# All Questions

162 views

### Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?

One-Time-Pad is information theoretically secure as long as the random number stream is evenly long or longer than the data stream it encrypts, for a "decyphered" message could have been any message ...
316 views

### How can k3d3/ed25519-java's performance be improved?

I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses. CodesInChaos showed me that ...
142 views

### Private Messaging

Suppose Alice and Bob wants to send messages through Sue without revealing to Eve that the exchange took place. Slightly more formally, I don't want Eve to have any advantage telling if Alice is ...
170 views

### How HOTP values are validated according to RFC 4226

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part, The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP ...
110 views

### Hardness of CDH in different groups

What is the difference of the CDH problem in different groups? In particular, given a group $\mathbb{G}_1$ of order $q$ that is a subgroup of $\mathbb{Z}_q^*$, $q$ prime, and another group ...
219 views

### How can I tell which curve a given ECDSA implementation uses? (P-521 or something else)

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant. Without having access to the sourcecode, or the specification, is there any way for me to test which ...
197 views

### Do Gap-CDH groups exist?

A Gap-CDH group is such that, given group elements $g, a = g^x, b = g^y$, it is hard to compute $g^{xy}$, but, given a group element $c$, easy to verify if $c = g^{xy}$. While such groups have been ...
214 views

### How to design a practical and secure MAC scheme?

I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
468 views

### How to calculate y value from ((y*y) mod prime) efficiently

i am working ECC-224 bit. can any one tell me, how to calculate y value from ((y*y) mod prime) efficiently for large bit numbers.
809 views

### Security of Deterministic Encryption Scheme

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. Although we ...
185 views

### Changing SRP-6a message order

In SRP-6a, the public key $B$ of the server is normally sent after receiving the public key of the client $A$. Is it okay to send $B$ and $s$ after the client sends its username $I$, but before the ...
324 views

### Why does the SRP-6 calculation of B include a multiplier k = 3?

In SRP-6 $B$ is calculated as $B=kv+ g^b, k=3$. What is the purpose of $k$, and why was it fixed as $3$? (In SRP-6a, this value $3$ is replaced by $k = H(N,g)$, but this question is about SRP-6.)
259 views

### Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...
512 views

### Efficient Symmetric Mutual Entity Authentication Protocol

I am looking for an Authentication protocol for access control. Let's say both the client and server would share a symmetric secret (256 bit key) and the client wants to access the server. Access ...
368 views

### Can I use PGP to sign a message without providing cryptographic non-repudation?

The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC ...
435 views

### Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
228 views

### Detect tampering of data

I have the following problem: There are $n$ users and each users fills in three data points per day, this are three integers between say $-10$ and $10$. I have access to the database and hence I am ...
369 views

### Memory-hard operations in work-factor hash functions

I'm playing around with work-factor hash functions, and I'm looking for a memory-hard operation to make it resistant to GPU / parallel hardware attacks. I considered a very large (i.e. 64K) s-box that ...
469 views

### Can I use guids / uuids as counters for key derivation?

I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ...
286 views

### How to construct a zero-knowledge proof of a number of the form $n=p^a q^b$

Let $n = p^a$$q^b$ where p and q are distinct primes and a and b are positive integers. How to construct a zero knowledge proof that n is of such form? This is actually a homework problem with a ...
365 views

### How can one share information using the 'host-proof' paradigm?

I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it. I really like the idea of a ...
286 views

### Undecrypt using the OpenSSL EVP API?

I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation. When using AES-256-CBC on the two sides, it's important ...
291 views

### Best choice of finite field for AES on a 4-bit microcontroller?

As the finite field of $GF(2^8)$ are isomorphic to $GF((2^4)^2)$, $GF((2^2)^4)$ and $GF(((2^2)^2)^2)$, which of the fields is best suited and most efficient for 4-bit MCU and why? Would it be ...
108 views

### Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
307 views

### How is the MJH double-block-length hash function constructed?

I'm looking for information on the MJH double-block-length hash function, but the best free source I could find is the diagram on page 18 of Efficient hashing using the AES Instruction Set (submitted ...
84 views

### 64bit nonce in AES-CTR, why not 128?

I'm just a bit confused about the nonce/IV in AES-CTR ... it seems the suggested way to go is have a 64bit random nonce, and use the last 64bits as the counter, "starting at 0". I'm just wondering ...
127 views

### Quantum computing vs AES s-box equation

Do quantum computers have any affect on the ability to solve the non-linear AES s-box algebraic expression, or does solving it still fall under search algorithms (Grover's)? If quantum computer do ...
141 views

### Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
73 views

### Parallel authentication of encrypted data. What AE type to choose?

I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly. AES-CBC+HMAC is good except that verifying the MAC ...
69 views

### On Proving That a Primitive Does Not Exist

In the paper of Hsiao and Reyzin, Section $1.4$: Note that to show that no general reduction from $P$ to $Q$ exists requires proving that $Q$ does not exist Since the statement is about trying ...
88 views

### Implementing AES MixColumns with fewest XOR gates

I'm playing with Contiki (O.S. for constrained devices such as sensors and micro-controllers) and particularly with the AES encryption in software (the one available in Contiki source code). I'm ...
113 views

### EC: Why does $h>200$ need to hold?

From BSI-TR-03111 (PDF), on page 15: The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200. This value commonly is referred to as $h$ in that ...
66 views

### possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
90 views

### Hard-core predicates: should the adversary be given $1^n$?

In most (all?) classical sources such as the book of Goldreich (2001), hard-core predicated are defined thus: A polynomial-time computable predicate $b : \{0,1\}^* \to \{0,1\}$ is a hard-core of a ...
82 views

### Discrete logarithm over prime modulo: small input, large exponent, larger prime

I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario. 1) Input ($m$): the input messages are small (16-bit) 2) Exponent ($e$): the ...
130 views

### Prime factorization

What is the largest integer that can be factored by modern algorithm like Msieve and GGNFS in a time less than 5 hours with normal computers? For example, can an integer like ...
239 views

### AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
217 views

### Factoring two RSA modulus with known $|p_1 - p_2| < \ell$

I have two 1024bit RSA modulus $N_1 = p_1q_1$ and $N_2 = p_2q_2$ such that $0 <|p_1 - p_2| < \ell$, and $\ell$ is at most 64bit integer. Can I factorise $N_1$ and $N_2$? What's the answer when ...
269 views

### How does cryptanalysis of the Playfair cipher work?

I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, ...
200 views

### What cryptography is suitable to motivate High School students to learn math?

A High School math teacher in the Bronx asked me if I knew of any way to use cryptography in a way that motivates students (15 to 18 years old) to learn math. I do know that many of them want to ...
169 views

### Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
120 views

### How did the power measurements translate to AES Key?

A side channel attack is described here. I did not quite get , how the power measurements are used to get the decryption key , can any body explain it?
274 views

### reducing false positives in searchable encryption

Practical techniques for searchable encryption proposed by Song et al. [1] have a false positive rate of $l/2^m$ where $l$ is left half of encrypted bits and $m$ is right half and $l+m=n$ where $n$ is ...
99 views

### OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well. Thank you.
138 views

### Public key in fully homomorphic encryption over the integers

I'm reading “Fully Homomorphic Encryption over the Integers” by van Dijk et al. I wonder why $x_0$, which is a component of the public key, should be an odd number?
172 views

### Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
186 views

### Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
133 views

### Deterministic Rand function for Winternitz One Time Signatures

Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless ...
By Shanon theorem, a perfect secrecy encryption scheme must use a key space of equal size as the message space. But when the correctness requirement is weakened such that $Pr[Dec_k(Enc_k(m))=m]=1/2$ ...