6
votes
1answer
228 views

How secure is the knapsack?

Can the knapsack be used in cryptography in a secure sense (described below)? Knapsack problem: Given some number $X$ and a set $W$ of weights $w_1, w_2, ... w_n$, find a subset $S$ of $W$ (if it ...
1
vote
0answers
59 views

How we can said a crypto system have perfect secrecy?

For example: I have 3 plaintexts ($a$, $b$, $c$) and 4 keys ($K_1$, $K_2$, $K_3$, $K_4$), making a table map to the cipher text, key as row and plaintext as column $\begin{matrix} \ \ \ \ \ \ \ \ \ \ ...
0
votes
0answers
53 views

New modulus or new key pair?

I have this assignment question that I'm not sure how to answer. Any insight would be helpful. In the RSA public-key encryption scheme, each user has a public key, e, and a private key, d. Suppose ...
1
vote
0answers
59 views

El Gamal encryption scheme and symmetric encryption scheme

Consider the El Gamal encryption scheme, a symmetric encryption scheme (KG,E,D), and the following hybrid encryption scheme having an encryption algorithm that, on input a public key (G,q,g,h), where ...
4
votes
1answer
127 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
7
votes
2answers
214 views

RSA: Letting $p$ and $q$ have different bit-size

I am aware that there are concerns if $p$ and $q$ are close i.e. $\Delta=|p-q|$ can't be too small. But I would like to know if there are any known attacks for cases where $p$ and $q$ take on ...
1
vote
1answer
45 views

Disadvantages of one-way accumulators?

One-way accumulators are built upon a (quasi)-commutative one-way function. With quasi-commutativity, I refer to the following property: For $f : X \times Y \to X$, it is true that $f(f(x, y_1), y_2) ...
1
vote
1answer
86 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...
4
votes
1answer
165 views

Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
2
votes
1answer
140 views

Generate a new public/private key pair for each new message?

When using PGP type public encrypted communication, would it be a good idea to generate a new public for each message and attach that in the new public key in the reply to back to sender mail body? ...
9
votes
2answers
2k views

What is difference between PRG, PRF, and PRP

Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then ...
1
vote
1answer
43 views

Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
1
vote
1answer
77 views

Difference between plain AES CTR and “CCM-style” CTR

I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
-1
votes
1answer
92 views

cryptography and use of python programming language [closed]

why is it recommended to write cryptography programs ,for example crypt-analysis projects with python programming language? what is the advantages of python? why not use c or any other language?
-1
votes
1answer
57 views

How to keep phi(n) secret in RSA?

As we know, RSA cryptosystem have both private key(a,p,q) and public key(b,n), by chinese remainder theorem and fermat's little theorem, we know that the importance of keep p and q secret, and from ...
1
vote
1answer
121 views

How do I express each element in a field F as a power of a primitive element?

I have a field $\mathbb F_{2^4}$, and it is represented as a residue ring of the polynomials over $\mathbb F_2$ modulo the polynomial $\beta^4 + \beta^3 + \beta^2 + \beta + 1$. I want to express ...
6
votes
1answer
156 views

Why does this square root algorithm work?

I've been doing some elliptic curve cryptography, and a library I'm using has this slightly bizarre algorithm for computing modular square roots: Let $x$ be some quadratic residue modulo $p$ for some ...
1
vote
0answers
68 views

How we transfer 128bits cipher to a 4x4 matrix for AES input?

Why the input cipher for AES encryption, can write in 4x4 matrix with 8 bits entires, and can said is 128bits? if each cell is 8bits in binary, how we said this matrix is represent 128bits?
2
votes
0answers
62 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
0
votes
0answers
59 views

After heartbleed, how can you safely distribute new certs? [migrated]

It's been a while since I studied key distribution, so I may have some fundamental misunderstanding.. From what I remember, man in the middle attacks can't occur during cert distribution because the ...
1
vote
1answer
103 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
3
votes
0answers
83 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
14
votes
5answers
2k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
1
vote
0answers
28 views

Index of coincidence for completely random text over k alphabets

I'm confused about /Friedman's method 2 (using a table with column of k size of key, and n/k rows, n is the total size for cipher text) \begin{equation} m = ...
2
votes
2answers
295 views

Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG: Why require an entropy source specify which pool a random event should ...
0
votes
2answers
98 views

Why are Fortuna entropy pools reset after a reseed?

I've implemented LibTomCrypt's version of fortuna and am wondering about the pool resetting after a reseed. In fortuna.c in libtomcrypt we have the following (which is that part that adds the entropy ...
6
votes
3answers
1k views

What are some disadvantages of homomorphic encryption schemes?

I'm doing some self-teaching / research for my own benefit in homomorphic cryptography. I've studied both additive and multiplicative schemes (Pallier and RSA respectively), but all I can seem to ...
2
votes
1answer
87 views

Rotation table for 8 round DES

I'm trying to implement DES from scratch using the NIST paper and the Wikipedia article on DES. I got 16 round DES done, but I can't seem to get 8 round DES working. I figure it's because I got the ...
2
votes
0answers
85 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...
1
vote
1answer
95 views

What is the best way to share a shared secret key over HTTPS to be used for HMAC authentication?

I am writing an application in Java that will be using SHA-1 HMAC message authentication. From what I understand, a connection over HTTPS is considered secure enough to share a secret key in plain ...
1
vote
0answers
65 views

Is this a correct understanding of Universal Hash Functions?

I'm studying universal hash functions and have been reading several papers but now i'm focusing on Wegman and Carters original paper from 1979 (Universal classes of hash functions) and the H1 class. ...
1
vote
3answers
191 views

What is h in the improved solution of RSA algorithm?

I am trying to implement a proposed improved algorithm of RSA . Here the author has increased the number of exponents. However I am unable to understand what $h$ is in the Key generation step. Can ...
0
votes
1answer
40 views

AES-256 Shift-Rows Offsets

I am currently trying to implement a AES-256 cipher according to this sepcificaciton: http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf As well as on Wikipedia and in the document ...
1
vote
0answers
39 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
6
votes
2answers
648 views

Will repeated rounds of SHA-512 provide random numbers?

If I hash a keyword with SHA-512 and then feed the output as the key for the next round ....and keep repeating this process, will I gather a stream of random numbers?
5
votes
2answers
200 views

Analogue encryption algorithms

I have a basic understanding of how strong encryption works on digital data. Bits can be changed so that they appear completely random and map one-to-one back to the original set, given the correct ...
3
votes
1answer
85 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
1
vote
0answers
22 views

Hill cipher key space

Key space is the set of all possible keys that can be used to generate a key.we using the number of valid key to describe it. Q: I've given a hill cipher of block size k over alphabet of size p, ...
-1
votes
1answer
165 views

SHA256-based stream cipher

Can anyone comment if the stream cipher described here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced ...
0
votes
0answers
49 views

How to know private key is computed from specific partial private key?

In a certificate-less cryptography, I have learned that – to resolve the key escrow problem of IBE – the concept of a partial private key is used. Now, consider the following Scenario: After ...
3
votes
2answers
122 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
1
vote
1answer
61 views

Is it possible to deduce the IV from CBC ciphered data, without knowing the key?

The question came up here, which left me thinking: Is it possible to deduce the IV from CBC ciphered data, without knowing the key? And if not, why is it considered a bad idea to create an IV by, for ...
1
vote
1answer
66 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
3
votes
1answer
50 views

Does displaying HMAC hashes of user inputs compromise the HMAC validation?

Here is the scenario: "SECRET" is a secret key that is kept private and only used in this one application. The application allows users to enter in any "VALUE" (within various open-ended limits such ...
6
votes
3answers
1k views

How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
1
vote
1answer
46 views

Secret Sharing 1 Required

Devise a scheme so that a message M can be shared among X, Y and Z in such a say that the only way of recovering the message is when X is present with either Y or Z. When X isn't present or each is ...
9
votes
3answers
376 views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
0
votes
0answers
91 views

Hybrid encryption RSA with AES?

I made a hybrid algorithm using the elliptic curve theory. I want to compare my algorithm with another standard algorithm. I was thinking about using RSA with AES, where the AES key is used to encrypt ...
1
vote
0answers
55 views

Is it safe to derive ephmeral keys by hashing a curve25519 key and a sequential number?

My understanding of curve25519 is that a key is derived solely from Alice's private key and Bob's public key and that curve25519 will always yield the same shared secret $K_s$ for the same keys. Now, ...
0
votes
2answers
96 views

Convert SpookyHash to semi-secure 192bit hash [closed]

What do you think of converting SpookyHash into semi-secure 192bit hash function by this way: increase security by using 8 * 8byte = 512bit blocks instead of 8 * 12byte blocks, but remaining 8 * ...

15 30 50 per page