are the users allowed to know how decryption works? (...
2answers
155 views

Factoring large $N$ given oracle to find square roots modulo $N$

When $p$ and $q$ are distinct odd primes and $N = pq$, the points in $\mathbb Z_N^\ast$ have either zero or four square roots. A quarter of the points have four square roots; the rest have no square ...
0answers
18 views

Finding missing probabilities for formal proofs

In formal proofs, you often need to use probabilities to show that the Advantage of an algorithm is negligible. In proofs by contradiction, these probabilities are often tied to probabilities of other,...
1answer
38 views

ElGamal scheme signature: if private key a mod p is equal to private sig. key k mod p-1, can an attacker notice and determine the value of a?

If someone is signing a document using the ElGamal signature scheme, and if the random involved in the signature $k \mod (p-1)$ is equal to $a$ (the private key), can an attacker notice? If so can he ...
0answers
20 views

Do users need to know decryption scheme in Identity-based broadcast encryption?

I have a question related to identity-based broadcast encryption: For decryption, there are different decryption schemes. Does the user need to know that scheme, or does the system firmly define the ...
2answers
122 views

Shannon theorem of perfect secrecy

From the class: Shannon Theorem: For a perfect encryption scheme, the number of keys is at least the size of the message space (number of messages that have a non-zero probability). Proof: ...
1answer
81 views

Does concatenation of two pair computational indistinguishable distributions still indistinguishable?

Let $X,X',Y,Y'$ be some distribution ensembles such that $X\sim X'$ and $Y\sim Y'$, where $\sim$ means computational indistinguishable. Define $(X,Y)$ be the distribution ensemble over $\{0,1\}^{2n}$ ...
0answers
79 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
1answer
39 views

Do any Identity-based Encryption Systems support messaging between domains?

Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE ...
4answers
915 views

Do any non-US ciphers exist?

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Are there any public ciphers produced by other states, China or Iran for example? ...
1answer
228 views

Why $e>n^{3/2}$ prevents Wiener's attack

Here's the Wiener's attack as I understand it. Suppose $n=pq$ with $q < p < 2q$, and $d < n^{1/4}/3$ where $ed=k\phi(n)+1$ and $e < \phi(n)$. \begin{align*} n-\phi(n) &=n-(p-1)(q-1)...
1answer
233 views

HMAC Secure Key Exchange?

Within RFC 2104 section 3 there is discussion around keys (below). How are these keys agreed upon/distributed? Practically speaking is asymmetric crypto a requirement to "bootstrap" and distribute ...
2answers
56 views

elliptic curve point doubling in Jacobian coordinates

I am writing an application that uses Elliptic curve Diffie–Hellman for authentication. I found two formulas for point doubling in Jacobian coordinates. 1st) X_1 = (3x^2 + aZ^4)^2 -...
3answers
3k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
1answer
102 views

DES: Computing the output of S-Box 1?

If the 48-bit input to the S-box is 0xAAAAAAAAAAAA, what are the first four bits emitted by S-box 1? Answer: 0110 I know that an S-Box takes n inputs and give m outputs and that n != m, but I really ...
0answers
57 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
1answer
198 views

2answers
78 views

Role of Fermat's little theorem in the proof of correctness of ElGamal signature

In the Wikipedia article about the ElGamal signature scheme it is written, that Fermat's little theorem is used in the following proof of correctness: From the signature generation in ElGamal we can ...
1answer
101 views

Given the first half of a SHA-1 hash, can you predict the second half?

I know this applies to secure ciphers, but does this also apply to hashes?
1answer
97 views

Exposed raw RSA private key operation

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
1answer
135 views

What is the difference between discrete logarithm and logarithm? [closed]

Why discrete logarithm? Is discrete logarithm is part of logarithm? I do not understand the difference between these two concepts.
0answers
39 views

Parallel hashing function that always gives the same hash despite a variable number of cpus

The title pretty much sums it up :) I'm looking for a hashing algorithm that does not need to be cryptographically secure beyond reducing the number of accidental collisions. There is no need to ...
1answer
33 views

Aggregation signature and verification

I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal. Imagine I have a simple digital calculator, with a screen and ...
1answer
25 views

Question about entity authentication

Say party A wants to make sure they are communicating with party B, and not an eavesdropper E. Then they will use an authentication scheme to do this. But what if there is an eavesdropper on the line,...
0answers
112 views

Homomorphic system that allows Hamming distance computation?

How can I work out Hamming distance between two binary vectors securely? I would like to know how I can apply homomorphic techniques here.
1answer
33 views

Are chosen-prefix collisions for SHA-1 a major threat?

GPG signing of Git commit tags relies on the collision resistance of SHA-1, which is weak. However, the attacker does not get to choose the prefix. How much does this translate to an actual ...
1answer
32 views

SHA encyption (help me) [closed]

OK, so I am a real noob at cryptography stuff and I have a set of files. One is a string that I am trying to decrypt, and the other has this SHA: 4534e95cb5f001719a6119a092459dc826965d60 Can I use ...
0answers
38 views

RC6-like key schedule with 16-bit S-boxes

I am trying to figure out an encryption algorithm whose key schedule function seems to be similar to RC6. However, it seems to be creating S-Boxes using 16-bit integers instead of 32-bit ones. I have ...
3answers
186 views

The internals of bcrypt

I'm attempting to get a better understanding of cryptography and have run into some questions about bcrypt. Bcrypt relies on the blowfish cipher, which is a reversible method of encryption. But ...

15 30 50 per page