1
vote
0answers
34 views

What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
2
votes
2answers
638 views

Why is hybrid encryption more effective than other encryption scheme?

Currently I am learning about Hybrid Encryption but I was not able to find any good study material. Below is my understanding: One of the reason why we use ...
5
votes
1answer
64 views

Information theoretical security of an inefficient Shamir based access structure

I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure: Terms: P = set of ...
5
votes
1answer
56 views

How to show CPA attacker does not need access to encryption oracle after receiving cyphertext

In the private key CPA game, the attacker has access to an encryption oracle anytime during the attack. However, I have seen this statement in lecture notes I downloaded "You can prove that for ...
3
votes
0answers
50 views

How does darkmail (DIME) work to hide email metadata?

While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver. There were several news ...
0
votes
0answers
50 views

What are the negative consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

DES has 8 different S-boxes, and AES has only 1. What are the negative consequences of such choices?
0
votes
1answer
32 views

Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

Consider the DSA key generation: A large prime $p$ is chosen; A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$; A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen. ...
1
vote
1answer
441 views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...
2
votes
1answer
67 views

How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)

My question is about Key-Policy ABE (KP-ABE). What does it mean when a "Ciphertext is Labeled with set of attribute"? How is it labeled?
4
votes
1answer
48 views

Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
12
votes
1answer
184 views

Structure for an introductory course on cryptography?

Many introductory courses on cryptography have their treatment of secret-key crypto start with OTP, then block ciphers, and for public-key cryptography revolve around RSA with no notion of padding (...
1
vote
4answers
328 views

Message exchange with textbook RSA

I am working on this exercise but can't work out the answer to the question b. I have solved the question (a) by decrypting the ciphertext $C = 2$ using the formula: $$ M = C^d \bmod n = 2^{17} \bmod ...
0
votes
0answers
36 views

NTRUSign Hashing

I have some trouble understanding the inner workings of NTRUSign. So what I have understood so far is, that when Alice wants to sign a message she does the following steps Convert Alice's message ...
0
votes
1answer
245 views

Help with RSA-2048 crypto ransom virus [closed]

The RSA-2048 Crypto Ransom Virus has devastated me, I tried the backup method, the previous version, the Shadow Explorer, it deleted all my restore points, Its took out 5 HDs and my USB pen that ...
6
votes
1answer
116 views

Non-deniability of data sent over TLS

Andy is going to connect to a server Selma over TLS. Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent ...
0
votes
1answer
108 views

How much stronger is RC4 if it is keyed with an RSA private key?

My idea is to generate a RSA 2048 bit key and use RC4 with the private RSA key to encrypt a stream of data. RC4 is weak because RC4 keys are small, 256-bit. But when we use RC4 with private RSA 2048 ...
1
vote
1answer
69 views

What is a good algorithm to scramble data in a 2-D grid

I want to know if there exists an algorithm i can use where the input is a string of data and the output is a scrambled version of the same but in a 2 D array ie given something like: |1 2 3 4 5 6 ...
1
vote
0answers
36 views

Is it possible to re-generate ECPublic key from raw private key and curve params?

As per my understanding, in Elliptical curve cryptography, the EC PrivateKey is nothing but a bigInteger value. If you know the curve specs and you have this private BigInteger value (which I am ...
1
vote
0answers
26 views

Simple RSA Key Generation example [duplicate]

I have two prime numbers: p = 37 q = 41 And I need to find whether any of these prime numbers, 5, 7 or 11, can be used as a valid encryption key e? My working ...
3
votes
1answer
60 views

Randomness and increment of nonce in GCM

2 questions about nonce usage in GCM: Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on. How much should a nonce increased for a file? Say I use 0x1000 as a nonce to ...
2
votes
1answer
87 views

Attack on textbook RSA with small messages

We learned in class that if Alice wants to send a small message $m$, such that $m < N^{\frac{1}{e}}$, so we can break the system using $e$-th square of $m^e$. But what if Alice knows this flaw and ...
8
votes
2answers
108 views

Historic Authentication Schemes Before Computers

The Bulletin of the Atomic Scientists recently ran an article about an alleged near miss with rockets in 1962, which raises some interesting cryptographic questions: http://thebulletin.org/okinawa-...
3
votes
1answer
207 views

Is it bad design to reuse an AES key?

The company I work for needs to develop a simple system where, for each client, we encrypt a token on our server, which is then transmitted to the client. The decryption is performed by the server ...
1
vote
1answer
96 views

Chosen-Ciphertext Attack on Rabin: Factorize n

At the end of this Wikipedia section, you can see that $$\gcd(|r-s|,n)=q$$ or $$\gcd(|r-s|,n)=p$$ holds. I don't understand why.
3
votes
3answers
150 views

Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
2
votes
1answer
79 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
3
votes
0answers
52 views

authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
3
votes
2answers
113 views

Are parts of a pseudorandom string also a pseudorandom string?

I am working on an exercise that encrypts a message using only the first $n$ bits of a pseudorandom generator's output $G(k)$, i.e. $F_k(m) := G(k)_{0...n−1} \oplus m$. $k$ is chosen uniformly at ...
2
votes
1answer
41 views

Diffie-Hellman over several non-secured HTTP requests - will it work?

This problem is about setting up cryptographic keys on an IoT device. I don't want my devices to be set up with any cryptographic keys pre-baked, but actual communication have to be based on TLS. Now ...
1
vote
1answer
63 views

bcrypt collision probabilities assuming same password and work factor?

What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input? Are bcrypt's salts large enough to prevent this from happening?
2
votes
0answers
70 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
1
vote
1answer
90 views

What effect does a salt have on attacks against hashes's fundamental properties?

I am interested in analyzing how adding a salt to our hashed passwords affects the three types of attacks we can use. The three types of attacks against hashes are as follows: We have the hashed ...
1
vote
0answers
61 views

AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
3
votes
1answer
160 views

Limit the length of AES encoded output to certain value

First let me be clear upfront that am not Crypto expert. I'm having a problem where I will have to use NFC card. Now given the limitation of NFC cards memory sizes, I will need to constraint my system ...
2
votes
1answer
101 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
1
vote
1answer
28 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
1
vote
1answer
49 views

How to store keypair generated by RSA in a textfile?

I'm trying to write an encryption decryption program using Openssl-RSA. There are only two operations. User stores the data and retrieves it whenever he needs. To decrypt something, we need the ...
8
votes
1answer
187 views

Santa Claus' secret permutation

This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the ...
0
votes
1answer
39 views

can session key be be used as digital signature?

if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
0
votes
1answer
71 views

Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
1
vote
0answers
66 views

Is there a fast implementation of RSA for Microcontrollers?

Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. "Efficient and Side-Channel Resistant RSA Implementation for 8-bit AVR Microcontrollers" describes a fast implementation, but only contains a sketch of ...
0
votes
1answer
87 views

Doubts about Authenticated Data Structures logic

I am studying the theory of authenticated data structure, like Merkle Tree and I have a doubt: why use them? I explain better: why to be sure, for example, that a cloud provider didn't modify my files ...
1
vote
2answers
24 views

Does threshold crypto (m-of-n) guarantee that m peers discover the plain text?

In a threshold cryptosystem, is there any guarantee that all $m$ peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee? For instance ...
0
votes
0answers
51 views

How to test the speed of an Authenticated Encryption algorithm?

I am trying to implement Authenticated Encryption algorithms using CUDA. Most of Authenticated Encryption algorithms have short message length like 64, 254..., 4094 (Byte). these message lengths ...
1
vote
2answers
220 views

Different tools return different ciphertext value for equal input

I have a Luna G5 Safenet HSM and I want to encrypt a text file containing testtest with 3DES-ECB algorithm. So in the first step ...
1
vote
1answer
57 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
2
votes
1answer
60 views

NMaster key from n secret key

I have to derive master key from N secret key. With the help of master key, i can collect all the secret keys which is used to derive master key. key1, key2,..keyN ==> single master key and single ...
0
votes
0answers
54 views

what is the fastest and efficient method to perform modular multiplication?

I'm working on a code that needs to perform modular multiplication of big numbers several times. Since the operation takes place several times, using division to find the remainder is very expensive. ...
3
votes
1answer
275 views

RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
2
votes
0answers
75 views

Lightweight Cryptography and Gate Equivalents [closed]

If I design a lightweight cryptographic algorithm, how do I calculate gate equivalents (GE)?

15 30 50 per page