All Questions

3
votes
2answers
150 views

ElGamal in private set intersection: how to handle negative numbers?

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...
1
vote
1answer
134 views

Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
2
votes
1answer
107 views

Proving that a function is not a OWF (One-way-function)

I was trying to prove that a given function is not a one way function and I was not sure how to do it because maybe I had unclear what a one way function was (OWF). The definition that I have for a ...
1
vote
1answer
64 views

OTP sequence uniqueness

Is it possible to use Time-based One Time Password (TOTP) algorithms to generate tokens from multiple channels (where a channel is defined as a "user" using a certain shared key $K_c$ for channel ...
-1
votes
1answer
197 views

Does a playlist of songs or movies mixed together contain enough random enough for OTP key material?

Ok hypothetical scenario. Lets say I want to generate a lot of key material quickly for a one-time pad. This key material will be divided up and used for many different messages in the future. I ...
0
votes
2answers
160 views

IV/Nonce in CTR&GCM mode of operation

We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM: Is it OK to use the same key for encrypting plain-texts in authenticated ...
4
votes
2answers
246 views

Block Ciphers and (Non-)Generic Attacks

I am currently reading through Cryptography Engineering and came across this definition of block cipher security: Definition 2 An attack on a block cipher is a non-generic method of ...
0
votes
0answers
46 views

Private Set Intersection Polynomial Computation [duplicate]

I am trying to implement the protocol mentioned in Section 3.4 of “Efficient Robust Private Set Intersection” in Java. In the Second Step, the Client computes a polynomial of degree $n$ over the ...
7
votes
3answers
2k views

Why hash or salt when signing?

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
3
votes
1answer
268 views

Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
24
votes
2answers
5k views

“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?

In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm? Similarly, what is the security difference ...
3
votes
2answers
154 views

Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
1
vote
1answer
83 views

Does a cofactor of an elliptic curve have to be an integer?

What are the implications of a curve having a non-integer co-factor for its generator point? Is that even possible?
3
votes
2answers
253 views

GCM encryption for 256-bit and 512-bit block ciphers

The Galois/Counter Mode of Operation (GCM) This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
2
votes
0answers
90 views

Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
4
votes
1answer
667 views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
2
votes
2answers
640 views

Can a shift cipher attain perfect secrecy?

On a practice question for my intro cryptography exam, it asks the following: Assuming that keys are chosen with equal likelihood, the shift cipher provides:    A) computational security ...
1
vote
1answer
98 views

How unsafe is to share parts of a password

The best way to ask this question and have a concrete answer is to set a very specific example. This is the example I would be interested in reading an answer to: Consider that my friend Alice has ...
6
votes
2answers
273 views

Proof of work for standard computers

I'm interested in a proof-of-work system that works well on standard computers without using the GPU. Properties the system should have: Seed based proof-of-work. There is no distinguished ...
0
votes
0answers
60 views

Plaintext patterns leaked based on single bit

Assuming that Elgamal is used as an encryption cipher, where lets say $p$ is 2048bit prime. Is it possible for an attacker to figure out $x$, a secret key, if any part of 2048 bits ciphertext and ...
1
vote
1answer
244 views

Encrypting firmware with AES and no IV [closed]

I have an embedded device with a AES CBC engine on it that is used to ensure the integrity of the firmware. I know that CBC mode requires unique IVs to be any good, but I'm unsure if it makes a large ...
1
vote
1answer
127 views

Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
2
votes
2answers
650 views

Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
0
votes
1answer
40 views

gnupg: display digest of key [closed]

How can I display what digest algorithm has a key? If I import a public key which has MD5 as digest, I get a warning about this weak algorith. But how can I check, what digest algorithms all my keys ...
4
votes
2answers
321 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
8
votes
2answers
1k views

Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
2
votes
2answers
177 views

RSA: What happens to restrictions of plaintext n, dependent on p and q?

Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused. We have a plaintext $x$ and ciphertext $y$, with $x ...
13
votes
6answers
5k views

Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ...
2
votes
3answers
223 views

How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
2
votes
2answers
85 views

Should tweak be unique per message?

Since tweaks are like IV,Salt for block cipher inputs . Should they be unique for each message ? If they are to be unique per message then what is the advantage of giving tweak directly into the ...
1
vote
1answer
306 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
7
votes
1answer
416 views

Why are cryptography algorithms not exported to certain countries?

There have been strict laws about the export of crypto software to certain countries. I can understand the intent, but never gauged the fact that there is nothing stopping these countries from ...
1
vote
1answer
193 views

Why do we use 1024 / 160 bit primes in DSA?

I am looking at DSA's parameter generation and don't understand why for $p$ a 1024 bit prime is needed if $q$ is chosen as a $160$ bit prime. I thought that the security of DSA relates on the discrete ...
1
vote
1answer
161 views

crypto design with AES256 MODE OFB

I have the following APP Design key store (contains 1:n user payload as 1:n key store entries) key store salt (is used to extend to key store password to 256 bits, stored in clear text) key store ...
4
votes
1answer
277 views

Complexity class of an idealised version of Bitcoin's proof-of-work (hashcash)? [closed]

To formulate this question precisely, I will define an idealized hypothetical "perfect" hash function $H(n)$ which has nice scalability properties, and will formulate a problem PERFECT HASHCASH in ...
1
vote
0answers
135 views

Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
1
vote
1answer
113 views

simple multiplication in GF(8)

I am trying to do multiplication in the GF($2^3$) defined by the irreducible minimum binary polynomial $X^3+X^2+1$. I want to multiply $A(x) * B(x)$ where $A(x) = x$ and $B(x) = x^2$. The ...
1
vote
1answer
103 views

If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
1
vote
2answers
247 views

How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
2
votes
1answer
170 views

Is this approach to generating a “random” number from a sha512 hash effective?

I'm looking to run a small raffle but i'd like people to be able to verify that the number chosen was fair. I know some sites use a "Provably Fair" system to achieve this where user input is combined ...
5
votes
2answers
435 views

Computationaly hard detokenization algorithm for credit card numbers

I am designing a vault that tokenizes credit card numbers (a plaintext that consists of 16 decimal digits), with the following requirements: Given some plaintext, the vault returns an index. If ...
0
votes
2answers
97 views

Needed: signature over a collection of hashes

I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be ...
5
votes
4answers
138 views

Is there a standard way to extend the output of a hash?

Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.) Is there are a standard way to ...
13
votes
2answers
1k views

Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?

Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
1
vote
0answers
58 views

What does the notation $1^n$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.
-1
votes
1answer
269 views

Is the random data at the end of my decrypted message supposed to be there?

This is my PKCS#5 & AES/ECB Python 3.3 code: ...
3
votes
0answers
173 views

Prove preimage resistance property

Let $ f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $ g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $ h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
3
votes
1answer
236 views

Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Routine 2.2.7 of ...
1
vote
1answer
69 views

Hashing a uuidv4 + time to create a unique id

First, I am no crypto expert although I am doing the MOOC. I have an item which has as id: uuidv4 When I create this item: I create a new uuidv4 check if it already exists and if not, I store it ...
5
votes
5answers
478 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...

15 30 50 per page