0
votes
0answers
47 views

Password generation/storage scheme

How bad is the following strategy for a password manager on a local machine? The user wants to sign up for somesite.com where he needs a password. The user has previously generated a secret key ...
0
votes
1answer
50 views

Direct sum of Binary numbers In Mixcolumns

I have just started learning cryptography and I am trying to make sense of the direct sum on some binary numbers. I am trying to find a column of a state space after a Mixcolumns operation has been ...
1
vote
2answers
110 views

Encrypting twice with same key gives back plain text

I read in the answer here that when encrypting twice the plain text with same key could result in plain text as shown below $encrypt_{key}((encrypt_{key}(plain)) = plain $ Which block-cipher ...
4
votes
1answer
205 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
5
votes
2answers
216 views

How do you test randomness?

Suppose I receive a list of 1 million coinflips, and I want to know how likely it is that the list was randomly generated. My first thought would be to count the number of heads and tails, which ...
2
votes
1answer
246 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
0
votes
0answers
27 views

Elliptic Curves Readdition

I found the term re-addition in https://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html and I cannot figure out what it is. It has actually same complexity of addition and I dont see the ...
1
vote
1answer
335 views

Why does openssl use SHA1 in ECC when I use secp384r1 curve

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. Thing here is am using nanoECC in my DTLS, nanoECC ...
4
votes
1answer
114 views

Why does NTRUEncrypt lack a formal security proof?

Is there any particular reason why NTRUEncrypt lacks a formal security proof? That is, a demonstration that it achieves certain security notion (e.g. IND-CPA). I know there is a provable-secure ...
1
vote
1answer
156 views

A simple attack on DESX in time $2^{120}$ [duplicate]

Let $\mathcal{M}$ be our message space and $\mathcal{K}$ our key space. Now, let $\mathrm{E} : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$ be a block cipher. Define the block cipher ...
0
votes
1answer
111 views

Is there any probabilistic version of RSA?

I have now studying the RSA, but I think that is it possible to have some probabilistic version like a random bit string "r" XORed with the key? Is there any probabilistic version of RSA? Thak you ...
0
votes
2answers
71 views

public key certificate on TLS/SSL

Currently I am working on a public key certificate. I got a question: Why is a public key certificate needed for TLS/SSL? Wouldn't TLS/SSL itself is enough? What is the role of the certificate?
8
votes
4answers
2k views

Why is the IV passed in the clear when it can be easily encrypted?

The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
1
vote
2answers
102 views

RSA prove $a^{\varphi(n)/g} \equiv 1 \pmod{n}$

I should prove that $a^{\varphi(n)/g} \equiv 1 \pmod{n}$, so I thought I would prove it with primitive roots but I got stuck. Here is the assignment: Let $p, q$ be primes such that $p \ne q$. ...
2
votes
2answers
179 views

What is a q-type assumption?

I've seen the term "$q$-type assumption" used in a few papers without a definition. A google search doesn't seem to come up with anything useful either (except the same papers without a definition). ...
1
vote
1answer
67 views

Are there any many to one encryption frameworks available?

I am reasonably new to the cryptography. For my use-case I need a method where in I would need a receiver to accept encrypted messages from a range of senders (each having their own, say, public key). ...
0
votes
1answer
63 views

Client-server communication

The base scenario goes as follows: A program stores some user's confidential data encrypted on their disk. The user is most probably clueless and the disk might get stolen, but these are the classical ...
1
vote
1answer
154 views

How to encrypt letters less than block n using Hill Cipher

I am learning about Hill Cipher and know that it is a block cipher where each block of n letters (considered as an $n$-component vector) is multiplied by an invertible $n \times n$ matrix, again ...
1
vote
1answer
211 views

Frequency analysis of Vigenere Cipher

For Vigenere cipher, I understand Find period first (say we have p = 6) Find highest frequency of letter in each group (from 1 to 6) and assume it is "e" in plaintext What if we have more than ...
1
vote
1answer
170 views

Equal length of primes in paillier cryptosystem

In the key generation step of paillier cryptosystem , In order to satisfy $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes. Instead of taking(length as parameter to generate $p,q$) equal ...
0
votes
1answer
96 views

A one way Function provably reversible at N applications with the same seed?

I'm looking for a function that is generally one way from some secret $F(s, A) \rightarrow Y$, where $A$ is known, $Y$ is produced (also known), and $s$ is kept secret. But whose repeated application ...
2
votes
2answers
116 views

Is it safe to salt a MAC?

Say that I define a scheme where the salt is public and is MAC-ed with the message: $k = KDF(password, salt)$ $tag = MAC_k(salt || message)$ Is it safe to salt the MAC this way? Assume that the salt ...
1
vote
1answer
105 views

Number of keys for a monoalphabetic cipher

My teacher stated that… The number of possible keys (E) in a monoalphabetic cipher is $26$! My thinking: Every letter in the alphabet can be $25$ different letters hence it the number of ...
1
vote
2answers
100 views

Are password salts equivalent to keystream?

I was reading up on keystream when I came upon the definition of it: A keystream is a stream of random or pseudorandom characters that are combined with a plaintext message to produce an encrypted ...
1
vote
1answer
137 views

Monoalphabetic cipher key

I'm new to cryptography and have just completed homework on Monoalphabetic cipher. I managed to decrypt the cipher text successfully but I cannot identify the key from my plaintext to ciphertext ...
1
vote
0answers
43 views

Infer encoding mechanism from $n$-grams distance?

I have a series of obfuscated strings which across the set of strings have regions of high variance and regions of low variance – implying some encoding mechanism as opposed to an encryption procedure ...
2
votes
2answers
561 views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
0
votes
1answer
62 views

Efficiently show/prove knowledge of third party secret without leaking information

Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob. Bob then publishes some data $d$ (his identity or a message or smt.) and an ...
2
votes
1answer
115 views

How secure is a lagged fibonacci sequence for encrypting brief messages?

Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= ...
1
vote
2answers
270 views

Use case of RSA CRT

I discovered the CRT version of RSA cryptosystem which is used in many crypto libraries (openSSL, Java...). The use of the Chinese Remainder Theorem improves the speed of decryption so why it's not ...
6
votes
1answer
490 views

What do you call one time pad where pseudo-random numbers are used?

What is the encryption method called when pseudo-random numbers are used instead of true random numbers?
13
votes
2answers
1k views

AES-GCM Disadvantage

What is the disadvantage of AES-GCM mode for authenticated encryption? Why does the CAESAR competition say that it’s one of the goals to find an AE scheme that offers an advantage over AES-GCM? What ...
1
vote
2answers
141 views

Operation which needs much computing power to be created, but just a little to be solved?

Does somebody know a cryptographic/mathematic operation, that needs much computing power to be "encrypted"/"created" but doesn't need much power to be "decrypted"/"solved"?
5
votes
2answers
219 views

Secure way to derive separate encryption and MAC keys from a single master key?

I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ...
1
vote
1answer
91 views

DES-X , computation load and storage

The passage said that the computational load to attack DES-X can be reduced to approximately $2^{(56+64)}=2^{120}$ steps,and the storage of data sets should be $2^{64}$. But I can't figure why ...
7
votes
1answer
648 views

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = KDF(K_{master}, i) = H(K_{master} ...
1
vote
1answer
113 views

What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
0
votes
1answer
87 views

Is AES's parity key-dependent?

Is the parity of the permutation of the set $\{0,1\}^{128}$, defined by AES encryption for a certain fixed key, dependent on this key? DES, and any pure Feistel cipher, has even parity for any key. ...
2
votes
3answers
354 views

Format Preserving Encryption for 32 or 64 bit plaintext values

I am looking for a Format Preserving Encryption implementation to apply to either a 32-bit or a 64-bit integer. It looks like AES/FFX mode is just what I need in terms of established security ...
1
vote
1answer
103 views

How can convert affine to Jacobian coordinates?

I have a point in affine coordinates: $(x,y)$. What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates? I need it for calculating ECC in a prime field.
2
votes
1answer
91 views

Recover plaintext in passive attack of RSA of coprime public key

I have a situation in RSA like this. Charles sends same message $m$ to Alice and Bob encrypted with $e_A$ and $e_B$ respectively. It happens that he they are under same modulus $n$ and $gcd(e_A, ...
0
votes
1answer
43 views

How are salt values more secure? [duplicate]

If a database stores password encrypted by using salt values, how are they stored? I read somewhere, it uses timestamps. So is the timestamp also stored? How about when a user tries to login next ...
4
votes
2answers
288 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
-1
votes
1answer
72 views

Convert message to polynomial NTRU

How to make a message into a polynomial? I saw many answers to this question and yes, i know that here are some questions. But i did not get it. I think that i am making some mistakes. I took a word ...
4
votes
1answer
104 views

Generic group model: use of polynomials in the proof of the master theorem

I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ...
2
votes
1answer
161 views

Understanding Pseudo Random Generators

I've been taking a crypto course online. I have a good idea how PRG's and Stream Ciphers work, but I'd love to get some input to help visualize what is actually happening. I understand a seed is used, ...
0
votes
1answer
70 views

Prepending random data to encrypted file

If random data is prepended to a file encrypted with GNUPG's symmetric encryption, how may an attacker find out if the input file is deliberately corrupted or the passphrase is wrong? If it is not ...
6
votes
3answers
641 views

What is the use of Mersenne Primes in cryptography

There is an international search for Mersenne Primes. The project is huge. But what is the use of Mersenne Primes in cryptography? Do they have any other properties other than the $2^n-1$ form?
3
votes
2answers
156 views

Does a stream cipher require a KDF when it's key is variable length?

RC4 has a variable length key. Is it still necessary to use a key derivation function, such as PBKDF2, to initialize it? Would using a single character password weaken it's output when compared to a ...
1
vote
3answers
183 views

verify contents, but not order

Is there an algorithm that can be used to verify the contents of a cyphertext, but not the order of the elements? I am thinking that a deck of cards could be shuffled, and it must be verifiable that ...

15 30 50 per page