1
vote
0answers
16 views

How to calculate LOW(b) and HIGH(b) in spritz cryptography

I try to implement spritz cryptography like this paper . But I don't know how to calculate LOW(b) and HIGH(b). In paper page 7. ...
3
votes
1answer
43 views

How many bits of an exponent are leaked when doing a powmod?

How many bits of the exponent $x$ are leaked when you calculate and reveal $g^x \pmod p$ for some generator $g$ of $\mathbb Z^∗_p$? The low bit of $x$ is obviously leaked: the low bit equals $1-\frac{...
4
votes
1answer
203 views

RSA time function

I am doing a paper on textbook RSA (highschool-level). I am explaining and proving the significance of the public key exponent in time and security. So far, I have encrypted a constant message with a ...
2
votes
1answer
70 views

PublicKey Unknown Encoding

I have a public key: ...
2
votes
1answer
182 views

Best practises to generate IV for AES-CTR in this scenario

I'm building a cloud storage application that will store files on my servers. I want these files to be encrypted with AES in CTR mode and the key will be always the same. I'm wondering what would be ...
3
votes
2answers
59 views

How does the size of the prime affect Elliptic Curve Bit Security?

I am using the MIRACL Library to implement an Elliptic Curve Diffie Hellman based Key Exchange according to ECDH-Scheme-Wikipedia. Referring to the Miracl Docs they suggest a few curves. Each curve ...
0
votes
1answer
59 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
0
votes
0answers
25 views

Intermediate values for testing Blowfish

I am trying to implement the Blowfish algorithm in VHDL. To debug my code, I need the intermediate values of s-box and P vectors after each iteration. Where can I find this data set? p.s :- I know ...
4
votes
1answer
126 views

What is scale-invariance notion of a fully homomorphic encryption scheme?

I read this paper https://eprint.iacr.org/2012/078.pdf and I didn't understand what does the author mean with scale-invariance perspective. The perspective in which we view the ciphertext is ...
2
votes
2answers
42 views

With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

A key pair has a private key $D_A$ and a public key $Q_A$. $D_A$ is an integer less than the curve's $n$. Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a ...
1
vote
1answer
146 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
4
votes
2answers
307 views

Why does the modulus of Diffie–Hellman need to be a prime?

I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?
0
votes
3answers
62 views

Which method to generate one time password?

I'm looking for a concrete algorithm to generate one time passwords. The situation is as follows: Alice and Bob exchanged a passphrase over a secure channel in the beginning. They want to ...
6
votes
1answer
175 views

Why is only one oracle + challenge-response phase sufficient for IND-CPA security?

The CRYPTUTOR wiki from UIUC uses the following definition of the IND-CPA game: We (privately) choose a key K according to the key generation algorithm: K $\gets \mathsf{KeyGen}$. We (...
4
votes
0answers
197 views

Salary Negotiation Problem

Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for ...
0
votes
1answer
153 views

Is it possible to correct the exponent of an RSA public key if it has been altered?

Is it possible to change the exponent of an RSA public key?
3
votes
1answer
52 views

Is there a standard notation for a message concatenated with its signature?

I'm wondering what's the standard (or canonical) notation for "a message along with its signature", i.e. $$ \mathit{Message}~\Vert~\sigma_k(\mathit{Message}) \text. $$ Here the duplicated $\mathit{...
1
vote
2answers
212 views

Is there an algorithm to hide text in another text, while preserving the meaning of the latter?

Is there a way to hide a text message $A$ inside another text $B$ using a cryptographic cipher/algorithm, while preserving the sense/meaning of $B$ and without anybody being able to notice there is a ...
1
vote
0answers
45 views

Can you explain “k out of n” from the VCS paper by Naor and Shamir

I am new to visual cryptography. I’ve just read the paper “Visual Cryptography” by Moni Naor and Adi Shamir and I'm stuck on the chapter about the “$k$ out of $n$” construction. I am aware that, on ...
4
votes
2answers
116 views

How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
3
votes
3answers
688 views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
3
votes
1answer
89 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
3
votes
1answer
65 views

Forcing participants to be honest in Secure Multiparty Communication

Alice and Bob engage to compute a secure function f(a,b) where a and b must be present in a ...
1
vote
0answers
52 views

Usefulness of ability to calculate $m^{p+q}$ with RSA

I noticed that with only an RSA public key, it is possible/tractable to calculate $m^{p+q} \pmod n$ for any $m$ without knowing $p$ or $q$. Namely, $m^{p+q} \equiv m^{n+1} \pmod n$. (This follows ...
2
votes
2answers
109 views

Is it possible to recover an RSA modulus from its signatures?

Let's say that you have some small number of RSA signatures of known data: you know some pairs $(m_k, c_k)$ such that ${c_k}^e \equiv m_k \pmod n$. If you know $e$, because probably it's one of $\{3, ...
0
votes
1answer
38 views

Understanding SSL vulnerability within Apple's GOTOFAIL

Currently learning and reading about the fascinating SSL Key Exchange and came upon the Apple GOTOFAIL incident back in 2014. I'm going through the code during that time and came across this section. ...
1
vote
0answers
21 views

EC algorithm to derive bits/keys and sign/verify [duplicate]

Looking at the question “ECDSA vs ECIES vs ECDH” it appears that you can either have a tool that can derive keys or bits, or can be used to sign and verify something. Is there an EC way to do both ...
4
votes
1answer
69 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
2
votes
1answer
268 views

Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
1
vote
1answer
121 views

Storing a secure key in an embedded device's memory

I am working on an embedded device which send/receive data and stored them in ciphertext mode (encrypted mode ). Now what's best approach for storing Keys (I used ARM CORTEX M series MCU) ? Storing ...
2
votes
3answers
338 views

Is there a 1:1 mapping between private and public EC keys?

After asking: Are all possible EC private keys valid? I learned that all 32 byte (256 bit) values greater than 0 and less than n are all valid private keys. This means that 99% of all 256 bit values ...
3
votes
2answers
406 views

Are all possible EC private keys valid?

I usually generate a key pair using openssl or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
2
votes
2answers
132 views

Possible to guess RSA public key $e$ using $n$ and $\phi$

We know that if $n$ and $\phi$ is known, then it is possible to find $p$ and $q$ (initial prime numbers). I have following the questions: Assume the public key $e$ is not known, how difficult would ...
5
votes
2answers
235 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...
1
vote
1answer
72 views

Is it safe to generate ECDSA keys from the hash of the previous, over and over again?

I have memorized a very long and secure passphrase, that when hashed with sha256, I can use the result as an ECDSA private key, and use it as a brain-address for Bitcoin. Now I need more bitcoin ...
-2
votes
2answers
122 views

Why are there so many stream ciphers out there and even ongoing research?

What make them better than OTP using a CSPRNG initialized with a secret key?
2
votes
1answer
185 views

Finding key of AES in ECB mode

How many plaintext-ciphertext pairs would be needed to guess with probability, say $p=0.5$, the key $k$ of AES under ECB mode? Most of the articles that I found tried attacks on single plaintext-...
1
vote
2answers
115 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
3
votes
1answer
64 views

Making Pascal Paillier' output absolute

Can we make subtraction result of cipher texts encrypted by Pascal Paillier absolute. Just like we use method Math.abs() in Java ? For example, if we subtract 0 from 1: 1-0 = 1, it is positive but 0-1 ...
5
votes
0answers
41 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
0
votes
1answer
151 views

SHA-256 Hash over multiple SHA-256 Hashes

I am trying to implement a checksum over multiple files. We can assume, that i have a package containing N files. I want to identify such a package uniquely by following calculation: SHA256-Hash ...
0
votes
0answers
19 views

What is the bound for the probability distribution for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as described in this paper https://eprint.iacr.org/2014/039.pdf. How do I choose the bound for the probability distribution chi? How do I choose standard ...
0
votes
0answers
17 views

How to choose moduli ladder for ATV-FHE scheme?

I try to implement the ATV-FHE scheme as mentioned in section 2 in this paper https://eprint.iacr.org/2014/039.pdf. In this paper, authors say this "For example, given a 256-bit prime q ..." in ...
1
vote
1answer
39 views

How to use a secret to allow the generation of public keys, where the private keys can be calculated later

Alice has a secret S and publishes some public information P, about S which is insufficient ...
2
votes
2answers
238 views

Can e = 2 be used in unpadded RSA?

I am wondering whether $e = 2$ can be used in unpadded RSA... It seems like it is not possible to use it: the value of e needs to be coprime with $tot(n)$. $tot(n) = (p - 1)(q - 1)$ where $p$ and $q$ ...
1
vote
2answers
130 views

Encrypt letters separately?

I am trying to encrypt the word Hello using RSA. When encrypting Hello’s integer representation, is each letter encrypted ...
1
vote
1answer
54 views

PRF that can be distinguished after $k$ queries?

In adaptive attacks, if we design poorly, adversary can modify his queries and break the given pseudo random function (that is being able to distinguish it from uniform randomness). Is there a poor ...
1
vote
0answers
31 views

How to generate public key for ATV-FHE scheme?

I want to implement the ATV-FHE scheme as it is described here https://eprint.iacr.org/2014/039.pdf. How to generate the public key? Should I compute it as indicated in section 2 : $h(i) = 2g(i)*...
1
vote
1answer
262 views

Large primes p and q for RSA

I am writing a high-school paper on textbook RSA (the mathematical aspect only). Many definitions of the RSA method start off with saying that one should: Generate two large random (and distinct) ...
6
votes
1answer
117 views

Is there any reason not to use Single-Key EM with AES and a constant key?

I've read recently the paper "Minimalism in Cryptography: The Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is ...

15 30 50 per page