1
vote
1answer
143 views

justification for method to factorize n knowing RSA private exponent d

I know that knowing the private exponent $d$ corresponding to the private key $k_{pub}\langle n,e\rangle$ it is possible to efficiently factorize n. The procedure starts stating that: $ed -1 = s(p-1)...
2
votes
1answer
50 views

Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$?

DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart ...
1
vote
1answer
117 views

Encrypting and Authenticating The Simplex Communication Between Embedded Devices

I am planning to build temperature sensor nodes for my home heater control. Central device will control the heater using temperature data read by nodes. These nodes will send temperature data to ...
3
votes
1answer
37 views

Questions about SSL3 POODLE Bites

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
0
votes
3answers
484 views

Are hash functions chaotic?

I'm looking into "bitcoin like" mining processes. Say a security process uses a hash of data as proof that the data was known at some point in time. From what I understand, hash functions are ...
0
votes
0answers
24 views

Elgamal and Cramer-Shoup encryption: Given private key and ciphertext, can public key be determined?

I have a potential use case for Elgamal or Cramer-Shoup encryption which would effectively reverse the visibility of the public and private keys. The ciphertext and private key would be published and ...
3
votes
0answers
23 views

uf-cma and uf-cmva probabilistic MAC

Is there any simple probabilistic MAC $\Pi=(\operatorname{Gen},\operatorname{Tag},\operatorname{Vrfy})$ with UF-CMA security but without UF-CMVA security? How can an attacker efficiently use the $\...
1
vote
1answer
42 views

Clarification on Key exchange approaches in TLS/SSL

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
3
votes
2answers
657 views

Creating serial key generator using ECDSA, how to get signature short enough?

I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together. I have for the last couple of weeks been building a serial key generator project ...
25
votes
2answers
3k views

In which cases should the IV be kept secret?

When must an IV be kept secret? There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places. Does this ambiguity suggest that there are, in fact, ...
3
votes
1answer
84 views

Exploiting XOR one-time-pads with alphabet size that isn't a power of 2

I realized that if the key is chosen randomly from a range that isn't a power of $2$, the one-time-pad leaks information about the plaintext. For example, if the alphabet was the first 20 naturals, ...
0
votes
1answer
493 views

Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack

While reading a literature on signature schemes, I came across the concept of Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack. Can anyone point me to the paper ...
0
votes
1answer
46 views

Is this ECDHE approach secure?

First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure. I'm developing a signed/encrypted ...
1
vote
0answers
25 views

Secure Communication Protocol Design using oblivious transfer?

I have a problem I need to solve with the following scenario and I hope someone can help me find an approach or direction to start tackling it. Consider Alice as a sender who has $n$ strings which ...
2
votes
0answers
44 views

Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
3
votes
2answers
64 views

Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
-1
votes
1answer
25 views

GIven Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM [duplicate]

Sorry for a simple curiosity, Given Unencrypted and encrypted data (AES-GCM) both, is it possible to calculate the Chiper key of AES-GCM ?
4
votes
1answer
249 views

Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
1
vote
2answers
45 views

substitution Box(s-box) for AES

can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes?for example ; if i have 100 different s-boxes. i want to pick any one which is secured ...
3
votes
1answer
147 views

In HMQV, can one use multiple identities with one public key?

The HMQV protocol has 2 "identity" fields $\hat{A}, \hat{B}$ that are used in the dual signature - and it tries to guarantee that any properly-generated session key is only shared by a single $(A, B, \...
7
votes
6answers
2k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more

When an entity A wants to send a message to entity B, he can attach a MAC to the message. Entity B on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
0
votes
1answer
28 views

XOR and bilinear form property

I know that $XOR$ is equivalent to modular addition in the field $\mathbb{F}_2 = \{0,1\}$ (is it right?), and thus should satisfy the following property of a bilinear form: $$\oplus(u+v,w) = \oplus(u,...
3
votes
1answer
83 views

How can I create pre-determined encrypted results?

I want my encryption results to be the lyrics to Star Spangled Banner. The original text I'm encrypting would be, for instance, the menu to a local pizza place. I know what I want my passphrase to be. ...
4
votes
3answers
154 views

What is a purpose of reducing lattice basis?

This may be too broad question but it is not. I have been studying lattices for few months now, more specifically I studied: lattice problems ($SVP$, $CVP$ and etc.) lattice cryptography in post ...
2
votes
0answers
39 views

Why is a LCG not suitable for use in a cryptographic primitive?

Two's complement addition (and multiplication) are non-linear with respect to XOR and AND. This means that for bit vectors over $\mathbb{Z}_2$, the operation $a + x$ cannot be expressed as the matrix ...
0
votes
1answer
40 views

PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)? Assuming an adversary ...
2
votes
0answers
58 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
0
votes
1answer
109 views

How are security proofs done in ABE Schemes?

I have been studying several ABE schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary. What ...
-1
votes
0answers
28 views

Can homomorphic encryption support the operation of exponentiation where both base and exponent are encrypted?

Does it exist some homomorphic encryption libraries or packages which can support the exponentiation where both base and exponent are encrypted? For example, $y = a^b$, where both $a$ and $b$ are ...
0
votes
1answer
75 views

How to decrypt an RSA ciphertext given an oracle providing the lower 8 bits of decryptions?

I have access to an oracle that can encrypt and partially decrypt a number with RSA-1024 algorithm. For encryption: \begin{equation} C = M^e\bmod n \end{equation} But for decryption, result will ...
1
vote
1answer
29 views

MICKEY 2.0: Mutual irregular clocking, register states

I'm trying to understand how MICKEY 2.0 works in detail. In [1], page 6, it says: ... the state of the generator does not repeat within the generation of a single keystream sequence ... What ...
0
votes
2answers
86 views

How do “modes of operation” with block ciphers like (eg) DES work?

When trying to understand how “modes of operation” are applied when using block ciphers like DES, I noticed I must be missing something. Maybe I simply misunderstood or mixed up things somewhere. ...
1
vote
1answer
23 views

Why am I getting a wrong output when implementing Feige-Fiat-Shamir ID protocol?

I am trying to implement the Feige-Fiat-Shamir identification protocol. I've read another posting here on this site and I tried to adapt - however the end results always fail to match. Maybe because ...
0
votes
0answers
23 views

Proof of Integrity in authenticated identity-based encryption

In authenticated ID-based encryption by Benn Lynn, in proof of integrity in section 4.3,Meaning of guess-ID? Why is it assumed that $L_{s}$ is empty, then $B$ fails? If guessed ID, why encryption ...
11
votes
1answer
154 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] \...
3
votes
2answers
145 views

MAC unforgeability and secret key guessing

The standard notion security for MACs is usually expressed by means of experiments like the following one (given an attacker A): $k \leftarrow \mathsf{KG}(1^\lambda)$ Invoke $A^{\mathsf{TAG}_k(\...
0
votes
0answers
32 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...
5
votes
2answers
622 views

What are some good examples of modifying crypto where flaws are not really obvious? [closed]

I run into some developers from time to time who sometimes try to modify crypto which I end up saying along the lines of "Don't modify crypto." Usually, the question I get is - "OK, tell me why is ...
3
votes
0answers
38 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
0
votes
1answer
44 views

AES Key Generation based on database guid

I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
0
votes
1answer
14 views

Decomposing a vector of random bits into constituent XORed vectores

Suppose I have N potential predefined, publicly known (pseudo?) random bit vectors: sequence 1: 1001000101010111001... sequence 2: 0100101011101010100... ... sequence n: 0101101010111010001... ...
2
votes
1answer
138 views

poodle padding multiple blocks?

I'm quite new to the topic and read a bit about poodle and padding oracle. I quite understand the "regular" padding oracle attack, substituting the last byte of block(n-1) to determine the last byte ...
195
votes
11answers
48k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
6
votes
1answer
83 views

Simulation-based proofs - advice tape of reduction algorithm

I am currently reading Yehuda Lindell's amazing tutorial on simulation proof technique and trying to write my own proof for the first time. In page 4 of this tutorial it is mentioned that [...] ...
10
votes
2answers
308 views

Why are zk-SNARKs possible, in layman's terms

zk-SNARK: Zero-Knowledge Succinct Non-interactive Argument of Knowledge From the Ethereum blog: One natural use case for the technology is in identity systems. For example, suppose that you want ...
6
votes
0answers
307 views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) $A \rightarrow B: r_A$ (...
-1
votes
1answer
77 views

Calculating $d$ in RSA?

I've looked in many places including here and can't get quite the answer... So I thought I'd post a question. I can't grasp how $d$ is calculated. Obviously the problem is that knowing $e$ and $n$ ...
6
votes
2answers
137 views

Are any of the practical implementations of ORAM being used in a real world system?

The concept of Oblivious RAM (ORAM) was first introduced by Oded Goldreich and Rafail Ostrovsky in 1996. However, in the past 5-10 years there has been a surge in the amount of research that looks ...
1
vote
1answer
36 views

Will the non-colluding servers communicate in IT-PIR schemes ?

The current literature around Information Theoretic Private Information Retrieval (IT-PIR) schemes assume the existence of multiple copies of the database distributed across non-colluding servers. ...
1
vote
1answer
98 views

Is it safer to use timestamp in REST authentication?

I am working on a personal project to build a REST authentication system which authenticate clients via three parameters: ...

15 30 50 per page