1
vote
0answers
470 views

Decrypting a message without the private key using CRT

I am given 5 different encryption modulus, $N$, each ranging from 78 to 88 numbers long. Then for the encryption exponent, each has the same which is 5. Then I am given 5 different encrypted messages, ...
3
votes
2answers
322 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?
2
votes
1answer
214 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
0
votes
1answer
918 views

My encryption message system & question about security

I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of ...
2
votes
3answers
152 views

How should I interpret this note on diffusion of the internal state of a PRNG?

This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here. ...
7
votes
1answer
155 views

Specification of the scream stream cipher is unclear

I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S. The specifications of the ...
3
votes
2answers
159 views

Calculating ciphersize of Paillier, SSE and OPE

If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?
1
vote
2answers
175 views

Re-using parts of a one time pad to encrypt a new one?

The main problem with OTP's is the fact that they can only be used once. Would it be possible to use a random number that's, say, 512 digits, then use 256 of those for the (non-random) message, the ...
2
votes
2answers
346 views

Please punch holes in this authentication scheme

Folks, I am undertaking a crypto course in Uni. Our professor asked us to try and design some authentication schemes which are resistant to active attacks. This was just a in class exercise to get us ...
2
votes
1answer
246 views

Generate key pair deterministically from a particular seed [duplicate]

I've been reading "SQRL Secure QR Login" at Gibson's website, and I'm wondering if there is a way to generate an RSA private/public key-pair based on some cryptographically secure input, so that if ...
3
votes
1answer
1k views

Can an RSA private key have several public keys?

Ok, so my crpto lecturer in Uni posed this question at the end of the RSA key generation lecture as a brain teaser. I have been thinking about this and I think I have come up with a way ( I am aware ...
3
votes
2answers
207 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
4
votes
5answers
203 views

Using multiple secret keys

I have two secret keys. One is a secret key generated by OpenSSL (primary secret key). Second key is generated by performing one way hash operation to GPS co ordinates and time parameters (geo secret ...
-1
votes
1answer
76 views

Paillier Crypto System : Pros and Cons? [closed]

Can you please list the pros and cons of the Paillier crypto system you have encountered or found?
4
votes
3answers
1k views

NIST temporarily closed — will that have a negative impact on the future of cryptography?

For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA. The text at their ...
0
votes
1answer
498 views

Attribute-based cryptography [closed]

I am trying to create a social network, in which I want to use attribute-based cryptography. One professor told me it is possible to do it only in J2EE, but he can barely code! Some friends of mine ...
4
votes
1answer
128 views

Shamir's Secret Share Over the Reals

What about using Shamir's secret share over the real numbers leaks information? I know there is a problem with random number generation, and someone suggested it leaks the parity of the polynomial, ...
2
votes
1answer
824 views

When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?

Quoting the article Gone in 60 Months or Less: The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. ...
6
votes
2answers
438 views

Would RSA make sense if we used no computers?

I was recently wondering - would RSA be useful if we brought it to, say, medieval times? Could you choose the keys so that you could encrypt/decrypt messages quite easily, but factoring the private ...
4
votes
2answers
174 views

how to iteratively calculate a^emod n with modulus n sized 4096 bits

In most sites the exponent of the RSA public key is 24 bits. But the modulus can get to 4096 bits size. I have an accelerator that can get max. 2112 bit size modulus. It calculates ...
7
votes
1answer
405 views

Why are cryptography algorithms not exported to certain countries?

There have been strict laws about the export of crypto software to certain countries. I can understand the intent, but never gauged the fact that there is nothing stopping these countries from ...
5
votes
2answers
2k views

Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

I've done research about this subject, but I can't find the answer I'm looking for. The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during ...
2
votes
1answer
167 views

Rijndael: explanation of Rcon on Wikipedia?

I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it. The example for Rcon indicates that Rcon(9) is 0x1b. That could make sense… ...
3
votes
1answer
125 views

Is this really the correct way to do an IND-CPA test?

In a description of IND-CPA (indistinguishability under the chosen plaintext attack), I have been reading the following, simple test: The adversary can generate as many messages as he wants. Then, ...
1
vote
1answer
200 views

Verifying Self-signed SSL Client Certificates

I have a service and I want to authenticate my clients using SSL client certificates. Now I want the key exchange process to be as simple as possible, kind of like SSH: You generate a keypair and ...
1
vote
0answers
300 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve (mod p). Suppose I have the following elliptic curve: y^2 ...
2
votes
1answer
376 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
1
vote
1answer
94 views

Who's talking to who encryption - does this concept work?

With all the NSA stuff in the news, I've been thinking about how to ensure the "who's talking to who" is just as private as the contents of the messages. I had an idea on the subject, about which I've ...
2
votes
0answers
30 views

Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
13
votes
3answers
723 views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as ...
1
vote
1answer
187 views

how to mathematically prove a key exchange algorithm [closed]

I want to know the basic methodology that can be used to prove that a key exchange algorithm is secure. I am not asking about any specific algorithm. I want to know what should be proven and how to ...
5
votes
4answers
582 views

Is it possible to create an open-source SecurID?

As far as I understand it, the hardware key-fob two-factor systems such as RSA SecurID depend on secret algorithms, and employ tamper-resistant hardware to prevent reverse engineering. Is there some ...
4
votes
1answer
117 views

Non-interactive proof that an element is in a subgroup

I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| ...
10
votes
2answers
783 views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
4
votes
1answer
101 views

What security do digital signatures provide (like used when signing PDFs)?

I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs. We know that if our document has a digital signature, we can detect if the original ...
7
votes
1answer
643 views

How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the ...
3
votes
1answer
136 views

Friedman Index of Coincidence, pruning multiples of the keylength

I'm trying to write a Vigenere decipher script. I defined a couple of possible keylengths using the Kasiski method, using roughly this method: find recurring strings in the ciphertext between 3 and ...
2
votes
1answer
55 views

How are the lower levels calculated using upper levels in an optimized Merkel Hash Tree?

I was reading about the TIK protocol for thwarting wormhole attacks on adhoc networks. It uses a Merkel Hash Tree to store keys. But since the number of keys can be large, the tree is optimized by ...
0
votes
1answer
71 views

Advise key management protocol

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - ...
1
vote
1answer
132 views

what is an injective trapdoor function?

The answer to this question at Crypto.SE is clear about what a trapdoor function is, but what makes a trapdoor function "injective"?
2
votes
3answers
247 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
1
vote
2answers
257 views

What are requirements for this grille?

I'm trying to program a Cardan grille, but I can't find requirements for grille. In my case, grille is square matrix A with $N$ x $N$ size, and elements are $0$ or $1$ (where $1$ means that it is ...
3
votes
3answers
232 views

How to attack a fixed LCG with partial output?

To show some colleague programmers exactly how broken C's rand() is (at least on Windows) I decided to break it. So everyone knows the exact parameters, MSVC's ...
1
vote
0answers
105 views

Career advice for our readers [closed]

I am a first year math PhD student with work experience and an MS in math. Do you have any advice regarding internships involved with cryptography and other mathematics other than the NSA? Thanks.
3
votes
2answers
1k views

Why is AES not a Feistel cipher?

I am studying for an exam right now. And I wanted to make sure I got this point correct. AES is not a Feistel cipher because the operations in AES are not invertible. Is the above statement ...
1
vote
0answers
167 views

How to perform benchmark of block/stream ciphers?

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
2
votes
1answer
414 views

Why does second pre-image resistance imply pre-image resistance

I am studying hash functions. I can understand why collision resistance implies second preimage resistance, but I don't get why second preimage resistance should imply first preimage resistance. ...
3
votes
1answer
111 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
4
votes
1answer
125 views

When would one prefer a proof of knowledge instead of a zero-knowledge proof?

I've just realized I find it hard to distinguish between these two terms (proof of knowledge, and zero-knowledge proof), specially where only the latter seems to be used in many cryptographic ...
1
vote
2answers
185 views

Shamir's Secret Share [duplicate]

I'm not quite sure the benefits of working over a prime modulus in Shamir's secret share- but doesn't limiting the numbers you pull from make the secret easier to guess? Instead of being over the real ...

15 30 50 per page