0
votes
1answer
35 views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
3
votes
2answers
85 views

Meaning of entropy of a bitstring in NIST SP 800 - 90A

From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6: For the purposes of this Recommendation, an n-bit string is said to have ...
1
vote
1answer
40 views

Why does UMAC encrypt the output of universal hash function?

UMAC uses a key to choose a random hash function from a family of universal hash functions. The value of the hash function is always encrypted using yet another key, and the resulting ciphertext ...
0
votes
0answers
13 views

CMSS key sizes flexiprovider

I am study the implementation of the Coronado Merkle Signature Scheme using flexiprovider. I want to verify the Table 1 of its paper. Using the flexiprovider, I have written a example for ...
0
votes
0answers
30 views

secure multi party protocol for multiplication

I started to learn secure multiplication protocol with oblivious transfer. And i came up with this question, Design a secure 2-bit multiplication involving 4 parties? Can any one suggest an answer for ...
-1
votes
1answer
45 views

Safe way to generate different encrypted output from the “same” plaintext

Imagine I want to send imaginary defcon levels to another party over the internet. I know there are good protocols for this like SSL, but lets say I only have a blackbox tool where I can input an AES ...
0
votes
1answer
29 views

Distinguishing between two probabilities and the uniform probability

Say I have a polynomial adversary $A$ that can distinguish with a non-negligible adventage between $x$ generated from a probability $X$ and $y$ generated from a probability $Y$. Obviously, this ...
1
vote
1answer
25 views

On countermeasures for replay attacks. Does this one require plaint text password storage?

I was reading this wiki section on the countermeasures against replay attacks and it basically suggests that: If Bob wants to confirm Alice's identity he can send a one-time token (I think it should ...
0
votes
0answers
48 views

Convolution and catastrophic codes

i'm reading the article of Massey and Sain (here) and i cannot unserstand - what is "foreforward inversion"? I mean There is a description of circles in convolutional codes and a little bit ...
1
vote
1answer
69 views

Is there a scheme that allows to use RSA based challenge response protocol limited to signing only 8 bytes to create a secure signature of any data?

I have a tiny device that has a challenge-response authentication mechanism where the device signs 8 bytes of any data with it's internal 2048 bit RSA key. I would like to be able to certify any data ...
1
vote
2answers
40 views

Definition of indistinguishable schemes

Let $\mathsf{Exp}_{A,\Pi}(\lambda)$ be some indistinguishability experiment that finally outputs 1 if A outputs $b'$ that satisfies $b' = b$, otherwise 0. Then the textbooks often define the security ...
3
votes
1answer
87 views

Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?

Let $G$ be a cyclic multiplicative group of order $n$. Let $g$ be a (public) generator of $G$. The Diffie-Hellman (DH) problem asks: Given $g^x, g^y\in G$ for $x, y\in \mathbb{Z}^*_n$, to compute ...
0
votes
1answer
78 views

Encryption of exe file

I recently started learning cryptography. I have learned some basic stuff. I'm also started learning about pc security, so I was wondering how do hackers use cryptography for bypassing antivirus ...
0
votes
1answer
61 views

RSA private key d knowing e,n

I need to find RSA private key $(d, N)$ knowing $(e, N)$. It's "own" RSA implementation. As i know $p$ is random 70 bit number, then $q$ is $p-2^{10} < q < p+2^{10}$ $d$ is max 16 bit long with ...
1
vote
1answer
36 views

Deriving 2 shared secrets from one private key and 2 different public keys

I have a key pair, say $(d, Q)$. I send my public key $Q$ to 2 different people. I also get their public keys $Q_1$ and $Q_2$. Now I can derive 2 shared secrets, $d*Q_1$ and $d*Q_2$. The 2 other ...
0
votes
2answers
117 views

Why are RSA ciphertexts different for the same plaintext?

I am using SpongyCastle for a project in android. I have used RSA to encrypt the data and then decrypt it in another activity, the keys are stored in the shared preferences. I discovered a thing I ...
0
votes
0answers
31 views

Cryptanalysis and Copying encrypted volumes

I just recently concerned myself with cryptography due to Snowden's revelations and there are a few things I cannot really wrap my head around but maybe you can help me with that. I am not a ...
0
votes
0answers
29 views

Join Datasets While Protecting Anonymity

I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world). Suppose I sell computers, and I ...
0
votes
0answers
17 views

How to prove the hardness of Rabin's function?

I am unable to prove the following theorem: If for a $1/(\log(n))$ fraction of the quadratic residues $q\pmod n$ one could find a square root of $q$, then one could factor $n$ in random polynomial ...
0
votes
0answers
60 views

Can a combination of encryption algorithms weaken the overall encryption?

Are there any instances where a combination of industry standard encryption algorithms can weaken the overall encryption of the data? As a Naive example using non-standard encryption algorithms, ...
0
votes
2answers
52 views

How is an epsilon of 1/1000 non-negligible?

Lately I've been studying cryptography and in the current course I'm taking we're reviewing statistical tests and how they can be used to determine if a pseudo-random generator is secure or not. ...
2
votes
3answers
664 views

Is DES slow in hardware or only in software?

I have been reading that DES is slow. Is it only slow in software or slow overall? Also, as far as Triple DES being slow is concerned, is double AES with two 128 bit keys slower than single AES with ...
0
votes
2answers
122 views

simple algorithm to encrypt/decrypt a text file

I need to write a first program in one language that saves data in a text file, and write a second program in a second language to decrypt that file. The two languages in question don't include any ...
1
vote
1answer
65 views

What's the principle to design the functionality under UC framework?

Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
0
votes
1answer
18 views

Blinding value of particular form

I'm working with an implementation that creates a blinding value for RW signatures with the following C++ code: ...
1
vote
1answer
39 views

sha256_hmac for session keys using a counter

I need to generate some session keys from a master key that was generated from an ECDH key exchange. The master key is 256 bits and I need 256 bit sessions keys. Is it safe to use SHA256_HMAC with ...
1
vote
1answer
67 views

Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper on ...
0
votes
0answers
7 views

RPC Service Authentication using Server and Client Nonce [migrated]

Forgive my ignorance, security is not my field. I have a RPC server where the server keeps a protected file containing user names and corresponding passwords. I would like to securely authenticate ...
-1
votes
0answers
26 views

How to calculate 16x16 SBox and InvSBox in AES Encryption?

As far as I know, $GF(2^8)$ and its multiplicative inverse are used to generate the 16×16 SBox and InvSBox in AES Encryption [or maybe I am wrong]. Can anyone please explain me how to generate this? ...
2
votes
1answer
61 views

Is “Bit Independence” of SHA-2 hashes secure?

I know bit independence is good in SHA2 function output, but is it truly 100% secure? For example: Y = SHA512(secretKeyNonce256bit) A = first 32ytes / 256bits of Y, used as message encryption key B ...
0
votes
1answer
26 views

What is the proper usage of GCM nonce in TLS1.2?

I have written a program with the help of the bouncy castle for C# library. I am monitoring the traffic which is send between the client and the server and found something (i find) strange. The ...
3
votes
0answers
67 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
0
votes
1answer
53 views
1
vote
1answer
23 views

Why does P1363 require RW signature with $0 ≤ s < n/2$?

I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs. P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45: ...
1
vote
1answer
42 views

How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?

Assume that $h:\{0,1\}^* \rightarrow \{0,1\}^\lambda$ is a cryptologic hash function, $r$ is taken randomly from $\{0,1\}^\lambda$, $p$ is a low-entropy password and $p^*$ is a guess. Now we get ...
2
votes
0answers
22 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
0
votes
0answers
31 views

Understanding the PRINCE cipher linear layer

I am struggling to understand how to implement the PRINCE cipher linear layer. (https://eprint.iacr.org/2012/529.pdf) From my understanding I need to multiply the state with M, and with M' in between ...
0
votes
1answer
58 views

Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group?

I'm working on a zero knowledge proof system that uses ECC over $\mathbb{Z}_p$ (currently using NIST P-256 since mbed TLS doesn't support group operations on Curve25519, but the problem should be ...
0
votes
1answer
45 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
0
votes
0answers
35 views

How to find an impossible differential?

Given an arbitrary SPN-based cipher with X rounds. How to find an impossible differential for this cipher? What are strategies to find one?
0
votes
0answers
45 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
0
votes
0answers
45 views

Vigenère cipher frequency analysis not working

I'm writing a C++ program to use the Kasiski method to crack the Vigenère cipher. I'm testing it with a bit of Shakespeare encrypted with the key ABCDEFGHIJKL. It ...
5
votes
1answer
109 views

Secret key and Decryption oracle in the revised Fujisaki-Okamoto transformation

Recently, Fujisaki and Okamoto provided a revised version of the Fujisaki-Okamoto transformation [1], a generic transformation for achieving IND-CCA2 security in the Random Oracle model. This new ...
1
vote
1answer
42 views

Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
3
votes
1answer
105 views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
2
votes
2answers
87 views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
0
votes
0answers
54 views

Is there any real practical group signature scheme deployed?

Groups signatures are a crypto primitive introduced in order to guarantee anonymity on signatures constructed by a group of people. Since there introduction and there exhaustive security requirements ...
0
votes
1answer
43 views

Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. [closed]

I'm in the process of converting a Python program I found for calculating ECDSA public keypairs from a given private key. In this particular case it's on the Bitcoin curve. ...
-1
votes
3answers
67 views

Some doubts about GnuPG

I've reading on GPG since yesterday and I have a doubt: the whole system of double key encryption does make sense but it looks to me like either way you are compromising something in terms of ...
0
votes
1answer
36 views

Physical entropy source: How many bits entropy per byte is sufficent?

8 bit / byte would be perfect obviously. head -c 1M /dev/urandom | ent gives ~ 7.9998 bits per byte. Now, if I have a physical entropy source, how much entropy ...

15 30 50 per page