2
votes
0answers
64 views

A confusion about linear span of modified de Bruijn sequence

Recently i'm reading "Cryptographically Strong de Bruijn Sequences with Large Periods" . In the section 2 2.1 Basic Denitions and Properties , property 1 says that ...
2
votes
0answers
102 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
2
votes
0answers
135 views

Rabin/RSA four possible messages?

Given this encryption method: $$f_{N,e} : Z^{*}_{N} \to QR(N)^{*};\quad f_{N,e}(x) = x ^{2e} \bmod N$$ I need to show that, for any $x_{0} \in Z^{*}_{N}$, there are four elements $x \in Z^{*}_{N}$ ...
2
votes
0answers
137 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
2
votes
0answers
80 views

Are there public $p$ and $q$ numbers for use in DSA?

There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the $p$ and $q$ large primes used in the DSA signature scheme. This is proving to be a ...
2
votes
0answers
147 views

How can I construct a distinguisher given an inverter?

Let $ PRG: \{ 0, 1\}^n \rightarrow \{ 0, 1\}^{n+s}$ be a pseudo random generator and let $A$ be an inverter that runs in polynomial time, specifically: $\large \mathbb P_{d \leftarrow PRG(U_n)}[ A(d) ...
2
votes
0answers
94 views

How does use of HMAC affect hash function combiners?

In the comments of this question, Ricky Demer proposes a function $HMAX$ to combine two $HMAC$s based on different hash functions: $HMAX_{H0,H1}(⟨k_0,k_1⟩,m) = HMAC_{H0}(k_0,m) \oplus ...
2
votes
0answers
70 views

Any functioning system for interactive proof?

My problem is to outsource an array of data and ask the prover to sort the data. I am wonder if there is any working system out there that support interactive proof for the above computation? Or if ...
2
votes
0answers
62 views

Protocol/algorithms based on a variable-length input PRF

Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt.
2
votes
0answers
103 views

What role plays Quantum Fourier Transformation in Shor's integer factorization algorithm?

I cannot seem to understand the role or goal of Quantum Fourier Transformation in Shor's integer factorization algorithm. Is it used to collapse all quantum states into one, in which it has a factor ...
2
votes
0answers
402 views

Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
2
votes
0answers
30 views

Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
2
votes
0answers
156 views

Precise meaning of various terms related to universal hash functions

I've been reading about universal hashing, but I'm confused by all these different terms and notations. Could someone help me understand the precise meaning or relation between the following terms: ...
2
votes
0answers
167 views

Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
2
votes
0answers
83 views

partial-domain permutation and strong assumption

Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
2
votes
0answers
82 views

Could BREACH be used to determine an HTTPS URL?

I was reading this article and had a question.... http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/ As I understand it TLS/SSL work in ...
2
votes
0answers
156 views

Security of a 3-party key exchange protocol

I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server. We have the following roles: ...
2
votes
0answers
111 views

Jumblar: Using map locations as passwords

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) ...
2
votes
0answers
93 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
2
votes
0answers
129 views

Ideal system for an encryption scheme

What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
2
votes
0answers
122 views

Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
2
votes
0answers
114 views

How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
2
votes
0answers
162 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
0answers
86 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
2
votes
0answers
72 views

Predicate Encryption supporting disjunctions

I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
2
votes
0answers
251 views

One-time pad and perfect secrecy properties

I have a homework problem: Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$ where P is probability and k is chosen uniformly. I do not know ...
2
votes
0answers
122 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
2
votes
0answers
93 views

Prevent/minimize replay attacks in public message board

Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
2
votes
0answers
219 views

Creating colliding x509 certificates: Crafting RSA moduli step

I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7). Now I have ...
2
votes
0answers
1k views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
2
votes
0answers
502 views

Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
2
votes
0answers
190 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
0answers
104 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
2
votes
0answers
123 views

Computer appliance protocol

I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
2
votes
0answers
171 views

Structure of encrypted office files

I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document ...
2
votes
0answers
59 views

Are there any systems like SDSI / SPKI that are currently being developed?

SPKI / SDSI look interesting but appear to have fizzled out and died. Are there any modern competitors?
2
votes
0answers
210 views

How to properly format a PGP Message Block?

As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
2
votes
0answers
156 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
2
votes
0answers
161 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
1
vote
0answers
9 views

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...
1
vote
0answers
6 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography, if there is not, is it interesting to do it ? thanks.
1
vote
0answers
28 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
1
vote
0answers
27 views

What consequences do the plaintext space size has on the performances in the BGV scheme?

In the BGV paper [1], the authors say in §5.4 that you can have $\mathbb{Z}_p$ as plaintext size with a large $p$. What is the impact of the size of $p$ on the ciphertext size and computational work ...
1
vote
0answers
51 views

ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...
1
vote
0answers
31 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
1
vote
0answers
22 views

Chance to find HMAC key/salt when having knowledge of the hashed data?

I'm not sure how to word this... I'm working with a HMAC (I think of it being a "salted hash"). I know the entire string being hashed, I do NOT know the salt. I also know the first 8 characters of the ...
1
vote
0answers
24 views

Improve security of transposition ciphers

As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not $d$-gram frequencies though, given that $2 < d < L$), or ...
1
vote
0answers
41 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
1
vote
0answers
35 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
1
vote
0answers
27 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...

15 30 50 per page