1
vote
1answer
49 views

Differences between OWP and OWF and their IND-CPA security

I am learning about one way permutations and one way functions and am not sure of the differences if there are any. Also in the random oracle model are they both IND-CPA secure?
1
vote
0answers
46 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme ...
1
vote
1answer
28 views

Would A5/1 with a much larger state be a good choice of stream cipher for hardware?

Would A5/1 with a much larger state be a good choice of stream cipher for hardware? Assume that a reasonable choice of MAC is made such as GMAC, with the first 128 bits of the stream cipher output ...
0
votes
1answer
49 views

Is AES-CTR or ChaCha20 vulnerable to a time-memory trade off?

Is AES-CTR or ChaCha20 vulnerable to a time-memory trade-off attack? According to this paper it seems to be, which would put AES-CTR at a clearly breakable $2^{64}$ security level (for AES-128-CTR). ...
0
votes
1answer
103 views

Two-party equality computation

Alice and Bob each secretly chooses an integer between 1 and 10, a and b. They want to know (with high probability) whether or ...
0
votes
1answer
31 views

Subscript R notation for the finite fields

I'm trying to understand the notation used in the literature for Pairing-based cryptography. I know (and I hope I've understood it well) from Wikipedia that $\mathbb{Z}_p$ is the finite field of ...
-1
votes
1answer
49 views

can pdfcrack software crack a 128 bit encrypted pdf file

One day ago,i downloaded a pdf that requires password then i search a software to decrypt the password that's s/w called pdfcrack Then i install pdfcrack and run a cmd in terminal pdfcrack -f ...
0
votes
1answer
28 views

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space?

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space? It the reason why this is not generally done because of a meet-in-the-middle attack?
3
votes
2answers
60 views

A bijective hash function

Suppose: $H: \{0,1\}^{n} \rightarrow \{0,1\}^{n}$. $H$ is bijective. It is difficult to derive $x$ from $H(x)$. Is this type of function possible? What would the strength of it be? I realize that ...
1
vote
1answer
25 views

Multiplexed stream cipher

Consider the stream cipher that consists of 3 LFSRs, with the output of one coming being used to determine which of the other 2 is used that clock cycle. Both the IV and the polynomials are secret. ...
3
votes
1answer
43 views

(How) Can we use HOTP for file encryption?

I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key. Now I trust the developer of this plug-in who is ...
1
vote
1answer
27 views

Encryption strength when using a PBKDF

Suppose: $m$ is a positive integer. $n=2 \times m$. $H: \{0,1\}^{*} \rightarrow \{0,1\}^n$. $p$ is a password. $s$ is a salt. $K=\{0,1\}^n$ is the derived key. $PBKDF(p,s)$ derives a key from $p$ ...
-3
votes
1answer
86 views

How to Perform Computation on AES Encrypted Data

I have this code that successfully performs symmetric encryption using AES algorithm. How can I go about performing computation on it to achieve somewhat homomorphic encryption? ...
3
votes
1answer
68 views

How to prove hardness of approximate-GCD problem?

I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker ...
3
votes
2answers
530 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
0
votes
1answer
36 views

Robust combination of two Password Based KDFs

I am researching some different constructions for combining two Password Based Key Derivation Functions in a robust manner to prevent weaknesses in a single algorithm from reducing the security of the ...
3
votes
1answer
35 views

Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data?

I want to know if AFsplit(random_data_input, stripes, digestmod=sha) output is indistinguishable from random data. The purpose ...
0
votes
2answers
48 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
8
votes
1answer
98 views

How do voters verify a Helios (v3) election result?

So from my understanding of verification specification version 3, a Helios election proceeds as follows: A voter retrieves the system's public key to encrypt their vote & submit it. The voter ...
0
votes
1answer
47 views

Is it possible to brute-force a hash algorithm of 32 bits

I have a 30000 user passwords and usernames stored in a table on a database in which the passwords are stored as hash where ,I need to guess the passwords for all users and I have the hash function ...
1
vote
1answer
27 views

How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
0
votes
1answer
48 views

Homomorphic Encryption or not

I am a beginner to homomorphic encryption scheme. As far as I think, it is just a kind of concealing real value without using standard encryption algorithms such as AES,DES or RSA. For example , for ...
1
vote
0answers
42 views

Format Preserving Encryption FF1 Samples

NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1 methods. I am confused by the value of R given in the examples. $R$ is the output ...
0
votes
2answers
59 views

SHA1 collision for first 32 bits for two different message

Is it possible to create a program to find the collision of 2 different message but with same first 32 bits using sha1 hashing? I tried using a while loop but it run endlessly as though no match is ...
2
votes
0answers
57 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
2
votes
1answer
110 views

Top notation as exponent

In cryptography, what does the Top notation mean? It resembles a capital T: T In particular, I saw it in the follwing context: $c = (c_1,c_2)^\top$ where $c_1$ and $c_2$ are homomorphic ciphertexts ...
3
votes
1answer
94 views

Time taken for a brute force attack on a key size of 64-bits

You can do $2^{30}$ encryptions per second and the key size is 64 bits. $2^{64}/2^{30}$ should give me the time taken for a brute force attack? What if you double the key size? How can I calculate ...
3
votes
0answers
61 views

How to attack polyalphabetic affine cipher with only ciphertext?

How to attack polyalphabetic affine cipher with only the ciphertext? A polyalphabetic affine cipher can be seen as the composition of an affine cipher ($p \mapsto c \equiv a \times p + b \pmod{26})$ ...
0
votes
2answers
75 views

What is necessary for generating an elliptic curve?

Let's say I want to generate my own elliptic curve with an order whose bit length is $n$ (specifically 2048, 4096, and/or 8192)? How would I do this? What needs to be done? What software can do this? ...
0
votes
0answers
10 views

Do eCryptfs encrypt same source files into same retulsing encrypted files?

Can I assume that for given eCryptfs mount, files with byte-by-byte same content will map into byte-by-byte same encrypted files in underlying filesystem (i.e. after umount) ? (i.e. if resulting ...
1
vote
0answers
29 views

WPA-PSK authentication without password [closed]

Suppose I have a service in which I allow users to share their WiFi connection. When sharing their connection, users provide their WPA PSK password to my service. Now if somebody wants to use this ...
0
votes
2answers
25 views

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so ...
5
votes
1answer
61 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
4
votes
1answer
57 views

Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
0
votes
1answer
52 views

How does Hash with random cryptography work?

I am new in this world of cryptography and while reading some articles I got stuck into something that I did not understand correctly: the use of hash based on random cryptography. On my knowledge, ...
1
vote
2answers
85 views

Is Threefish the only cipher with 1024 bits of security?

Threefish has up to a massive 1024 bits of security. Is it the only cipher with such overkill security?
5
votes
0answers
53 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
3
votes
0answers
61 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every ...
1
vote
1answer
48 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
2
votes
1answer
170 views

What is the meaning of IND-CCA secure under standard model? [duplicate]

I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
0
votes
0answers
27 views

Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
1
vote
0answers
32 views

Increase in security with increase in size of salt [duplicate]

Does increasing or doubling the size of salt result in improved security? It will require some extra time to brute force the passwords, but any added advantage?
3
votes
1answer
72 views

Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
6
votes
2answers
95 views

Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...
-2
votes
0answers
32 views

What is the definition of Selective Security?

What exactly is the definition of "selective security"? For instance, it is used in [KSW'13] (Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products), but is there a ...
0
votes
1answer
71 views

Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $ \in $ $Z^*_{N}$ is a "good" point for 'I', ...
3
votes
1answer
97 views

ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
1
vote
1answer
29 views

SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,

From Wikipedia I read SHA-1 function produces an output of 160 bits and expects a max message size of $2^{64}-1$ bits. Is that right? If I order all possible inputs I would produce $\approx ...
3
votes
0answers
38 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
3
votes
1answer
83 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...

15 30 50 per page