# All Questions

82 views

### Why do the outputs of parties in an MPC protocol have to be indistinguishable from the ideal / real world (as opposed to inputs)?

In this paper at the bottom of pg. 1235 and beginning of pg. 1236 it says: An MPC protocol is said to be secure, if for every real world leakage adversary A there exists an ideal world ...
274 views

### Fully Homomorphic Encryption over the Integers - Runtime Question

I have a question regarding the paper "Fully Homomorphic Encryption over the Integers" (http://eprint.iacr.org/2009/616.pdf): On page 6 after they set their parameters, it says "This setting results ...
593 views

228 views

### How to use salt if I am sending hashed password?

If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
1k views

### Known-plaintext attack on Blowfish in ECB mode

The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
380 views

### What does the expression $1^n$ mean as a function argument?

In a paper about predicate encryption or attribute based encryption, the setup function is mentioned with the $setup(1^n)$ or $setup(1^l)$. I want to know what is meant here. Is it multiples of ones ...
178 views

### How can two UProve token holders prove to a 3rd party that they aren't the same user?

Suppose I have two users who are issued two different UProve IDs. The Issuer has guaranteed that one UProve token bearer will never have more than one UProve token ID. How can I use UProve to ...
438 views

### How to compute the dot product on encrypted values?

Is there a practical homomorphic encryption scheme that can give reasonable execution time results in computing a dot product: $$a_1*b_1 + a_2*b_2 +a_3*b_3 +\ldots+ a_n*b_n$$ I imagine the scheme will ...
150 views

### How to obtain a one-value share in Shamir's secret sharing

This is a trivial question, but I had to ask: since each generated share in a Shamir's secret sharing scheme initially consists of a pair of values (representing the coordinates of a point on the ...
485 views

### Symmetric encryption mode where ciphertext size is plain text size

I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of ...
826 views

### Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
260 views

### How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
121 views

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
296 views

### Mental Poker with untrusted server (i.e. no peer to peer)

The question of implementing peer to peer mental poker has already been asked on stackoverflow. And there appears to be an implementation called LibTMCG. Also on this site a question was asked about ...
996 views

### Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our ...
178 views

### Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
224 views

### Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ ...
705 views

### How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
177 views

### SSL Key Exchange

I read briefly over the TSL/SSL key exchange protocol. I have to wonder about the whole pre-master-key procedure. Wouldn't it be sufficient if the client or server encrypted a generated session key ...
2k views

### How to prove that the concatenation of two secure PRG is secure?

Given $G:\{0,1\}^s \rightarrow \{0, 1\}^n$ a secure PRG, how can one prove that $G'(k_1, k_2) = G(k_1) \cdot G(k_2)$ is secure ($\cdot$ means concatenation)? In other words, I'd like to show that if ...
423 views

### Efficient setup for a Montgomery multiplication

Montgomery described an efficient method to compute a modular multiplication. This works by using a special constant $R$ and assumes the inputs $a$ and $b$ have been made into a special representation ...
4k views

### Advantage of AES(Rijndael) over Twofish and Serpent

I'm trying to figure out a suitable encryption technique and after reading a bit, I figured the current AES 128-bit encryption is suitable for what I'm trying to do. However, this is more due to the ...
747 views

### Key derivation from a random seed

The main problem is to use a block cipher to generate a random key. I would like to generate 256-bits key which can be as random as possible. I generate it in the following way: Pick a plaintext ...
411 views

### Can I save space for short messages by using encryption with private key instead of a signature?

Let's say I have a message, a Private Key and a Public Key. Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you ...
292 views

### Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
417 views

### Is truncating a hashed private key with SHA-1 safe to use as the symmetric key for AES for data at rest?

I realize this is mixing the purposes between asymmetric and symmetric crypto, but I was wondering if it is safe to use a hashed, truncated private key (asymmetric) as the symmetric key for encrypting ...
490 views

### What kind of multiparty computation is this?

The classic multiparty computation protocols are defined around " Untrusted parties trying to compute something together". But is there a cryptographic abstraction for, "Trusted parties trying to ...
501 views

### RSA algorithm's license free or paid?

I checked RSA's patent application, which was registered in 1983. As patents don't last more than 20 years, it seems to me it should be free. But my friend said to use RSA I have to buy a license from ...
248 views

### Stream ciphers based on discrete logs

Blum Blum Shub is a stream cipher that is provably reducible to the difficulty of factoring integers. I'm wondering whether there is a similar construction for discrete logs? For example, I could ...
287 views

### Where can i find relative software for differential cryptanalysis?

Is there any publicly known software for differential cryptanalysis over some cryptographic building blocks as blocks ciphers or cryptographic hash functions