0
votes
1answer
40 views

PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)? Assuming an adversary ...
-1
votes
1answer
78 views

Calculating $d$ in RSA?

I've looked in many places including here and can't get quite the answer... So I thought I'd post a question. I can't grasp how $d$ is calculated. Obviously the problem is that knowing $e$ and $n$ ...
1
vote
1answer
48 views

AES Key Generation based on database guid

I am developing a .NET application spanning multiple servers who should all be able to decrypt data stored in a SQL database. My database is multi-company where each company has its own GUID. since ...
3
votes
1answer
39 views

Questions about SSL3 POODLE Bites

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
3
votes
1answer
46 views

SPDZ protocol: how expensive is it to generate the multiplicative triples?

I am currently reading the full version of the SPDZ protocol. I understand that the online phase does multiplication with computational and communication complexity $O(n)$ by using Beaver's ...
1
vote
1answer
27 views

Does Kasisky test for Vigenère cyphers assumption always hold?

In the notes from which I'm studying I read about Kasisky test: "Key observation: Two identical segments of $l ≤ L$ plaintext letters, will be encrypted to the same $l ≤ L$ ciphertext letters." ...
3
votes
2answers
121 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
1
vote
1answer
37 views

Will the non-colluding servers communicate in IT-PIR schemes ?

The current literature around Information Theoretic Private Information Retrieval (IT-PIR) schemes assume the existence of multiple copies of the database distributed across non-colluding servers. ...
1
vote
1answer
62 views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
3
votes
2answers
146 views

MAC unforgeability and secret key guessing

The standard notion security for MACs is usually expressed by means of experiments like the following one (given an attacker A): $k \leftarrow \mathsf{KG}(1^\lambda)$ Invoke $A^{\mathsf{TAG}_k(\...
6
votes
1answer
85 views

Simulation-based proofs - advice tape of reduction algorithm

I am currently reading Yehuda Lindell's amazing tutorial on simulation proof technique and trying to write my own proof for the first time. In page 4 of this tutorial it is mentioned that [...] ...
4
votes
0answers
44 views

How does Ring Learning with Errors work? [closed]

I read that Google want to integrate this into HTTPS because it is safe against quantum computers. However, the Wikipedia article might as well be written in Latin because it makes very little sense ...
0
votes
0answers
20 views

Secure algorithm for calculating token and comparison

I am trying to define algorithm that would create a irreversible token from IDs, which are 10 digit information, and then would be compared on two different end points. Between end points, only ...
1
vote
1answer
67 views

Plaintext for randomness evaluation of cryptographic algorithms?

I’m running an experiment to test the randomness output of many cryptographic algorithms based on INST test suite to measure the randomness of their outcome. However I’m searching to a sample data ...
0
votes
1answer
29 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
10
votes
2answers
313 views

Why are zk-SNARKs possible, in layman's terms

zk-SNARK: Zero-Knowledge Succinct Non-interactive Argument of Knowledge From the Ethereum blog: One natural use case for the technology is in identity systems. For example, suppose that you want ...
4
votes
2answers
74 views

Chance of finding the right key by exhaustively searching on half of the key space

An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. If the attacker finds the key, he knows the answer. If he doesn't find the key, he ...
0
votes
1answer
38 views

PBKDF2 with the same salt for all IDs

I have a unique identifiers that I would like to keep secure and provide information about it through tokens. These tokens should be verifiable after using the same algorithm on other end system with ...
4
votes
0answers
39 views

Cracking a PRNG by observing ranks within groups of its output

Suppose that I am generating random numbers with Python's random module, so that there is a known random number generator (Mersenne Twister in this case). I've ...
3
votes
1answer
53 views

How to glean info from a message that simply has the letters shuffled?

Suppose someone had published a several hundred page (sensitive) book, but had randomized all of the letters in an order known only to them (e.g. with a vector of random numbers of the same length as ...
0
votes
0answers
37 views

Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$ C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
1
vote
1answer
60 views

RSA key generation gives d=1

I was reviewing RSA by hand. I picked 53 and 59 as my primes. For e I picked 5. When I solved for d using extended euclid, I got 1 which obviously doesn't decrypt anything. I checked my answers online ...
1
vote
1answer
53 views

Can we use a sort of “hash” function in CTR mode instead of a block cipher? [duplicate]

CTR mode does not use the decryption function at all, only the encryption function. This may suggest that a different primitive that has this "one-way" property could do the trick. For instance, I ...
1
vote
0answers
31 views

Authenticating a range of a ciphertext

I have some data that I CTR-AES-256 encrypt already. I am aware of ways to validate the integrity of the entire file (ie: a separate MAC of the plaintext, or encrypt then MAC, etc). But none of ...
0
votes
0answers
15 views

PAN authenticatable irreversible tokenization algorithm

I need to implement algorithm to create authenticatable irreversible tokens from PAN, without using any secrets. Is it possible? Is there any standards for that from associations? I was thinking ...
6
votes
0answers
80 views

Are there any signatures based on matrix multiplication with noise?

Are there any signatures based on matrix multiplication with noise? Representing the message as a matrix and multiplying with some randomness coming from another matrix such that the signature itself ...
3
votes
1answer
52 views

Is there a problem in a PK cryptosystem if the plaintexts are very small compared to the ciphertexts?

I'm wondering, suppose we have a public key cryptosystem $P = (pk,sk)$ such that $$pk: \{0,1\}^n \to \{0,1\}^{n^2},$$ that is, the ciphertexts are $n$ times longer than the plaintexts (here, $n$ is ...
-3
votes
0answers
33 views

What does the encyption part of RSA entail?

As part of an assignment I have to encrypt and decrypt the following two block message (115, 209), using two primes (p = 17, q = 13). e = 5. I computed n to be 221 (17 * 13) and I confirmed that e ...
26
votes
1answer
6k views

How was the special DES key 0E329232EA6D0D73 found?

The DES key 0E329232EA6D0D73 has the unusual property that decrypting a ciphertext block consisting entirely of zeros gives a plaintext block consisting of eight repetitions of the same byte (0x87). ...
1
vote
0answers
25 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...
0
votes
2answers
76 views

Secret sharing scheme with ability to add or update share number

I would like to have a secret sharing scheme with the following properties: Generate secret $S$ a split it to $N$ shares $(s_1, s_2, ..., s_N)$ Require $k$ of $N$ shares in order to reconstruct ...
-1
votes
0answers
29 views

Finding Probability in simulation of identity-based encryption [duplicate]

I have found such kind of demonstration in security proof. I don't know concept of $\epsilon$ and why $\frac{1}{2}$. Moreover, why subtraction is done $$|Pr[B(P,aP,bP,cP,e(P,P)^{abc}=1]-Pr[B(P,aP,bP,...
0
votes
0answers
9 views

Error when decompress smime file [migrated]

I receive this file from my friend. I use command to decompress it: openssl cms -uncompress -in myfile.txt -out content.txt but there are error: ...
1
vote
1answer
29 views

RSA I2OSP & OS2IP in RSAPSS verification

I started working with RSA two weeks ago. But I coudn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algo. I am ...
4
votes
1answer
43 views

What are the differences between X9.31 RSA operation and PKCS#1 RSA operation?

NIST and other - mainly older - standards often don't just mention PKCS#1 RSA algorithms but also X9.31 RSA algorithms. What are the differences between X9.31 and PKCS#1 (v2.1) with regards to key ...
4
votes
2answers
426 views

Key recovery when AES ECB is used for short but repeated messages

My question is based on the specification of the protocol LoRaWAN and especially on the part 6.2.5 Join-accept message. It is said that the join-accept message is encrypted using AES ECB. This is (...
4
votes
0answers
42 views

Security proof in (Ciphertext-Policy) Attribute-Based Encryption

I am having hard time understanding the security proof in Attribute-Based Encryption, especially in Ciphertext-Policy Attribute-Based Encryption. To do reduction in CP-ABE scheme, how do I check that ...
0
votes
0answers
53 views

Why do openssl elliptic curve digital signatures differ by one byte [duplicate]

For some curves defined in Openssl 1.0.2h if I generate a key and generate a digital signature the size of the signature block changes by one byte. Why does this happen? My test file is, y.sh ...
6
votes
1answer
87 views

What does Shor's algorithm tell us about the complexity class of RSA and the DLP?

If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these ...
3
votes
3answers
109 views

DIY message level security?

This might be in danger of being too elementary a question for this community but I'm hoping for expert help: Assuming that TLS is not enough to protect messages transmitted between a client and a ...
0
votes
1answer
64 views

Multiplicative sharing of 1

Let R be a ring. Is there a known/standard way for N parties to perform some exchanges, such that at the end each party holds an element $r_i\in R^\ast$ and $r_1r_2\dots r_N=1$ (and each party $i$ ...
1
vote
2answers
57 views

How can I be sure the RNGCryptoServiceProvider is able to produce 12 bytes that can have 2^96 values?

I am writing code that needs to produce a truly random number of 96 bits. The requirements are: The code must be able to produce all $2^{96}$ values. The likelihood for any value to come up must be ...
3
votes
2answers
77 views

Are Paillier and El Gamal encryption schemes secure against quantum attacks?

I was wondering if there is a security difference between Lattice based homomorphic encryption schemes versus an partially homomorphic encryption scheme like Paillier, and El Gamal encryption schemes ...
3
votes
2answers
73 views

Proving a function is one way hash function

I am working on a project which computes the hash of the given input, I have to prove that the function is pre-image resistant that is given an output we cannot get back to the input. While proving ...
1
vote
2answers
416 views

How to obtain 256-bit security from Ed25519?

It is said that breaking Ed25519 has similar difficulty to breaking RSA with ~3000-bit keys" 1 When using RSA, I prefer 4096-bit keys, but I would like to use Ed25519. If I wanted to double the ...
4
votes
2answers
262 views

The main differences between Sketch of Proof and Full proof

My question in general is: Question 1: What are the differences between sketch of proof and full proof? In simulation-based proof, in semi-honest model, we construct a view that is computationally ...
-1
votes
3answers
113 views

Why is RSA decryption the inverse of encryption?

In RSA, to encrypt a message, the following formula is used: $$c=m^e\bmod n$$ For decryption, $$m = c^d\bmod n$$ is used. However, when I try to substitute the value of $c$ from the first into the ...
1
vote
2answers
50 views

Layman's description of the padding oracle attack

I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and ...
1
vote
2answers
236 views

RSA cipher: ambiguous or break by eth root?

Confused about RSA message cipher: $c = m^e (mod\ n)$ So if $m^e$ can be greater than n, then you can get duplicate ciphers for the same message. Most postings I've read say that $m^e$ must always ...
-2
votes
0answers
73 views

How to calculate ϕ(n) from n?

I'm trying to fully understand all the steps of the RSA algorithm. I have clear so far that: $n$ comes from the product of two numbers: $p$ and $q$ The public key consists of the pair ($e$, $n$) ...

15 30 50 per page