All Questions

46 views

How to store keypair generated by RSA in a textfile?

I'm trying to write an encryption decryption program using Openssl-RSA. There are only two operations. User stores the data and retrieves it whenever he needs. To decrypt something, we need the ...
51 views

AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
155 views

Santa Claus' secret permutation

This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the ...
24 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
90 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
169 views

RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
678 views

Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique (described here): it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed ...
1k views

In standard RSA, the modulus $n=p_1 p_2$ is a product of two primes $p_1,p_2$ of the same size. Suppose we construct the modulus as a product of multiple primes $p_1,\dots,p_k$, i.e., $n=p_1 p_2 ... 3answers 81 views RSA message integrity I wish to send some small data that RSA alone can encrypt, and I send a shared secret along with it. ... 2answers 773 views What does well-typed mean? I am currently studying Cryptography and I don't really understand what does 'well-typed' mean when talking about secure cryptographic protocols. I can't find any reasonable explanation on the ... 1answer 213 views Are there any good examples of Contemporary Mechanical Cryptography? Are there secure mechanical cryptosystems in use today? Not necessarily alphabetic either, ie digital but mechanical? 1answer 39 views can session key be be used as digital signature? if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature? 0answers 53 views Is there a fast implementation of RSA for Microcontrollers? Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. "Efficient and Side-Channel Resistant RSA Implementation for 8-bit AVR Microcontrollers" describes a fast implementation, but only contains a sketch of ... 2answers 22 views Does threshold crypto (m-of-n) guarantee that m peers discover the plain text? In a threshold cryptosystem, is there any guarantee that all$m$peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee? For instance ... 2answers 283 views Can you help me understand PFS and wPFS? Every time I encounter the concepts of PFS (perfect forward secrecy) and wPFS (weak perfect forward secrecy), I feel uncertain about them. My understanding is that: PFS ensures that, if the ... 2answers 808 views Winternitz One-Time Signature I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key$Y$,$f$is applied$2^w-1$times? Are there any security ... 0answers 45 views How to test the speed of an Authenticated Encryption algorithm? I am trying to implement Authenticated Encryption algorithms using CUDA. Most of Authenticated Encryption algorithms have short message length like 64, 254..., 4094 (Byte). these message lengths ... 5answers 12k views What is the lowest level of mathematics required in order to understand how encryption algorithms work? What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ... 1answer 5k views What is the meaning of “trapdoor” in cryptography? I do not really understand the meaning of a "trapdoor" in cryptography, so here are my questions: What is the meaning of trapdoor and how can I convert a word or string using a trapdoor in ... 1answer 90 views Usefulness of Damgård–Jurik I am trying to understand what are the benefits of using Damgård–Jurik over Paillier. I understand that expansion factor decreases as s increases. But isn't it the ... 3answers 13k views How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint? If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use? The original cracking was significantly helped by operator ... 1answer 58 views NMaster key from n secret key I have to derive master key from N secret key. With the help of master key, i can collect all the secret keys which is used to derive master key. key1, key2,..keyN ==> single master key and single ... 1answer 57 views Is it secure to encrypt random key with block cipher in ECB mode? If we have a random key$K$which is 256-bit, and have a block cipher$C$which has a block size of 128-bit. Is it safe to encrypt$K$with$C$in ECB mode? This problem can be generalized to given a ... 0answers 50 views what is the fastest and efficient method to perform modular multiplication? I'm working on a code that needs to perform modular multiplication of big numbers several times. Since the operation takes place several times, using division to find the remainder is very expensive. ... 0answers 40 views Differential Cryptanalysis How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ... 0answers 82 views Deletion in RSA Accumulator I am studying RSA Dynamic Accumulator and I have a question: why is simpler to calculate the new accumulator value after a deletion if is known the secret ϕ(n)? Is possible to calculate the deletion ... 1answer 37 views Deletion complexity in a RSA accumulator My question is about the existence of a dynamic RSA accumulator with deletion of an element in O(1) time. Do you know some practical implementation? 1answer 62 views Largest number that could be factored in milli seconds Considering a home pc/laptop as machine used (Say typical 2.4 GHz, 16GB RAM, 4 core processor) for running any factorization algorithm. What would be the largest number that could be factored into its ... 1answer 277 views Decoding base64 encoded message with a key I am pentesting a database that where I found data which was base64 encoded. I tried the usual method of decoding base64, which didn't work. Later, I found in ... 0answers 49 views Applying Vigenere on small strings with sorting capability I am new to cryptography and have a question about a use of Vigenere cipher in the case of small strings. I'd like to encrypt keywords that are smaller than 10 characters. If I use Vigenere ... 0answers 1k views Reasons for Chinese SM2 Digital Signature Algorithm In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ... 4answers 2k views What is a Non-Interactive Zero Knowledge Proof? I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ... 5answers 14k views Why is AES resistant to known-plaintext attacks? At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext? 1answer 110 views Message security and also program copy detection Imagine I have client and server running on different machines, each as a separate software. I want to ensure: message authenticity, integrity and confidentiality at least of messages coming from ... 2answers 185 views Is my protocol that uses hybrid cryptography and AES-GCM secure? I'm having a lot of trouble trying to understand how to implement AES-GCM. My usecase: Person A sent me a file with a gauranteed unique name. I want to be assured it was from person A, and that no ... 0answers 23 views How to calculate Private Key in RSA using Extended Euclidean Algorithm [duplicate] I have googled for about 2 hours now and still haven't found an explanation. The wiki article just makes me more confused and so has every other similar question I've found on StackExchange. Here's an ... 0answers 26 views Clarification on the state of the art of qubit commitment What is the current state of research on quibit commitment? It seems that the answer is not 2001 but it seems to me that a lot of these pdf are referring to a old protocols of quantum bit commitment ... 1answer 195 views Why Merkle Tree doesn't suffer Birthday attack? I am trying to understand why Merkle Tree doesn't suffer the birthday attack? Can you help me? Thank you! 2answers 130 views Random Coin Flip Quoting an old question: Consider the following protocol for two parties A and B to flip a fair coin (more complicated versions of this might be used for Internet gambling): A trusted ... 1answer 83 views Unconditionally Secure Authentication I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ... 2answers 81 views Probability approximation of no collisions I am comparing the actual probability of no collisions to the probability approximation formula of no collisions from the Understanding Cryptography text. The approximation is as follows: ... 0answers 33 views Can knowing part of what was used to generate an md5 hash make it vulnerable? [duplicate] Say I am able to ask a black box MD5 generator to generate 1,000,000 hashes given input$STRING$Where$STRING$is an arbitrary ... 1answer 37 views How do different block sizes affect the throughput of GPU implementations of AES? I am confused about the effect of different block sizes on AES performance. As you can see here, there is a huge gap between the throughput of different block sizes. As far as I know, every 16 bytes ... 1answer 39 views elliptic curve multiplication with negative factor I'm learning the multiplication operation on EC. From most material I can found, the multiplication$nP$is just: $$nP=P+P+\cdots +P+P$$ For negative factor, i.e.$(-n)P$, by above definition and the ... 1answer 90 views How can IND-CPA encryption be identity revealing? This is problem 10 of Chapter 4 "Symmetric Encryption" (pdf) from Lecture notes by Bellare and Rogaway: An IND-CPA secure encryption scheme might not conceal identities, in the following sense: ... 1answer 72 views Is there short period in AES 128 key schedule? I am wondering if for some particular keys the AES 128 key schedule lead to a periodic pattern for the round keys. The key schedule is only 10 rounds, but I am also wondering in the general case where ... 2answers 103 views Multiple NTRU public keys for the same private key? An NTRU public key is generated essentially by multiplying the inverse of a polynomial$f$by a polynomial$g$. The polynomial$f$is the private key;$g\$ is discarded. My question is: Is it insecure ...
34 views

MonkeyDuplex constructions defined by Keccak authors has padding in every duplex block. Why only last duplex block is padded in NORX? Is it because NORX has domain separation, or simply because ...