# All Questions

65 views

### Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
25 views

### Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
59 views

### One-wayness proof of Elgamal

Here in the proof of Elgemal one-wayness: Consider an adversary V that can invert random Elgamal encryptions with $ε$ probability. $V *$ : Adversary to compute the Diffie-Hellman function: ...
35 views

### Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
47 views

### How do you do a linear feedback shift register?

I saw a video on YouTube by Daniel Rees. The video was about stream ciphers and showed how to do a linear feedback shift register. The example that was used to demonstrate how to do it is was like ...
73 views

### AES sbox security issue - power analysis attack?

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. I am new to power analysis attacks, so it is hard to ...
65 views

### Distinguish two ciphers in Ring-LWE?

I am fairly new to this topic. so my question is: if I have $A=e_0a+e_1$ and $B=e_2a+e_3$ where $a$ is the agreed public parameter, $e_i \leftarrow \chi$ (drawn from the error distribution). if the ...
59 views

### In what sense addition modulo $n$ ($n>2$) isn't linear in the field $\mathbb{F}_2$?

I've been reading the Reason why “XOR” is a linear operation, but ordinary “addition” isn’t? question, in which one of the answers states that addition modulo $n$ ($n>2$) is linear in $\mathbb{Z}_n$...
87 views

### Key exchange problem

I've found the following problem in one of my courses. Any tips on how to solve this would be appreciated! Alice has the key pair $(pka,ska)$. Bob has the pair keys $(pkb,skb)$. They want to ...
25 views

### linear cryptanalysis: how are the subkey bits removed from the linear approximation?

I'm currently reading the tutorial on linear/differential crypta here: https://www.engr.mun.ca/~howard/PAPERS/ldc_tutorial.pdf End of page 14/Beginning of page 15: all the bits from the subkeys are ...
40 views

### ZK Proof for SIS

Let $A x = 0 \bmod q$ with $\Vert x \Vert < \beta$ be a lattice SIS problem. Does there exist an efficient zero knowledge proof of knowledge for such a solution? My idea is to use it for an ...
37 views

### Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
2k views

### Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
284 views

### Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
26 views

### The Encode algorithm of Garbling scheme is probabilistic or deterministic?

In general the garbling scheme works as follows: Garb(1^\lambda, C): on input the security parameter \lambda in unary and the circuit C, it outputs a garbled circuit \widehat{C} and a garbling key ...
73 views

### Definition of secure computation with more that two parties

In Definition of secure computation in m-party case with respect to semi-honest adversary (Definition 7.5.1 in Foundations of Cryptography: Volume 2, Basic Applications by Oded Goldriech) we say ...
23 views

### Encrypt a small amount of data with a password derived from PBKDF2

I have a small amount of data (about 128 bits) to secured with a strong password. I plan to run PBKDF2-SHA2-256 on the password and a 128 bit random salt to generate a 256 bit derived key. Then with ...
34 views

### What is many:1 and collision in MD5?

This is in reference to this answer on Stackoverflow. If you read the first paragraph of the answer, you'll find this line: It's always a many:1 mapping (meaning there will always be collisions) ...
145 views

42 views

### Clarification on Key exchange approaches in TLS/SSL

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
660 views

### Creating serial key generator using ECDSA, how to get signature short enough?

I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together. I have for the last couple of weeks been building a serial key generator project ...
3k views

### In which cases should the IV be kept secret?

When must an IV be kept secret? There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places. Does this ambiguity suggest that there are, in fact, ...
84 views

### Exploiting XOR one-time-pads with alphabet size that isn't a power of 2

I realized that if the key is chosen randomly from a range that isn't a power of $2$, the one-time-pad leaks information about the plaintext. For example, if the alphabet was the first 20 naturals, ...
495 views

### Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack

While reading a literature on signature schemes, I came across the concept of Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack. Can anyone point me to the paper ...
46 views

### Is this ECDHE approach secure?

First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure. I'm developing a signed/encrypted ...
25 views

### Secure Communication Protocol Design using oblivious transfer?

I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it. Consider Alice as a sender who has $n$ strings which ...
44 views

### Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
64 views

### Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
25 views

### GIven Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM [duplicate]

Sorry for a simple curiosity, Given Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM ?
251 views

### Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
47 views

### substitution Box(s-box) for AES

can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes?for example ; if i have 100 different s-boxes. i want to pick any one which is secured ...
147 views

75 views

### How to decrypt an RSA ciphertext given an oracle providing the lower 8 bits of decryptions?

I have access to an oracle that can encrypt and partially decrypt a number with RSA-1024 algorithm. For encryption: $$C = M^e\bmod n$$ But for decryption, result will ...