3
votes
0answers
58 views

Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
3
votes
0answers
165 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
3
votes
0answers
87 views

Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking). Specifically this scheme: If you look at the ...
3
votes
0answers
108 views

Hi Sec National algorithm

I'm trying to create a remote controller compatible with HiSec algorithm. It's so old that National (now Texas Instruments) discontinued NM95HS01/02 and docs are unavailable. Does anyone have the ...
3
votes
0answers
246 views

Logics for Cryptographic Information Games

Preamble: There is currently a zoo of various logics for evaluating (proving) security in cryptographic protocols. The idea is that, by expressing these protocols using some logic, you can create a ...
3
votes
0answers
85 views

Could BREACH be used to determine an HTTPS URL?

I was reading this article and had a question.... http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/ As I understand it TLS/SSL work in ...
3
votes
0answers
166 views

Security of a 3-party key exchange protocol

I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server. We have the following roles: ...
3
votes
0answers
139 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
3
votes
0answers
118 views

Question about proof of knowledge defintion?

I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...
3
votes
0answers
268 views

One-time pad and perfect secrecy properties

I have a homework problem: Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$ where P is probability and k is chosen uniformly. I do not know ...
3
votes
0answers
68 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
3
votes
0answers
380 views

RSA reencryption scheme

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user? Basically, such an algorithm would probably be ...
2
votes
0answers
59 views

How to prove that a function F isn't a pseudo random function

Let $F$ be a length-preserving pseudorandom function. For the following constructions of a keyed function $F' : \{0, 1\}^n \times \{0, 1\}^{n−1} \to \{0, 1\}^{2n}$, state whether $F'$ is a ...
2
votes
0answers
54 views

Q: Relevance of physical layer security to cryptography

I found that there are quite some active research activities in a field named "physical layer security", with in particular some types of codes that apparently are different from those commonly ...
2
votes
0answers
38 views

Example of Projective Coordinates

Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right? ...
2
votes
0answers
20 views

What is the canonical way of creating merkle tree branches?

I'm currently looking into creating some compact merkle tree branches to prove that a given hash was included in a given merkle root. My initial thought was to list the leaf, the merkle root and all ...
2
votes
0answers
35 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
2
votes
0answers
38 views

Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)

Given an encryption system where $c\equiv m^x \pmod p$, $p$ is a known prime, 1. Is it possible to recover $x$ with a known plaintext attack? Given $(p,\text{factorization of }\varphi(p),m,c)$ 2. Is ...
2
votes
0answers
21 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
2
votes
0answers
19 views

TPM specification physical presence requirements

I am looking at TPM Main-Part 1 Design Principles_v1.2_rev116_01032011 and on page 69 of pdf, equivalent to page 57 of the document itself,there is comment on physical presence as follows: "Observe, ...
2
votes
0answers
21 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key ...
2
votes
0answers
60 views

Zero Knowledge Argument for Subset Sum

What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem? The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift ...
2
votes
0answers
46 views

Cyclic group collision resistant keyed cryptographic hash function

I am self-studying cryptography from a book and have come across a really difficult question that's doing my head in. I would be very grateful if somebody can help me out here with this difficult ...
2
votes
0answers
17 views

802.1X Radius WLAN protected by certificate 1024-bit key

I want to ask you a question. I have WPA-2 (enterprise) network. Also called as 802.1x. I use the Linux Zeroshell distribution, which is optimized for these services. Linux Zeroshell is provides a ...
2
votes
0answers
33 views

authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
2
votes
0answers
59 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
2
votes
0answers
25 views

Lightweight Algorithm

If I design a lightweight algorithm, How do I calculate gate equivalents (GE) in lightweight algorithm? and what are the parameters of the algorithm was called "Lightweight"??
2
votes
0answers
26 views

Differential Cryptanalysis

How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ...
2
votes
0answers
48 views

Applying Vigenere on small strings with sorting capability

I am new to cryptography and have a question about a use of Vigenere cipher in the case of small strings. I'd like to encrypt keywords that are smaller than 10 characters. If I use Vigenere ...
2
votes
0answers
32 views

How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

Gen generates Pk and Sk (l bits each), Enc encrypts m (length l) but by bit using each bit of Pk respectively, Dec decrypts ciphertext bit by bit using each bit of Sk respectively. How do I prove this ...
2
votes
0answers
53 views

Cryptographic operations for NISTP256 can be implemented using montgomery method?

I need to implement cryptographic operations starting with the curve NISTP256. I have been told to implement it using Montgomery method. I read a pfd from ...
2
votes
0answers
25 views

Edwards / Montgomery ECC over binary extension fields

I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary ...
2
votes
0answers
14 views

What's the perfect chain length : number of chains ratio for rainbow tables?

I'm building a SHA-1 rainbow table to crack basic passwords (i.e. up to 10 character, 0-9,a-z). But I can't seem to calculate that golden ratio that would give me the most coverage. Also is there ...
2
votes
0answers
22 views

Are there any real-world E-voting systems in use with the Paillier cryptosystem?

There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?
2
votes
0answers
33 views

Are there any FHE-MPC schemes implemented?

I want to know if there are any publicly available multiparty computation schemes derived from fully homomorphic encryption schemes. An example would be the implementation of this scheme ...
2
votes
0answers
45 views

on broadcast encryption

I've read the following paper and have one question on it. M. Luby and J. Staddon, "Combinatorial Bounds for Broadcast Encryption", EUROCRYPT'98. On page 523 (12th page of the paper) the authors say ...
2
votes
0answers
53 views

Calculating Phi(M) and D for RSA decryption given p,q,e

I've been given a message in 4 digit numbers but it doesn't seem to work when I use my calculated values for phi(m) and d. If I'm correct phi(m) = (p-1)(q-1) correct? And d is given by ed = ...
2
votes
0answers
57 views

Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
2
votes
0answers
30 views

PathORAM with read path eviction

I am currently trying to implement the pathORAM algorithm as describe in this paper: https://eprint.iacr.org/2013/280.pdf The paper states that with high probability, the stash size will be bounded ...
2
votes
0answers
56 views

Why is SSL/TLS so complicated?

I'm new to SSL/TLS and I'm staring as a new security researcher. It appears to me that SSL/TLS protocol is needlessly complex for arriving at a shared secret. The complexity results in so many bugs ...
2
votes
0answers
56 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = ...
2
votes
0answers
50 views

Usefulness of ability to calculate $m^{p+q}$ with RSA

I noticed that with only an RSA public key, it is possible/tractable to calculate $m^{p+q} \pmod n$ for any $m$ without knowing $p$ or $q$. Namely, $m^{p+q} \equiv m^{n+1} \pmod n$. (This follows ...
2
votes
0answers
34 views

Can I expand the modular of an encryption scheme?

Take the lifted ElGamal as an example: suppose the original ciphertext is $<g^y ~mod~q,~g^m~mod~q>$. After some calculations, $m$ could be large enough to do modular. But I don't want $m$ to be ...
2
votes
0answers
40 views

Signing integers and UUIDs and restoring them from a third party server without tampering

I'm educating myself about cryptography. I know this is a long one, but please, bear with me. :) Now I have a scenario in my mind and I'd like to ask if what I've thought is sound (enough), what more ...
2
votes
0answers
44 views

Discrete logarithms: large prime modulus vs. large semi prime modulus

I have a cryptography homework question, in the question it says a cryptographic hash function in the form of $f(x) = g^x \bmod n$ , where $n$ is a very large prime (1024bits and more), $g$ is a ...
2
votes
0answers
48 views

How does Intel TXT prevent spoofing of PCR values?

I have read some content on trusted execution environment, and I like to ask exactly how it improves hashing. What I read at Wikipedia’s “Trusted Execution Technology” article states: ...PCRs) ...
2
votes
0answers
66 views

How can I multiply an additively homomorphic encrypted value by a float number?

As we all know, if $E()$ is an additively homomorphic encryption, we can multiply $E(a)$ by an integer $b$, then we will get $E(ab)$. But what if $a$ is a float number? Can we still get $E(ab)$? Which ...
2
votes
0answers
42 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
2
votes
0answers
33 views

Hiding the identity of a party within the Kerberos authentication scheme

In the Kerberos authentication protocol, as described here: would it be safer to replace step (1) with: $$ A \rightarrow T : A, E_{K_A{_{T}}}(B, N_A) $$ so that a passive adversary does not know ...
2
votes
0answers
46 views

can pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...

15 30 50 per page