3
votes
2answers
66 views

Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
0
votes
1answer
46 views

Is this ECDHE approach secure?

First of all sorry if this question could be trivial, but I did some researches and it seems to me that this is a standard approach, but I want to be really sure. I'm developing a signed/encrypted ...
1
vote
2answers
52 views

substitution Box(s-box) for AES

can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes?for example ; if i have 100 different s-boxes. i want to pick any one which is secured ...
0
votes
1answer
28 views

XOR and bilinear form property

I know that $XOR$ is equivalent to modular addition in the field $\mathbb{F}_2 = \{0,1\}$ (is it right?), and thus should satisfy the following property of a bilinear form: $$\oplus(u+v,w) = \oplus(u,...
2
votes
0answers
39 views

Why is a LCG not suitable for use in a cryptographic primitive?

Two's complement addition (and multiplication) are non-linear with respect to XOR and AND. This means that for bit vectors over $\mathbb{Z}_2$, the operation $a + x$ cannot be expressed as the matrix ...
25
votes
2answers
3k views

In which cases should the IV be kept secret?

When must an IV be kept secret? There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places. Does this ambiguity suggest that there are, in fact, ...
2
votes
0answers
64 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
5
votes
2answers
92 views

Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
-1
votes
0answers
29 views

Can homomorphic encryption support the operation of exponentiation where both base and exponent are encrypted?

Does it exist some homomorphic encryption libraries or packages which can support the exponentiation where both base and exponent are encrypted? For example, $y = a^b$, where both $a$ and $b$ are ...
3
votes
2answers
89 views

Malleable encryption

What I would like to achieve is the following: Alice sends to Bob the encryption of a datagram that has the following format: ...
7
votes
6answers
2k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more

When an entity A wants to send a message to entity B, he can attach a MAC to the message. Entity B on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
1
vote
1answer
23 views

Why am I getting a wrong output when implementing Feige-Fiat-Shamir ID protocol?

I am trying to implement the Feige-Fiat-Shamir identification protocol. I've read another posting here on this site and I tried to adapt - however the end results always fail to match. Maybe because ...
1
vote
1answer
29 views

MICKEY 2.0: Mutual irregular clocking, register states

I'm trying to understand how MICKEY 2.0 works in detail. In [1], page 6, it says: ... the state of the generator does not repeat within the generation of a single keystream sequence ... What ...
0
votes
0answers
23 views

Proof of Integrity in authenticated identity-based encryption

In authenticated ID-based encryption by Benn Lynn, in proof of integrity in section 4.3,Meaning of guess-ID? Why is it assumed that $L_{s}$ is empty, then $B$ fails? If guessed ID, why encryption ...
0
votes
0answers
32 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...
3
votes
0answers
40 views

In NTRU, if $N$ is not prime, prove that one can recover the private key by solving a lattice problem in dimension lower than $2N$

In the NTRU cryptosystem, it is suggested to take $N$ prime. I want to understand why. In Jeffrey Hoffstein, Jill Pipher and H. Silverman An Introduction to Mathematical Cryptography, they suggest (...
5
votes
2answers
624 views

What are some good examples of modifying crypto where flaws are not really obvious? [closed]

I run into some developers from time to time who sometimes try to modify crypto which I end up saying along the lines of "Don't modify crypto." Usually, the question I get is - "OK, tell me why is ...
0
votes
1answer
14 views

Decomposing a vector of random bits into constituent XORed vectores

Suppose I have N potential predefined, publicly known (pseudo?) random bit vectors: sequence 1: 1001000101010111001... sequence 2: 0100101011101010100... ... sequence n: 0101101010111010001... ...
2
votes
0answers
47 views

Proof of IND-q-CCA security

I have some questions about the paper Bounded CCA2-Secure Encryption (pdf). On page eight "3.2 Construction", the authors have done a black-box construction of an IND-q-CCA security schema and then ...
0
votes
1answer
40 views

PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)? Assuming an adversary ...
-1
votes
1answer
78 views

Calculating $d$ in RSA?

I've looked in many places including here and can't get quite the answer... So I thought I'd post a question. I can't grasp how $d$ is calculated. Obviously the problem is that knowing $e$ and $n$ ...
1
vote
1answer
51 views

AES Key Generation based on database guid

I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
3
votes
1answer
45 views

Questions about SSL3 POODLE Bites

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
3
votes
1answer
46 views

SPDZ protocol: how expensive is it to generate the multiplicative triples?

I am currently reading the full version of the SPDZ protocol. I understand that the online phase does multiplication with computational and communication complexity $O(n)$ by using Beaver's ...
1
vote
1answer
27 views

Does Kasisky test for Vigenère cyphers assumption always hold?

In the notes from which I'm studying I read about Kasisky test: "Key observation: Two identical segments of $l ≤ L$ plaintext letters, will be encrypted to the same $l ≤ L$ ciphertext letters." ...
3
votes
2answers
121 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
1
vote
1answer
37 views

Will the non-colluding servers communicate in IT-PIR schemes ?

The current literature around Information Theoretic Private Information Retrieval (IT-PIR) schemes assume the existence of multiple copies of the database distributed across non-colluding servers. ...
1
vote
1answer
64 views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
3
votes
2answers
146 views

MAC unforgeability and secret key guessing

The standard notion security for MACs is usually expressed by means of experiments like the following one (given an attacker A): $k \leftarrow \mathsf{KG}(1^\lambda)$ Invoke $A^{\mathsf{TAG}_k(\...
6
votes
1answer
85 views

Simulation-based proofs - advice tape of reduction algorithm

I am currently reading Yehuda Lindell's amazing tutorial on simulation proof technique and trying to write my own proof for the first time. In page 4 of this tutorial it is mentioned that [...] ...
4
votes
0answers
45 views

How does Ring Learning with Errors work? [closed]

I read that Google want to integrate this into HTTPS because it is safe against quantum computers. However, the Wikipedia article might as well be written in Latin because it makes very little sense ...
0
votes
0answers
21 views

Secure algorithm for calculating token and comparison

I am trying to define algorithm that would create a irreversible token from IDs, which are 10 digit information, and then would be compared on two different end points. Between end points, only ...
1
vote
1answer
67 views

Plaintext for randomness evaluation of cryptographic algorithms?

I’m running an experiment to test the randomness output of many cryptographic algorithms based on INST test suite to measure the randomness of their outcome. However I’m searching to a sample data ...
0
votes
1answer
30 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
10
votes
2answers
318 views

Why are zk-SNARKs possible, in layman's terms

zk-SNARK: Zero-Knowledge Succinct Non-interactive Argument of Knowledge From the Ethereum blog: One natural use case for the technology is in identity systems. For example, suppose that you want ...
4
votes
2answers
74 views

Chance of finding the right key by exhaustively searching on half of the key space

An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. If the attacker finds the key, he knows the answer. If he doesn't find the key, he ...
0
votes
1answer
38 views

PBKDF2 with the same salt for all IDs

I have a unique identifiers that I would like to keep secure and provide information about it through tokens. These tokens should be verifiable after using the same algorithm on other end system with ...
4
votes
0answers
39 views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
3
votes
1answer
53 views

How to glean info from a message that simply has the letters shuffled?

Suppose someone had published a several hundred page (sensitive) book, but had randomized all of the letters in an order known only to them (e.g. with a vector of random numbers of the same length as ...
0
votes
0answers
37 views

Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$ C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
1
vote
1answer
60 views

RSA key generation gives d=1

I was reviewing RSA by hand. I picked 53 and 59 as my primes. For e I picked 5. When I solved for d using extended euclid, I got 1 which obviously doesn't decrypt anything. I checked my answers online ...
1
vote
1answer
53 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
1
vote
0answers
32 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
0
votes
0answers
15 views

PAN authenticatable irreversible tokenization algorithm

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets. Is it possible? Is there any standards for that from associations? I was thinking ...
6
votes
0answers
81 views

Are there any signatures based on matrix multiplication with noise?

Are there any signatures based on matrix multiplication with noise? Representing the message as a matrix and multiplying with some randomness coming from another matrix such that the signature itself ...
3
votes
1answer
52 views

Is there a problem in a PK cryptosystem if the plaintexts are very small compared to the ciphertexts?

I'm wondering, suppose we have a public key cryptosystem $P = (pk,sk)$ such that $$pk: \{0,1\}^n \to \{0,1\}^{n^2},$$ that is, the ciphertexts are $n$ times longer than the plaintexts (here, $n$ is ...
-3
votes
0answers
33 views

What does the encyption part of RSA entail?

As part of an assignment I have to encrypt and decrypt the following two block message (115, 209), using two primes (p = 17, q = 13). e = 5. I computed n to be 221 (17 * 13) and I confirmed that e ...
26
votes
1answer
6k views

How was the special DES key 0E329232EA6D0D73 found?

The DES key 0E329232EA6D0D73 has the unusual property that decrypting a ciphertext block consisting entirely of zeros gives a plaintext block consisting of eight repetitions of the same byte (0x87). ...
1
vote
0answers
25 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...
0
votes
2answers
76 views

Secret sharing scheme with ability to add or update share number

I would like to have a secret sharing scheme with the following properties: Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$ Require $k$ of $N$ shares in order to reconstruct ...

15 30 50 per page