2
votes
1answer
55 views

Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says: The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are ...
-1
votes
0answers
28 views

Block Cipher vs PRP in CBC?

What is the difference between using a Block cipher and a Pseudorandom Permutation in Cipher Block Chaining mode, which is better?
1
vote
1answer
62 views

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.
0
votes
1answer
45 views

How are security proofs done in ABE Schemes?

I have been studying several ABE schemes and I understand the security assumptions and the several types of security models used for the security game between the Challenger and the Adversary. What ...
0
votes
0answers
53 views

Crack multiple One-Time-Pads with same key [duplicate]

I've got 12 pads, all with a length of 50 characters, except the last one. I also know, that the key has got a length of 50 and that the key has been re-used on all of the 12 pads. What do I have to ...
-2
votes
1answer
72 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte ...
2
votes
0answers
37 views

Can I serve data for user without the ability to access them? Which functions for the user remain?

My Problem I want to serve sesible data for users as a webservice that is accessed by the user via the browser. Restrictions: I may not be able to technically acces the data of the user Data is ...
3
votes
1answer
145 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
1
vote
1answer
31 views

Why does Carter-Wegman MAC have 2n-bit output?

The Coursera course on Cryptography 1 has a section about Carter-Wegman MAC. Here is the image of slide: Now my question is both $F$ and $S$ output $n$-bit strings. We XOR two $n$-bit strings and we ...
1
vote
1answer
39 views

How to increment the counter value for CTR mode?

I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.
0
votes
0answers
27 views

check user signed in group signature

I have $N$ users, all of them creating a group digital signature. Also I have user $A$. How can I check if user a signed or not signet in this signature? Is it possible ? Are there other methods how I ...
1
vote
0answers
33 views

How to break a Quagmire 3 cipher?

What would be a good way to go about attacking a Quagmire 3 cipher? I understand that it is polyalphabetic with a key and an indicator. I have started by taking the cipher text, taking every n-th ...
6
votes
2answers
62 views

How to test implementation of primality tests like Miller–Rabin?

The Miller-Rabin primality test is an algorithm for checking if number is a prime. What would be best way to test implementation of such algorithm (or any primality test in general)?
2
votes
0answers
38 views

Is this PRG secure?

$G$ is a safe PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$. Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$. Is $G'(S)$ a secure PRG? ...
-2
votes
1answer
21 views

How to find HEXA value of String [closed]

This may be very easy thing, but i am just unable to understand this. I have a string "Hi", and in HEXA its written like this ...
5
votes
1answer
26 views

What security checks do I need for SRP-6a?

I'm implementing an SRP-6a login system. What security checks do I need to do? Note that the modulus is sent to the client at algorithm startup. Here is the list I have so far. I'm using the ...
0
votes
0answers
11 views

Rotate values in predefined manner

I want to create a Server S1, that publish a different value every 10 minutes on the internet. The value looks something like f7826da6-4fa2-4e98-8024-bc5b71e0893e. ...
-3
votes
1answer
41 views

Binary fast exponentiation method

Evaluate $17^{93} \mod 23$ \begin{align}e &= 93\\ &= 1 × 2^6 + 0 × 2^5 + 1 × 2^4+ 1 × 2^3 + 1 × 2^2 + 0 × 2^1 + 1 × 2^0\\ &= |\ 1011101\ |_2 \end{align} Then we have: ...
0
votes
1answer
40 views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...
7
votes
2answers
65 views

Conditions for a successful Differential Power Analysis attack

From this paper, there are two conditions for a successful DPA attack: i) there exists an intermediate variable in the implementation that is correlated with the power consumption and ii) ...
1
vote
0answers
39 views

DTLS 1.2 Finished message

I am implementing DTLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. Below is my client finished message Can anyone explain this message? How many bytes for verify data? Is there ...
0
votes
0answers
30 views

How can Käsper and Schwabe's Bitsliced AES Mixcolumns work

The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed. ...
0
votes
1answer
15 views

DROWN - decrypting ServerVerify message is not enough?

I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again... When exploiting these flaws the attacker will send its ...
2
votes
2answers
67 views

TWO Fish MDS and PHT

Twofish was an AES candidate and it uses 4x4 Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula Branch Number = Minimum of [HammingWeight(Input) ...
1
vote
0answers
62 views

Simulation-Based Proof: When a Secret Key is Involved

Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key. We want to construct a simulator for this party (so this party ...
1
vote
1answer
41 views

Access control problem in oblivious transfer

I am not sure whether the title is proper or not, but this question comes to my mind when I was reading $k-n$ oblivious transfers. In a $k-n$ oblivious transfer (OT) protocol, a party A has $n$ ...
5
votes
0answers
47 views

Security of Fernet Construction

Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ...
2
votes
1answer
90 views

RSA Encryption problem for Discrete Math

I am doing practice problems for my upcoming final exam, and am having trouble with this RSA encryption problem. If any one could check to see if i did these correctly, it would be greatly ...
4
votes
1answer
63 views

ORAM over Third Party DB

Oblivious Ram (ORAM) is a cryptographic technique that is used for secure DB querying without leakage on the access patterns. There are several schemes for ORAM, amongst the most popular ones, there ...
1
vote
1answer
55 views

Safe MD5 digest

So I've heard that MD5 is broken because it's possible to engineer collisions. So instead we should use, say, SHA256. The problem which SHA256 digests is that they are long. So I've come up with this: ...
9
votes
1answer
182 views

State recovery of Micalli-Schnorr random number generator modulo a prime

Let $p$ be a public prime of $n$ bits. Define the sequence $x_i=z_{i-1}^e \bmod p$, where $z_i$ is the $k$ high-order bits of $x_i$, and $r_i$ the remaining $n-k$ bits of $x_i$ (thus ...
14
votes
2answers
1k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
1
vote
1answer
58 views

Does sending the same message with 2 different keys in OTP leak information?

Suppose a common message ($M$) is XOR'ed with two different keys $K_1,K_2$ producing two ciphertexts $C_1,C_2$. Thus, $$M \oplus K_1 = C_1\\ M \oplus K_2 = C_2$$ On observing $C_1$ and $C_2$, an ...
0
votes
0answers
31 views

Does revealing shares of the result reveals shares of the inputs?

Suppose Alive and Bob have shares of two polynomials $P,Q$, say, Alice knows $P_A,Q_A$, Bob knows $P_B,Q_B$ s.t. $P=P_A+P_B$ and $Q=Q_A+Q_B$. They perform some operation $f$ over the shared values, to ...
3
votes
1answer
82 views

Is Using Digital Signatures to prove identity a zero knowledge proof?

Suppose Alice publishes a book with a public key in it, and later wants to prove that she wrote the book. She could sign challenge messages with her private key, and others could verify those signed ...
3
votes
2answers
70 views

Can CMAC be used as a 128bit Key Derivation Function?

I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one. The logic looks something like this: ...
2
votes
1answer
55 views

How can I show RSA OAEP IND-CPA secure

How can I show, that RSA with OAEP is IND-CPA secure by using G,H one way function?
2
votes
1answer
98 views

How much weaker is AES-64 than AES-128?

It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ...
1
vote
0answers
16 views

finished message layout in TLS version 1.2 [duplicate]

Is there anyone that can explain what wrong with my understanding about 'finished message layout' in TLS version 1.2 ? I'm trying to implement it for my own purpose, upgrading host-to-host ...
0
votes
1answer
49 views

Given a hash function how to find all/some inputs that hash to 0? [duplicate]

Say I have a simple hash function where $x$ is a sequence of integers: $$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$ where $a_1,a_2,a_3,...,a_n$ is the coefficient ...
3
votes
1answer
36 views

Yao's Garbled circuit: Does Bob ever see the circuit?

I asked a question about whether the circuit structure for Yao's garbled circuit needs to be rearranged. I understand from Yehuda Lindell's response that the circuit structure itself does not need to ...
3
votes
1answer
33 views

What are the pros and cons of SIP media encryption types SRTP, ZRTP, and DTLS?

I'm just getting used to SIP for my first time using Linphone. Which encryption is better and why? My Settings > Network > Media Encryption has the options of SRTP, ZRTP, and DTLS.
1
vote
0answers
45 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
2
votes
1answer
54 views

How to find collisions in a hash function knowing its coefficent?

Say I have a simple hash function where $x$ is a sequence of integers: $$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$ where $a_1,a_2,a_3,...,a_n$ is the coefficient ...
2
votes
0answers
24 views

Proving CCA security for scheme constructed from secure PRP

We have a $PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$ and encryption scheme constructed from this $PRP$. $E_k(x\|r\|0^n)$, where $r$ is randomly chosen from $\{0,1\}^n$ and $0^n$ is a block of ...
0
votes
1answer
63 views

Diffie-Hellman: Calculating the private key from the public key with Java

I have the task to calculate the private key from the given public key and have the hint that the secret exponent lies in the range from $-2^{31} < e < 2^{31}$. To find the exponent I ...
0
votes
1answer
38 views

DROWN Attack - Which is the SSLv2 vulnerability exploited?

In order to get the session key used in TLS communication, an attacker must capture X TLS handshakes based on RSA key encryption, and switch to a server supporting SSLv2 protocol, and sharing the same ...
1
vote
1answer
53 views

Handshake SSLv2, SSLv3, TLS

Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)? If not, can you tell me the main differences between theses three ...
3
votes
2answers
80 views

Why are MACs not included when defining Protocols?

I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions. For example: ...
6
votes
1answer
86 views

Noise in Homomorphic encryption

What is the noise in homomorphic encryption schemes? (or where does the noise come from, I see that its inbuilt in the scheme and is not a side channel or disturbance noise) Is it also due to the ...

15 30 50 per page