1
vote
0answers
74 views

A topic for my master thesis on post quantum cryptography [closed]

I am a master´s student. I am interested to work on post quantum cryptography. None of my professors are offering any topic this year related to post quantum cryptography. However I have the freedom ...
0
votes
0answers
48 views

Rijndael variant using AES for key schedule? [on hold]

The weakest part of Rijndael is considered to be the key schedule (I believe that this is true for all variants, including ones not standardized as AES). One solution to this problem is to use (...
4
votes
2answers
151 views

Help with breaking AES reduced to 2 rounds

I was studying Rijndael AES proposal, and its cryptanalysis. I started with writing code to break AES reduced to 2 rounds. I am using 128 bit key size and 128 bit block size. 2 round AES means the ...
1
vote
0answers
34 views

Partially homomorphic addition - not all parties present

I often see homomorphic encryption as a solution to a problem where a server wants to know the sum of $n$ users' numbers but can not know each individual users' number plaintexts. My question is: if ...
2
votes
1answer
61 views

Why is $Mac_k(m_1||m_2) = ⟨F_k(m_1), F_k(m_1 \oplus \overline{m_2})⟩$ not a secure MAC?

I am preparing for an exam and trying to solve the following question I found on the internet: Let $F_k$ be a pseudorandom function. Show that the following MAC for messages of length $2n$ is ...
0
votes
2answers
156 views

How to show something is not a one-way function?

Lets say that $f:\{0,1\}^* \to \{0,1\}^*$ is a strong one way function. Let $h(x)=f(x)||x_n$ where $x_n$ is the $n$th bit of $x$. I understand that $h$ will not be a strong one-way function. However, ...
3
votes
1answer
111 views

Why is not there any ideal S-Box?

i read about linear cryptanalysis and about S-Box that there is not any ideal S-Box (ideal S-Box is a random S-Box in another words S-Box that bias of input and output bits is zero) then i read about ...
1
vote
1answer
32 views

Secret key agreement by public discussion from common information

There is a paper: U. M. Maurer, Secret key agreement by public discussion from common information, IEEE Trans. Inf. Theory, 39(3) 733-742 of 1993, with an IMHO fairly impressive title but having ...
3
votes
0answers
22 views

Can GCM auth be bitsliced?

Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
-2
votes
1answer
88 views

How to XOR two hex values and am I doing crib dragging correctly? (OTP)

Let's say I have the two cipher texts 7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B 73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B According to this website http://xor.pw/? the result ...
4
votes
1answer
57 views

How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
5
votes
1answer
105 views

Is the concept of provably secure hash the same as entropy smoothing hash functions?

Is the concept of provably secure hash the same as entropy smoothing hash functions? In the tutorial Sequences of Games: A Tool for Taming Complexity in Security Proofs V. Shoup shows us a proof of ...
1
vote
1answer
83 views

“Security” of SHA functions (Wikipedia), what does it mean?

Wikepedia's table Comparison of SHA functions mentions "Security(bits)" for some SHA functions. From the ratio (Output size (bits): Security(bits)), I feel it is something like "collision resistance". ...
5
votes
1answer
175 views

great discovery in the field of elliptic curves cryptography?

Prof. Adi Shamir says in The Cryptographers' Panel 2016: i think that NSA has made a great discovery in the field of elliptic curves cryptography and NSA wants to avoid the increased use and ...
1
vote
1answer
91 views

What is the importance of 1 < d < φ(n) and 0 ≤ m < n in RSA?

I'm a first year Maths undergraduate and we have recently gone onto RSA. I understand the majority of the algorithm using Fermat's Theorem etc. From the algorithm stated on Wikipedia: 4) Choose ...
3
votes
3answers
189 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote "...
0
votes
0answers
16 views

Why Sflash signature scheme is constructed in this way?

Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the ...
1
vote
0answers
22 views

For the LTV-FHE scheme, after how many additions should modulus switching be used?

From the LTV-FHE paper I find out that after every multiplication there must be a modulus switch to mitigate the noise in the resulting ciphertext, besides relinearization. But, assuming the ...
1
vote
1answer
61 views

Number of shifts in DES key schedule

In DES key schedule some rounds use one left shift while others use two left shifts. What is the reason behind this?
3
votes
1answer
125 views

Why does 0x00 make bcrypt weaker?

On the following site: https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence when talking about the dangers of using bcrypt it states: There is a nontrivial ...
1
vote
0answers
24 views

Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to ...
0
votes
0answers
20 views

Is there any difference between a one-time pad and a Vigenère cipher with a long key? [duplicate]

I've been browsing Wikipedia and stumbled on the article for the Vigenère cipher. I realized after seeing the example that it's quite similar to the one time pad, except with a short key repeated as ...
0
votes
2answers
48 views

Trying to understand MixColumns with Hexadecimal matrix

I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook has a final answer and it does not clarify how it got the result. I am trying to ...
1
vote
2answers
784 views

Use cases and implementations of RSA CRT

I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...). The use of this theorem improves the speed of decryption so, ...
2
votes
1answer
64 views

Distinguishing two sets of pseudorandom values when their keys differ by one

Suppose we use a pseudorandom function $PRF$ and a random key $k$ to generate a set of pseudorandom values: $\forall i, 1\leq i \leq n: w_i=PRF(k,i)$ Now, consider instead of picking a fresh key, ...
5
votes
2answers
156 views

Is there a security problem with this prime generation algorithm?

I am facing the following algorithm to generate an RSA public key: ...
4
votes
0answers
56 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
2
votes
1answer
137 views

Generate hash value using public key along with message

I was trying to understand one way signature chaining on message by Saxena and Soh. As the message is passed from one user to other, every user can combine their signature to create one single ...
3
votes
1answer
142 views

How does DPA work on AES?

I am really not much of a crypto guy so I don't really get how a differential power analysis on AES works. Can somebody explain it to me how it basically works?
0
votes
0answers
22 views

Confidentiality then Integrity with different keys [duplicate]

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
14
votes
1answer
4k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
1
vote
0answers
76 views

Confidentiality then Integrity with different keys

Can anyone describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides (PPTX) on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole ...
0
votes
3answers
50 views

Getting inverse of a transposition key

I'm new to security stuff and I have some questions about the keys of transposition cryptography. If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I ...
0
votes
1answer
84 views

Solving for a One-time pad cipher help ; crib dragging doesnt work (no surprise) [duplicate]

Basically we're given the text 7ECC555AB95BF6EC605E5F22B772D2B34FF4636340D32FABC29B 73CB4855BE44F6EC60594C2BB47997B60EEE303049CD3CABC29B 64C6401BAF45F6A930435F3DF875C4E102F8742A45C824AFCA9B ...
0
votes
0answers
41 views

Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
0
votes
0answers
11 views

Calculating inverse of transposition key cipher [duplicate]

I need some help on transposition cryptography. If I'm given the encoding key to a transposition cipher, how do I get the decoding key for it? I tried googling but couldn't find any steps on the ...
5
votes
0answers
77 views

What is the fastest modular reduction algorithm available?

I have been browsing for the fastest and most efficient modular reduction algorithms and came across quite a few. But the one in A Fast Modular Reduction Method (2014) by Zhengjun Cao, Ruizhong Wei ...
1
vote
2answers
45 views

Are there any disadvantages of using libsodiums helpers for en-/decoding/comparision instead of the native ones?

Libsodium has some helpers, which allow hexdecimal decoding, encoding and also constant-time string comparison. So if you use the php binding libsodium-php you ...
0
votes
3answers
136 views

Does RSA have two trapdoors?

I watched some videos from Khan Academy explaining the algorithm for RSA encryption/decryption. They explained that there are two trapdoors, modular exponentiation being one and prime factorization ...
1
vote
1answer
46 views

How to test an encryption against different attacks [closed]

For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to ...
0
votes
1answer
41 views

Attack being kind of completely puzzled?

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 4 the author wrote: Thus, after all, this belief about every attack being kind of ”completely ...
1
vote
1answer
57 views

Public-key encryption with associated data

In the symmetric-key world, we have authenticated encryption with associated data (AEAD). I'm looking for something similar, but for public-key encryption: public-key encryption with associated data (...
3
votes
2answers
703 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
2
votes
0answers
39 views

Password hashing in embedded systems

Are there good options for password hashing in embedded systems? These systems often cannot afford slow has functions. I can think of a few approaches: Store the (hashed) passwords in a HSM that ...
5
votes
1answer
134 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
1
vote
0answers
33 views

Impact of Git's use of SHA-1? [closed]

Git uses SHA-1, and it is common to sign Git commit or tag hashes to authenticate a repo. Is this insecure now?
0
votes
1answer
35 views

Probability of generating same master secret key in Identity-based Encryption

Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system ...
9
votes
3answers
1k views

How is the One Time Pad (OTP) perfectly secure?

The Wikipedia entry on One Time Pads (OTPs) states that if this cipher is used properly; ie, the keys are truly random and each "part" of the key is independent of every other "part", it's uncrackable,...

15 30 50 per page