0
votes
1answer
56 views

What is base of $\log$ in Subexponential Algo for DLP?

I am currently going through this paper - "A Subexponential Algorithm for the Discrete Logarithm Problem" by Leonard Adleman. On page 56, author mentions that Dixon's algorithm - Asymptotically Fast ...
3
votes
0answers
57 views

What is perfect collision-resistence in probability terms?

update: removed lots of stupidity... sorry. I didn't know I can be this stupid but I achieved it. 1. Goal Let $\mathcal{D}$ be the universal space of our plain data. Our goal is to find a function $...
1
vote
0answers
63 views

Encryption & decryption of integers using modular multiplicative inverse and extended euclidean algorithm

I'm looking for a neat algorithm, which is capable of encrypting an integer to another integer and decrypting it again AND is secure. When I was in university, my professor showed me an awesome way ...
4
votes
5answers
232 views

Is it possible to ensure security with zero pre-shared information?

Is it possible to secure a communications channel against both passive (sniffing) and active (injecting / MitM) attackers without either legitimate party knowing any pre-shared information? I know ...
0
votes
0answers
18 views

Can we bound adversarial power in terms of total entropy in universe? [duplicate]

The strengths of various cryptographic primitives are often explained (though not defined) in terms of how long it would take to break under the current best known attacks. For example, apparently the ...
1
vote
2answers
103 views

Weak and Strong Collision Resistance, again

Weak collision resistance (CR), or second-preimage resistance, is the property that given $x$ and $h(x)$ ($h$ a hash function) it's difficult to find $x' \neq x$ such that $h(x') = h(x)$. Strong CR, ...
3
votes
0answers
32 views

how exploitable are cache timing attacks

So there's a PHP package that's been recently written to protect against cache timing attacks: https://www.reddit.com/r/PHP/comments/4a1iuh/rfc_4648_character_encoding_written_to_resist/ My question ...
19
votes
0answers
712 views

Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$

Suppose you want to select a prime $p$ such that finding e.g. $\log_2(3)$ in $\mathbb{Z}_p$ is expected to be either at least as hard as the general Discrete Logarithm Problem in $\mathbb{Z}_p$, or at ...
7
votes
4answers
206 views

Why haven't we proven many things computationally secure yet?

Brute Force is infeasible for just about every algorithm we use today. Yet, attacks are feasible. This is because weaknesses keep coming up in our algorithms. Why? We have proven lower bounds for ...
1
vote
1answer
95 views

SHA-3 padding clarifications

I am implementing the SHA-3 algorithm in AVX2 assembly. The part where I am getting confused is that the padding with 10*1. Now my understanding is that the data message M first needs to be padded ...
1
vote
0answers
46 views

Security of a lightweight heartbeat protocol

I am implementing a heartbeat protocol so that a server can send notifications to clients. The notifications are not occurring so often, so I don't want to keep an open TCP+TLS session for each client,...
3
votes
0answers
60 views

Perfect secrecy is maintained for other plaintext prob distributions?

Suppose a cryptosystem achieves perfect secrecy for a particular plaintext probability distribution. Prove that perfect secrecy is maintained for any other plaintext probability distribution. Having ...
0
votes
1answer
191 views

Cube-Root attack - RSA with low exponent

I have this RSA public key ...
3
votes
1answer
77 views

How can I formally verify fuzzy commitment scheme based security protocol?

I am currently working on designing a security protocol which involves usage of fuzzy commitment schemes, for. eg Reed-Solomon codes which allows us to tolerate a certain level of error. I was ...
0
votes
2answers
63 views

Would a non-deterministic (read: randomized) compression algorithm be crypto-safe?

Would a compression algorithm that randomly shifts stuff around every iteration be TLS/crypto-safe? This randomization would prevent the same byte sequence from appearing twice in a row, thus making ...
2
votes
2answers
111 views

Implementing RSA with small integers in CUDA

I have found some researches dedicated for speeding-up RSA calculations using CUDA. But I am wondering how they do that, given that the biggest unsigned int that could be declared in CUDA is 64 bit. ...
0
votes
0answers
27 views

Using Counters instead of MAC in CBC mode

I am wondering what are the implications of using a session counter appended to the end of a plaintext and then use a cipher in CBC mode to encrypt it vs. adding a HMAC or some form of keyed MAC to ...
0
votes
0answers
19 views

caesar cipher implemention and exection

I am trying to run one of the caesar cipher from https://competitions.cr.yp.to/caesar-submissions.html I have got the code for the cipher from https://github.com/floodyberry/supercop Can anyone help ...
6
votes
3answers
3k views

Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?

I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information. I have narrowed down the implementation to 3 different approaches, ...
1
vote
2answers
61 views

Using same encryption key in different schemes

Is it safe to encrypt possibly same plaintexts with 2 different algorithms using same secret encryption key? This question is similar to this question except they use 2 keys. More formally: $E_k(m) = ...
11
votes
1answer
15k views

What is Attribute Based Encryption?

Can someone explain what attribute based encryption is? I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing ...
2
votes
0answers
22 views

CRL number generation sequence

RFC 5280 states that the CRL number should be monotonically increase. I have seen this common practice of incrementing the CRL number by 1, everytime a new CRL is generated. But can i use epoch time ...
1
vote
1answer
81 views

Are developers expected to implement Diffie-Hellman key exchange themselves?

I noticed that the GO standard library has some really nice functions for performing AES encryption / decryption in various modes. However, I couldn't (yet) find anything for Diffie-Hellman key ...
10
votes
3answers
793 views

Stopping timing attacks on AES: Why is it important to prevent the OS from interrupting the AES computation?

I read the paper Cache-timing attacks on AES (by Daniel J. Bernstein), but I don't seem to understand everything. The author dedicates a long section on how to prevent the OS to interrupt an AES ...
4
votes
1answer
35 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
4
votes
1answer
100 views

How does a company like Apple keep its keys safe? [closed]

Whatever key is used to sign new iOS updates (for example) must be incredibly well-protected. How does a huge corporation like Apple keep those 4096 bits safe?! Same goes for SSL keys for websites ...
-4
votes
1answer
65 views

Perfect secrecy of affine cipher

Given any probability distribution P r on the set $\{k โˆˆ \mathbb{Z}_{26} : \gcd(k, 26) = 1\}$. Show that the Affine Cipher achieves perfect secrecy if the key (k, a) is used with probability $Pr(k) ยท(...
4
votes
2answers
122 views

Using One Time Pad with a block cypher

The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ...
2
votes
1answer
47 views

reconstructing data on a noisy channel?

I have an interesting situation where I have a block cipher and a noisy channel. The interesting thing is that I happen to know much about the data. The cipher is a balanced Feistel network, and for ...
2
votes
1answer
215 views

Client Puzzles and HMAC

I'm learning about client puzzles for DoS (Denial of Services) Protection, and I came across this question. For each request, the server sends the client a freshly generated random challenge r and ...
-3
votes
1answer
56 views

How does the math part of RSA work? [duplicate]

I understand the theoretical part of RSA (the concept of public and private keys), but I don't understand the mathematical part. Can anyone please explain it to me in simple terms? Thanks.
1
vote
1answer
46 views

Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?

Given $c' = \operatorname{HMACSHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$ and the 32-bit integers $a$, $b$, $c$, and $d$ is it feasible to alter $b$ and produce a valid MAC under the unknown key? I ...
3
votes
2answers
27 views

X509 converted to Encrypted and Signing keys

We have proprietary tool which takes a p12 file and generates a .key file. Inside the key file, I see two PEM formatted sections: Encrypting Certificate and Signing Certificate. When I open them on my ...
1
vote
1answer
39 views

Government root SSL certificate possible vulnerabilities [closed]

I'm writing an article about new government law in Kazakhstan. The law was accepted in December, but now one of our providers announced information for small and medium business how to install ...
0
votes
1answer
50 views

Is sharing the RSA public key secure?

I am trying to understand how RSA public key cryptography works. I have the following questions: Are any attacks / compromises possible if a server sends its public key $(n,e)$ in the clear to a ...
2
votes
3answers
210 views

What is the difference between substitution cipher and block cipher?

I'm studying(and clearing my head) about block cipher. I started from Caesar Cipher which can be considered as a kind of substitution cipher (if my understanding is right). And an ideal substitution ...
1
vote
0answers
72 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
3
votes
1answer
92 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
6
votes
1answer
113 views

Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519. ...
1
vote
1answer
103 views

Really simple RSA style public private key generator

I am giving a talk to high school students and would love to do a real life encryption/decryption demonstration. I am not too familiar with the maths but is it possible to create like a 5-10 bit ...
1
vote
1answer
88 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
5
votes
1answer
517 views

One-Way property of Random Oracle

I'm currently working on a proof in the Random Oracle model, and could not find the formal argument on why the random oracle is one-way (i.e. for an Oracle $O$, it is easy to calculate $x=O(n)$, but ...
3
votes
1answer
54 views

Difference between Constructor and Destructor terms

I was thinking that in the formal model (or symbolic model?) the destructor terms were used to model processes that could abort generating some errors or something like that. But then, I realized that ...
1
vote
1answer
82 views

Determine whether a given function is a pseudorandom generator/function

I am trying to solve the following three tasks (for exam practice, not as a homework): Define $๐บ : \{0,1\}^* \rightarrow \{0,1\}^*$ by $G(x_1,...,x_n) = ๐‘ฅ_1 \oplus ๐‘ฅ_2,๐‘ฅ_1,โ‹…โ‹…โ‹…,x_n.$ Prove that ...
1
vote
1answer
68 views

Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
1
vote
0answers
69 views

Fast algorithm for reduction modulo a prime [closed]

If the prime is $p=2^a\cdot3^b+1$ , is there any fast reduction technique modulo this prime?
3
votes
3answers
108 views

In an A5/1 stream cipher, why do the registers have a stepping probability of 3/4

I know that the probability of each register to step is 3/4 but I have yet to find an explanation of why. Can anyone explain this to me?
0
votes
0answers
21 views

How were the diffusion statistics for norx calculated?

I was reading the norx specification and came across this section, which provides some kind of statistics about the diffusion of the norx round function. However, I don't see how these values were ...
6
votes
1answer
86 views

Are CSPRNGs quantum-resistant?

It's fairly well known that Shor's algorithm kills RSA, DSA, ECDSA, DH, ... and that symmetric ciphers (AES and 3DES) and hashes (SHA-2, SHA-3) are safe as long as you double your key size / output ...
1
vote
1answer
132 views

HMAC-SHA1 vs. AES

This might be a very silly question, but I am a total novice in encryption. I don't know where to start searching for an answer to this problem. I am building applications using a proprietary ...

15 30 50 per page