# All Questions

34 views

### What do you mean by Ciphertext indistinguishability [duplicate]

Wiki definition : A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space ...
638 views

### Why is hybrid encryption more effective than other encryption scheme?

Currently I am learning about Hybrid Encryption but I was not able to find any good study material. Below is my understanding: One of the reason why we use ...
64 views

### Information theoretical security of an inefficient Shamir based access structure

I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure: Terms: P = set of ...
56 views

### How to show CPA attacker does not need access to encryption oracle after receiving cyphertext

In the private key CPA game, the attacker has access to an encryption oracle anytime during the attack. However, I have seen this statement in lecture notes I downloaded "You can prove that for ...
50 views

### How does darkmail (DIME) work to hide email metadata?

While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver. There were several news ...
50 views

### What are the negative consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

DES has 8 different S-boxes, and AES has only 1. What are the negative consequences of such choices?
32 views

### Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

Consider the DSA key generation: A large prime $p$ is chosen; A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$; A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen. ...
441 views

### MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...
67 views

### How is the ciphertext labeled with a set of attributes in Key-Policy Attribute-based Encryption (KP-ABE)

My question is about Key-Policy ABE (KP-ABE). What does it mean when a "Ciphertext is Labeled with set of attribute"? How is it labeled?
48 views

### Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
184 views

### Structure for an introductory course on cryptography?

Many introductory courses on cryptography have their treatment of secret-key crypto start with OTP, then block ciphers, and for public-key cryptography revolve around RSA with no notion of padding (...
328 views

150 views

### Is there any alternative for extended euclidean algorithm to perform modulo division?

I'm implementing point addition and point doubling operations for elliptic curve cryptography. I have implemented extended euclidean algorithm to perform modulo division. It appears the that ...
79 views

### How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
52 views

### authentication protocol questions/security

Disclaimer: I am the only person that uses my software. This is just experimental fun. I previously wrote a server/client that used the secure remote password protocol authentication. I had an idea ...
113 views

### Are parts of a pseudorandom string also a pseudorandom string?

I am working on an exercise that encrypts a message using only the first $n$ bits of a pseudorandom generator's output $G(k)$, i.e. $F_k(m) := G(k)_{0...n−1} \oplus m$. $k$ is chosen uniformly at ...
41 views

### Diffie-Hellman over several non-secured HTTP requests - will it work?

This problem is about setting up cryptographic keys on an IoT device. I don't want my devices to be set up with any cryptographic keys pre-baked, but actual communication have to be based on TLS. Now ...
63 views

### bcrypt collision probabilities assuming same password and work factor?

What is the likelihood of 2 bcrypt hashes colliding if they use the same work-factor and input? Are bcrypt's salts large enough to prevent this from happening?
70 views

### MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
90 views

### What effect does a salt have on attacks against hashes's fundamental properties?

I am interested in analyzing how adding a salt to our hashed passwords affects the three types of attacks we can use. The three types of attacks against hashes are as follows: We have the hashed ...
61 views

### AES-GCM Hash sub key parameter in Intel's IPsec library

I am trying to use Intel's optimized AES-128-GCM implementation (from the Intel white paper “Fast Multi-buffer IPsec Implementations on Intel Architecture Processors”, you can find the code here). ...
160 views

### Limit the length of AES encoded output to certain value

First let me be clear upfront that am not Crypto expert. I'm having a problem where I will have to use NFC card. Now given the limitation of NFC cards memory sizes, I will need to constraint my system ...
101 views

### How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
28 views

### What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
49 views

### How to store keypair generated by RSA in a textfile?

I'm trying to write an encryption decryption program using Openssl-RSA. There are only two operations. User stores the data and retrieves it whenever he needs. To decrypt something, we need the ...
187 views

### Santa Claus' secret permutation

This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the ...
39 views

### can session key be be used as digital signature?

if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
71 views

### Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
66 views

### Is there a fast implementation of RSA for Microcontrollers?

Zhe Liu, Johann Großschädl, and Ilya Kizhvatov. "Efficient and Side-Channel Resistant RSA Implementation for 8-bit AVR Microcontrollers" describes a fast implementation, but only contains a sketch of ...
87 views

### Doubts about Authenticated Data Structures logic

I am studying the theory of authenticated data structure, like Merkle Tree and I have a doubt: why use them? I explain better: why to be sure, for example, that a cloud provider didn't modify my files ...
24 views

### Does threshold crypto (m-of-n) guarantee that m peers discover the plain text?

In a threshold cryptosystem, is there any guarantee that all $m$ peers participating in retrieving a plain-text will all retrieve it? If not, is it possible to provide such a guarantee? For instance ...
51 views

### How to test the speed of an Authenticated Encryption algorithm?

I am trying to implement Authenticated Encryption algorithms using CUDA. Most of Authenticated Encryption algorithms have short message length like 64, 254..., 4094 (Byte). these message lengths ...
220 views

### Different tools return different ciphertext value for equal input

I have a Luna G5 Safenet HSM and I want to encrypt a text file containing testtest with 3DES-ECB algorithm. So in the first step ...
57 views

### Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
60 views

### NMaster key from n secret key

I have to derive master key from N secret key. With the help of master key, i can collect all the secret keys which is used to derive master key. key1, key2,..keyN ==> single master key and single ...
54 views

### what is the fastest and efficient method to perform modular multiplication?

I'm working on a code that needs to perform modular multiplication of big numbers several times. Since the operation takes place several times, using division to find the remainder is very expensive. ...