All Questions

2
votes
1answer
128 views

What does this step in this protocol for the Yao's Millionaire Problem mean?

I was reading “An Efficient Protocol for Yao’s Millionaires’ Problem” (Ioannidis and Grama 2003). In the proposed protocol in section three, it is written: (Step 4) For every $i$, $1 \le i \le d$, ...
3
votes
2answers
110 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
8
votes
1answer
289 views

Did NIST verify “post-quantum” claims in the SHA3 proposal papers?

I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010… This document disproves ...
0
votes
0answers
226 views

Blum-Blum-Shub Cryptosystem

I am given $N$, which is Bob's encryption key. I was able to successfully factor $N$ into $N=p*q$. Alice encrypts a messages for bob and sends $a = [1,1,1,0,0,0,1,0,1,1,0,...]$ $b = 1545164156...$ ...
0
votes
2answers
116 views

Why use two affine transformations in Multivariate Cryptography?

I'm reading Multivariate Cryptography and would like to know why we use two affine transformations to scramble the central map? Why not use only one?
1
vote
1answer
297 views

Can AES decrypt with a wrong key?

The title is asking the question in layman terms, but what I really mean to ask is this: Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ ...
3
votes
1answer
208 views

Purpose of leading zero in PKCS1-v1_5 padding

According to this document the padded message has the following structure: $EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$ What is the purpose of this null byte at the beginning ...
1
vote
1answer
130 views

Weak Stream Cipher cryptanalysis

Hi I have a stream cipher which uses a keystream of: F(r) || F(r+1) || F(r+2) || ... Suppose F(r) is the RSA encryption algorithm: ...
2
votes
2answers
145 views

Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
1
vote
0answers
48 views

Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
3
votes
1answer
117 views

Why is Lamport-Diffie secure?

Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer ...
5
votes
1answer
242 views

Can you help me understand hash-preserving encryption?

I have rather simplistic understanding of cryptography, so I have to beg a pardon in advance if the question has internal contradictions. Imagine data $A$ with a hash $hashA$. This data is encrypted ...
3
votes
1answer
126 views

Can minimum encrypted message length be used to identify public key algorithm or derived some of its features?

Encrypting a very small message using public key cryptography always result in larger encrypted messages. Is it possible to deduce the algorithm used, key length, etc just by looking at the minimum ...
0
votes
1answer
333 views

Is this encryption scheme perfectly secure?

Let $m = 6$, and let $\mathbb{Z}_m$ denote the set $\{0,…,m-1\}$. Let $X \mod m$ denote the remainder obtained when dividing $X$ by $m$. (a) Consider the symmetric encryption scheme in ...
0
votes
0answers
231 views

How good is the RandomPool generator in Crypto++ library?

How good is the RandomPool generator in Crypto++ library? I never heard of it before… I wonder if there is a Fortuna C implementation that I could use in an Objective-C project. Also: How secure is ...
1
vote
0answers
71 views

How can user privacy be preserved in certificateless cryptography?

In certificateless cryptography, how can a user preserve his privacy from Key Generation Center? If the KGC becomes malicious, how can the user's privacy be preserved? I read "Privacy-Preserving ...
2
votes
1answer
56 views

are ideal hashes possible to create?

In a hash function, you map an input of arbitrary length to an output of finite length such that the relationship is one-to-one (or at least that's what you are trying to achieve). Hence, isn't it ...
1
vote
0answers
179 views

What would make it impossible to deny that decryption of a package has taken place?

I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ...
6
votes
2answers
373 views

Can the XOR of two non-collision-resistant hashes be collision resistant?

Suppose I have two hash functions, of which neither (or only one) is collision resistant, and I want to create a new hash function by taking the bitwise exclusive or (XOR) of the results of those two ...
1
vote
0answers
45 views

TCR hash functions from MD5

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ...
6
votes
1answer
156 views

Can homomorphic encryption filter?

Often in articles homomorphic encryption is praised as the holy grail of encryption for cloud storage. This is done by suggesting that it can do any computation, and as such could be used for ...
4
votes
1answer
170 views

Homomorphic Encryption and Semantic Security using Lattices?

I've been reading Brakerski and Vaikuntanathan's "Efficient Fully Homomorphic Encryption from (Standard) LWE" and I'm still digesting pieces at a time. Under section 1.1, "Re-Linearization: Somewhat ...
0
votes
0answers
101 views

becoming a cryptographer after math studies [duplicate]

After studying philosophy and being a philosophy teacher, I took back studies 4 years ago and I did a bachelor in maths. I'm in maths grad school now (I'm 32), and I would like to work in ...
3
votes
1answer
160 views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
0
votes
2answers
253 views

Convert a number to sha-1

I have a task to find a the message for which the SHA-1 hash's last 11 symbols in hexadecimal presentation corresponds to an 11-digit number. I have been given the following example solution: For ...
3
votes
1answer
77 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen thet ...
2
votes
1answer
126 views

Reusing PGP key when generating SSL Certificate Authority?

Does it make sense to reuse some of the keys from my PGP (gnupg, gpg) keyblock when generating my own SSL Certificate Authority (a toy one for myself and a few web services of mine)? In an ideal ...
1
vote
0answers
24 views

Why does a joint leakage MPC protocol not directly apply to a disjoint leakage requirement?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage" on pg. 1239 the footnote at the bottom points out the difference between $joint$ leakage and $disjoint$ leakage. The ...
1
vote
1answer
73 views

How do you prevent the risk of damage to the security of Fully Homomorphic Encryption?

In this paper on pg. 1248 in the "preprocessing phase" section the authors say: In the preprocessing phase, the parties run a (standard) MPC to collectively generate a key pair (pk,sk) for the ...
2
votes
0answers
127 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
0answers
152 views

Best group if one wants the discrete log problem to be hard?

Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ...
1
vote
1answer
81 views

Adversary to Any Collision Resistance Hash Function

I'm reading a notion Any Collision Resistance for Hash Functions. In the lecture define a collision finder CF. CF is said to $(t,\epsilon)$-break the family of hash functions $F_K$ if the ...
2
votes
2answers
104 views

Speed up modular exponentation with fixed base and modulus

Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed? ...
3
votes
1answer
163 views

How can Shamir's method for secret sharing work in the GF(256)?

I have been reading about Shamir's secret sharing, and maybe i completely misunderstand something, but the field is meant to be a prime. However, when i look at the implementations of this algorithm, ...
1
vote
2answers
232 views

scrypt and bcrypt for benefits of both?

I've been reading about bcrypt and scrypt, and it seems that the general consensus is that bcrypt is more "tried and true", but scrypt is better in theory. Couldn't you just hash something with ...
0
votes
1answer
150 views

Tamper-evident audit logs

I want to be able to detect tampering in a log file that is under the control of an untrusted party. I am not interested in secrecy, only the integrity of the contents in the file - so I want to ...
0
votes
1answer
209 views

Why does WPA2-PSK use 4-way handshake instead of 2-way handshake

I don't seem to grasp why is the handshake for PTK in WPA2-PSK 4-way and not 2-way. Isn't it enough to just have these two steps: First party sends Nonce1 to the other party Second party sends to ...
2
votes
1answer
116 views

password generation: random length or max length

In short: Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible? Does the ...
2
votes
1answer
109 views

Upper bound Linear Feedback Shift Register

It is clear that when we have any output stream $x_0,x_1,...$ produced by linear feedback shift register than this output has to be periodic. Now I was wondering if we can find an upper bound for ...
2
votes
3answers
286 views

Is it possible to attack RSA with a WalkSat derivative?

We consider a large $n$-bit number $N$. We want to find a factor, if it admits any. For $m$ taking values from $1$ to $n$, perform the following three steps (actually, for each $m$, perform many ...
1
vote
0answers
97 views

Unblind a RSA blinded signature

I have blinded $m = 16$ with $r= 13$, $e = 7$ and $n = 209$. This resulted in $m' = 464$, which led to a $s' = 8$. Now, I want to unblind this $s'$ by using $s = s' \times r^{-1}$ but im stuck at ...
28
votes
1answer
1k views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
1
vote
2answers
222 views

Shamir's Simple Sharing Scheme - preventing partial recovery of data

In SSSS, if you recreate the original secret with one of the decoder inputs being slightly damaged (e.g. one or two chars incorrect), you receive a slightly damaged version of the original secret. So ...
1
vote
0answers
49 views

AES and Known-plaintext attack [duplicate]

Can you help me to finding some papers that shows AES is secure against known-plaintext attack?
1
vote
1answer
250 views

Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
2
votes
3answers
145 views

Help me about Advanced Encryption Standard (AES)

Suppose $E_k$$(a, b, c)$ is encryption of values $a, b$ and $c$ with key $k$ through encryption algorithm AES (AES-128) and each $a, b$ and $c$ are 300 bits integer values. Also Suppose this ...
2
votes
1answer
100 views

What is adaptive zero-knowledge?

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
4
votes
3answers
176 views

Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...
3
votes
1answer
140 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
2
votes
1answer
199 views

Is this new server API authentication protocol secure?

I need a secure protocol to authenticate client side users with my server which has an API. I am devising something more secure particularly to resist active MITM attacks where an attacker may modify ...

15 30 50 per page