# All Questions

287 views

### Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
115 views

### Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?

I'm reading the ECDSA paper and they say you can only use ECDSA with odd-power fields $p$ or with binary fields $2^m$. Why not other power prime fields?
127 views

### EC: Why does $h>200$ need to hold?

From BSI-TR-03111 (PDF), on page 15: The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200. This value commonly is referred to as $h$ in that ...
263 views

### Computation indistinguishability questions

The definition I have is: Two probability ensembles $X = \{X_n\}_{n \in \mathbf{N}}$ and $X = \{Y_n\}_{n \in \mathbf{N}}$ are computationally indistinguishable if for every probabilistic polynomial-...
849 views

### How to solve cipher encrypted with Vigenère + Columnar Transposition?

Vigenère's weakness is Kasiski's test and index of coincidence. However, if you put columnar transposition on top of Vigenère, that weakness is gone. The text is now shuffled and you can't search for ...
343 views

### Leak-proof protocol: is such a thing possible?

Is it possible to design a protocol that by itself guarantees that a malicious implementation cannot leak secret data without breaking the protocol? Setting: Alice and Bob have a pre-shared secret ...
557 views

### Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
262 views

### Can you help me understand hash-preserving encryption?

I have rather simplistic understanding of cryptography, so I have to beg a pardon in advance if the question has internal contradictions. Imagine data $A$ with a hash $hashA$. This data is encrypted ...
271 views

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of $\operatorname{HMAC}(... 1answer 135 views ### estimating entropy/randomness as fail-safe mechanism Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as ... 1answer 532 views ### Safe generator for ElGamal signature What are the properties a generator$g$should have to be secure for ElGamal signatures (original scheme)? I am aware that it is poorly chosen and not secure when$g|p-1$or$g^{-1}|p-1$, where$p$... 1answer 1k views ### Can you help me understand the Common Modulus Attack in a Lucas Group? I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ... 0answers 57 views ### Increase in AES SBox AES uses one single Sbox to substitute all 16 bytes in one Round. Will using 16 different Sboxes (with cryptographic properties similar to AES Sbox i.e Non-Linearity of 112, Differential probability ... 1answer 72 views ### AES with shuffleBytes instead of shiftRows I was examining how AES provides diffusion and noticed that indices of the shiftRows transposition step can be modeled as inputs/outputs of a 4x4 table: ... 0answers 59 views ### Software timing attack using Kocher method What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of$A_{i,r}$and$D_{i,r}$? I'm working from this paper: Volker ... 0answers 59 views ### Confusion on Private Information Retrieval by Keywords PIR protocols retrieve an item from the database without the server knowing which item it is. But classic CPIR(Computational PIR) or IT-PIR (Information Theoretic PIR) protocols requires the user to ... 0answers 107 views ### Homomorphic system that allows Hamming distance computation? How can I work out Hamming distance between two binary vectors securely? I would like to know how I can apply homomorphic techniques here. 0answers 47 views ### Best differential characteristic for this PRF Consider the following construction of a PRF$F: \{0,1\}^{128} \times \{0,1\}^{64} \to \{0,1\}^{64}$on 64-bit messages and 128-bit keys. Define$f:\{0,1\}^3 \to \{0,1\}$by$$f(c,x,y) = \begin{... 1answer 65 views ### Difference between hierarchical and multi level secret sharing In this paper, the definitions are simply as follows. Multi-Level secret sharing: Higher level participants can help lower participants to get the secret. Compartmented secret sharing: Each level ... 0answers 76 views ### What is the fastest modular reduction algorithm available? I have been browsing for the fastest and most efficient modular reduction algorithms and came across quite a few. But the one in A Fast Modular Reduction Method (2014) by Zhengjun Cao, Ruizhong Wei ... 0answers 133 views ### Is F5 still a viable steganography algorithm? [closed] I am currently developing a steganography application and have been studying the F5 algorithm by Westfeld. I keep on seeing from various literature and open source projects (e.g. from GitHub) that it ... 0answers 147 views ### help with cryptanalysis of a sponge permutation I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ... 0answers 42 views ### An MPC protocol from Elgamal is a good solution a homomorphic multiplication? I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ... 0answers 34 views ### OTR AKE protocol implementations security While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ... 0answers 90 views ### Performance of ECDSA, ECKCDSA and ECGDSA It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ... 0answers 77 views ### Why is AES-SIV not used, but AESKW, AKW1? I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ... 0answers 98 views ### Proof that perfect privacy implies that the number of keys is at least the number of messages I was reading a proof to the statement: Perfect privacy implies that$|K| = |M|$where I am pretty sure that$K$is the set of keys and$M$is the set of messages. The proof is the following, ... 0answers 121 views ### Efficient way to confirm identity I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ... 0answers 41 views ### Is it possible and safe to use SAKKE for signing/verification, rather than for encryption? Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ... 0answers 46 views ### Can a one-way accumulator be used in place of a digital signature? Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to: verify that the data has not been tampered with, and verify that the message is in fact sent/... 0answers 325 views ### How to break a columnar transposition cipher? I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ... 0answers 67 views ### Elliptic curve point addition with$Z_1 = Z_2 = 1$Elliptic curve point addition and point doubling operations using Projective and Jacobian coordinates require fewer field multiplication operations when considering$Z$coordinates of input points ... 0answers 32 views ### Safe generation of$k$points on a curve such that the mutual discrete logs are hard? I have a multiplicative group$G$of prime order$p$implemented using a twisted Edwards curve (similar to Ed25519). I want to compute a set of$k$distinct points$P_1,...,P_k$that generate$G$, ... 1answer 398 views ### Small subgroup confinement attack on Diffie-Hellman I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ... 0answers 113 views ### Would the encryption of bigrams and trigrams weaken the code? Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ... 0answers 283 views ### What is the original SKID3 protocol? While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) A --> B: rA (2) B --> A:... 0answers 340 views ### Evaluating Algebraic Complexity of a S-box While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ... 2answers 438 views ### Is my id obfuscation algorithm secure? I'm designing an id obfuscation system. My system includes: Embedded chips, each chip has a unique 32-bit address (id). Server Insecure low-bandwidth unstable one-way channels from the chips to the ... 0answers 119 views ### Homogenous and heterogeneous Unbalanced Feistel Networks Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ... 0answers 268 views ### Given a 'good' basis for a lattice, how can we solve the CVP? I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ... 0answers 319 views ### Is there a “brainwallet” for GPG keys? [closed] “Brainwallet” is a program that takes a passphrase (hopefully a good one) and deterministically creates a Bitcoin wallet. This wallet can be used for transactions, then deleted from the computer. To ... 0answers 306 views ### LT codes with Homomorphic hashing I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and http://blog.notdot.net/2012/... 0answers 170 views ### Unique GCM/CCM initial counters without recipient side message counters I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ... 0answers 338 views ### Odds of false error detection in a randomness test using the chi-squared test? Common Criteria classifies the requirements for true Random Number Generators, and specifies how these should be tested against failures (these can occur accidentally, or following deliberate attack, ... 0answers 455 views ### How can I find two strings$m_1$and$m_2$, knowing that I know$m_1 \oplus m_2$? [duplicate] Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first part ... 1answer 106 views ### Build set with PKI from reliable broadcast / random beacon I am trying to build a protocol (or find an existing one) for creating a set$S_2$with PKI from a set of parties$S_1$that initially does not know anything about the other parties. We assume end-to-... 2answers 429 views ### Relation between key size and PRNG state size Some (supposedly) cryptographically secure PRNGs have an internal state of only 160 bits or less. When the algorithm is otherwise properly designed, that seems like enough to generate a 128 bit key ... 2answers 466 views ### Tunnels used in md5 I'm reading the paper "Message Freedom in MD4 and MD5 Collisions: Application to APOP" about finding collisions for the MD5 hash algorithm involving the concept of tunnels as described in "Tunnels in ... 2answers 1k views ### Is there something wrong with my decryption using key=9, mod 26? I am new to cryptography and have started looking at some basic encryption. I have the following question to answer: Decrypt the the following encrypted quotation using ... 4answers 450 views ### Where does the$\varphi(n)$part of RSA come from?$e d \equiv 1 \pmod{\varphi(n)}$Where does the$\varphi(n)$part come from? How did the inventors of RSA arrive at$\varphi(n)\$?

15 30 50 per page