All Questions

0
votes
2answers
152 views

Encryption of a number with RSA bigger than $n$

I'm having trouble understanding why encrypting a number $m$, which is larger than $n=p\cdot q$. I've looked into the following threads: Why RSA can't handle numbers above 76? Why does plain RSA ...
1
vote
2answers
111 views

Proof for exponentiation in modular arithemtic

If $e$ is a natural number, then this is true: $$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$ This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, ...
14
votes
4answers
1k views

What security do Cryptographic Sponges offer against generic quantum attacks?

In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides: Collision resistance up to $2^{256}$ operations Preimage resistance up to $2^{256}$ operations Second ...
2
votes
2answers
196 views

What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
0
votes
0answers
119 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
1
vote
1answer
92 views

Cracking Stream Cipher

I need to crack a stream cipher. I have a set of plain text and encrypted text pairs. The hint to the question asks me to use entropy analysis and look at the hex dump of the encrypted text. However, ...
3
votes
1answer
181 views

State of the art in zero knowledge proof compilers?

What is the current state of the art zero knowledge proof compiler ? I need one that can minimally handle double exponentiation by a known value E.g. $$Pok\{(\alpha):h=g^{\alpha^b}\} $$ where b, ...
2
votes
1answer
109 views

Why is CBC based on AES malleable in blocks other than the first block?

Perhaps I don't understand the answers to Malleability attacks against encryption without authentication, so trying to be more concrete... please be patient. If I want to change the first block and I ...
0
votes
1answer
104 views

DES-encrypted cipher

Suppose that you knew that a plaintext was encrypted with DES and consisted only of 16-bit Unicode letters, numerals, and punctuation marks available on a standard English-language QWERTY keyboard. ...
1
vote
1answer
84 views

Is knowing the distribution of input domain only way to do cipher text only attacks?

Imagine there is a $n$ bit block cipher. The attacker has harvested some how all possible $2^n$ cipher texts for some given key. Without the knowledge of the distribution of input domain as in ...
1
vote
1answer
106 views

Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
2
votes
1answer
337 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
4
votes
1answer
715 views

What is it meant by a “hybrid argument”?

Can anyone explain (or point to a reference for) what a hybrid argument is in a security proof, and when it's convenient or preferable to use it? Among some of the places where I've seen it ...
2
votes
2answers
134 views

Is there a metric (term) for work required to decrypt a public key?

Any public key decryption can be decrypted given enough time and computing power. Is there a metric or term for this? Something like it would require on average 2^43 1024 bit hashes to find private ...
1
vote
1answer
171 views

How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... ...
1
vote
1answer
68 views

Addition-only PHE in F#

Using homomorphic encryption, I would like to be able to take an encrypted integer and either add 1 or -1 for a new encrypted value. I do not want the encrypted value to be recoverable - just the ...
1
vote
2answers
216 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
2
votes
2answers
133 views

implication of tweak on bruteforcing a block cipher

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is ...
10
votes
2answers
625 views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
1
vote
1answer
65 views

Using cryptographic hash to match AES key size

I am making a tool for myself where I intend to store cipher text. I wish to use AES together with arbitrary sized keys to create these cipher text strings. The idea is to use a cryptographic hash ...
3
votes
2answers
160 views

Best way to get 32 bytes from PBKDF2

Use the PBKDF2 output as an HMAC key, hashing two different inputs - once for 20 bytes and once for 12 : ...
1
vote
1answer
100 views

Security based on PRF

I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs. When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they ...
0
votes
1answer
84 views

Efficient Robust Private Set Intersection Questions

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ...
8
votes
0answers
152 views

Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$

Suppose you want to select a prime $p$ such that finding e.g. $log_2(3)$ in $\mathbb{Z}_p$ is expected to be either at least as hard as the general Discrete Logarithm Problem in $\mathbb{Z}_p$, or at ...
5
votes
1answer
249 views

What is 'Carry-forward verification' defense against MITM?

Wikipedia article on Man-in-the-middle attack mentions, in the list of defenses against it, some method called "Carry-forward verification", but it does not explain it. I am curious about different ...
1
vote
0answers
45 views

ElGamal Homomorphic Encryption Formula Question [duplicate]

With Pubic Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
4
votes
1answer
72 views

Why are security against eavesdropping and security against CPA equivalent in the setting of public-key cryptography?

Why are security against eavesdropping and security against CPA equivalent in the setting of public-key cryptography?
3
votes
3answers
214 views

Is the following authentication protocol insecure?

I am a student taking cryptography this semester. I was just wondering why can't we use this simple protocol? Alice → Open Connection → Bob Alice ← Cert$_b$ ← Bob Alice → {K$_{AB}$}$_{Bob}$ → Bob ...
3
votes
1answer
235 views

Proofs of security methodologies

I'm looking for course material on the subject of proofs, reductions, and games, as used to prove cryptographic schemes secure. What are the methodologies? What are the preferred ones? In what cases ...
4
votes
6answers
395 views

A block cipher with independent keys for each round

I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ? Thank you. EDIT Some missing ...
4
votes
1answer
171 views

Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
4
votes
3answers
401 views

Is this “layered” XOR cipher secure?

I am aware of the vulnerabilities of simple xor ciphers and recently I came across a block cipher that claims to solve those vulnerabilities. The cipher goes as follows with both the block and key ...
5
votes
1answer
215 views

What are the pros and cons of deterministic site-specific password generation from a master pass?

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this: Pick a master username and a master passphrase. The username could be your ...
2
votes
1answer
348 views

Block cipher with key longer than block size

When a block cipher key length is greater than the block length, is it the case that for some keys $k_0, k_1$ (with $k_0 \not= k_1$) and plaintext message $m$ that $E_{k_0}(m) = E_{k_1}(m)$?
1
vote
1answer
38 views

Logarithm in Private Set Intersection

Is the logarithm in the private set intersection protocol mentioned in Section 3.4, Step 5 of http://www.ece.umd.edu/~danadach/MyPapers/set-int.pdf, a base 10 or 2? How do we find this out?
1
vote
0answers
70 views

LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
1
vote
1answer
152 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key ...
1
vote
1answer
99 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
2
votes
1answer
334 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
1
vote
0answers
58 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
2
votes
1answer
73 views

Can you explain the counter in the Key derivation function of PACE?

I try to understand the PACE-Protocol, especially the Key Derivation Function in ECDH on page 33. Can someone explain me, what the Counter is good for? Often there are iteration counters in KDF - but ...
2
votes
3answers
142 views

Combating traffic analysis over request-response protocols

Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions: Contribute a ...
1
vote
1answer
108 views

Usage of Fermat primes in RSA

Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption? I understand why $2^n+1$ primes are useful, because they would simply be ...
1
vote
0answers
59 views

Efficient Robust Private Set Intersection Additive ElGamal [duplicate]

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ...
1
vote
1answer
61 views

What is the padding scheme for the original Tiger hash?

The specification doesn't seem to indicate how to pad messages to the requisite 512-bit boundary. What is the padding scheme for the original Tiger hash?
2
votes
1answer
136 views

Efficiently computing the neutral element in a ring isomorphic to Z/NZ?

Edited to clarify question So my question is whether anyone knows of an efficient way to compute the neutral element (I'm gonna call it 1, but the operation doesn't have to be multiplication) in an ...
2
votes
1answer
198 views

Predicting Java's PRNG using partial output

I have a program (a game) that uses Java's nextInt function with parameter 0x10000 to get a random 16-bit number. Java's ...
1
vote
1answer
73 views

Authentication and deniability

I have the following problem: Alice wants to send Bob a message such that Bob knows it is from Alice but at the same time he cannot prove that Alice send him this message. The solution I came up ...
0
votes
1answer
92 views

ElGamal encryption with private key [closed]

Does the encryption with a private key and decryption with a public key works in ElGamal likewise what is done when we use RSA for sender authentication?
8
votes
1answer
958 views

Three-way hash collision

According to the birthday paradox we need approximately $O(|T|^{1/2})$ samples from the tag-space to find a collision for a hash function $h:K\times M \to T$. But how many samples are needed to find a ...

15 30 50 per page