# All Questions

77 views

### What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
38 views

### Determine safety of exercise hash functions

There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$. Professor A suggests a new function $h_{666}$ with an output length of 666 bits. Professor B suggests ...
58 views

### Worst case one way function

the worst-case one way function is defined as follows $$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$ can you give any example of such function?
36 views

### What is the general idea of truncated differential attack on hash functions?

What is the general idea of truncated differential attack on hash functions ? i'm using stream cipher and sponge hash construction and i want to know what is the general idea of differential attack ...
28 views

### Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
65 views

### Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
80 views

### Is there a mental poker algorithm that does not rely on commutative encryption?

The algorithm for mental poker that I saw on Wikipedia and everywhere else relies on an encryption algorithm such that $E_k(E_j(P)) = E_j(E_k(P))$, but I can't find a modern and secure algorithm for ...
82 views

### DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
53 views

### Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
42 views

### Proposed unidirectional authentication scheme

I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ...
70 views

### SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ...
81 views

### Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
63 views

### Energy necessary for brute-forcing or decryption

I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it. ...
211 views

### Is chaotic encryption secure?

I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) ...
84 views

### Pseudorandom Function Proof

Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: ...
39 views

### During electronic voting, how does one hide the choice from Voting device?

Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially ...
128 views

### How to calculate the non-linearity of an s-box?

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
81 views

### Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 v2.20 section 12.1.6 PKCS #1 v1.5 RSA is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 signature of data hashed externally to a ...
70 views

### Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
90 views

### Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
111 views

### Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
69 views

### Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
51 views

### How exactly is the output of the XOR step in PBKDF2 used?

I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ...
94 views

### Are all binary-additive stream ciphers reciprocal?

I'm writing a thesis focused on Maurer's provably-secure stream cipher. Long story short, this cipher works by expanding a short key into a long keystream and then XORring this keystream with the ...
235 views

### Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
98 views

### Does the SSH protocol preserve integrity if an endpoint is cloned?

I am trying to find out if the SSH protocol preserves integrity of the transferred data in the following scenario: The SSH client is running on a virtual machine, at some point in the middle of the ...
154 views

### As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
76 views

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ... 0answers 99 views ### Timing Attack on OpenSSL by Brumley I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ... 0answers 98 views ### Multi-round Transposition/Playfair as a secure hand cipher in the computer age Given that computers can be easily compromised, there is a need for a hand cipher that can withstand computer attack. Clearly the traditional hand ciphers fail. One time pads work. They also have ... 0answers 89 views ### Using same key for encryption and ECBC-MAC k2 ECBC-MAC:$E_{k_2}(CBC-MAC_{k_1}(m))$If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure? 0answers 55 views ### online Vickrey auction using remote coin flip Is there any published work on implementing a online auction, which uses "remote coin flip" to prevent auctioneer cheating when choosing winner and bid value? Is there any possible way to use remote ... 0answers 116 views ### How to compute the decompositions used in fast FHE bootstrapping? Leo Ducas and Daniele Micciancio's recent paper "FHE Bootstrapping in less than a second" gave an exciting result that one can compute the `atom operation' of Fully Homomorphic Encryption (i.e. ... 0answers 66 views ### Bridging the gap between security proofs and “real-world” security I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ... 0answers 179 views ### Encrypted database: how to deal with general queries? My question is quite related to the concept of homomorphic encryption, which is not practical at all nowadays. In short, I would like to know how to query encrypted databases. Simple queries which ... 0answers 100 views ### See any problems with this search-specific homomorphic encoding strategy? I'm imagining this for use in the scenario of cloud-stored client-encrypted email, where, when seeking to do a string search across messages, you don't want to have to download every stored message in ... 0answers 494 views ### Understanding the FMS attack on WEP I am trying to implement the Fluhrer, Mantin and Shamir attack, one of the ways to break WEP. I seem to have hit on a problem. I have no idea whether or not it is a programming error, or if I don't ... 0answers 92 views ### Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks? As the question suggests, I wanted to get a sanity-check on this issue... is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay ... 0answers 69 views ### Cracking an appliance's network protocol I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ... 0answers 46 views ### ECIES: Purpose of optional shared information? According to Wikipedia the ECIES algorithm has two optional shared information$S_1$and$S_2$. They are used as follows: Generate a random shared secret$Z$according to ECIES, which will never be ... 0answers 88 views ### What does Set Membership actually prove? While going through this paper, I came across the idea of Set Membership proofs. The proof allows a prover to prove that a value is contained in some set. The point where I am confused is, all the ... 0answers 81 views ### Implementation Attacks on Hashes So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions ... 0answers 132 views ### Hardware Implementation of Pairing over BN curves I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ... 0answers 290 views ### Challenge-response based on public-key decryption, why send public key Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol:$A \leftarrow B: h(r), B, P_A(r,B)$... 0answers 72 views ### Where is the OID and ASN.1 specified for AES_CMAC? I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ... 0answers 97 views ### Protocol: Coin Flipping over phone Protocol: Coin Flipping over telephone Hypothesis: Alice and Bob have agreed: a one to one function$f$which is easy to compute$f(x)$from$x$and while given any value$f(x)$it is nearly ... 0answers 43 views ### Malicious KGC attack in the identity-based authenticated key exchange protocol There are two users$A$and$B$who are in different domain. Let's assume that$A\in KGC_1$and$B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ... 0answers 73 views ### Type 2 to Type 1 pairing transformation - why not considered? How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting$e' : G_2 \times G_2 \rightarrow \mu, (P,Q) ...
This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...