7
votes
1answer
2k views

ElGamal Signature Scheme: Recovering the key when reusing randomness

Show how if Alice uses the same value of $k$ to sign two different messages $m_1$ and $m_2$, using the ElGamal signature scheme, Eve can recover the value of $a$ from the corresponding signatures ...
5
votes
1answer
311 views

Safe generator for ElGamal signature

What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)? I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ ...
1
vote
1answer
256 views

Efficient algorithm for remainder calculation over prime field for ECC implementation?

I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) ...
1
vote
2answers
246 views

ElGamal: Generation of “g” value?

I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures: $p$ = safe prime $q = (p-1)/2$ $g$ = an ...
1
vote
1answer
410 views

How to protect from Silver–Pohlig–Hellman algorithm

I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a ...
5
votes
1answer
1k views

DSA vs. ElGamal vs. Schnorr

It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA). DSA is a sort of hybrid of the ElGamal and Schnorr signature ...
4
votes
2answers
226 views

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.
1
vote
2answers
530 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
1
vote
0answers
251 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
-1
votes
1answer
109 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
1
vote
1answer
141 views

Designing a secure IM protocol

I haven't been programming much lately, so I figured I would make an encrypted instant-messaging program (read: Skype clone) with groups to hone my skills. That's not important though, I can do that. ...
1
vote
4answers
282 views

Does it make sense to have a 4000 bit long key?

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?
2
votes
0answers
1k views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
3
votes
1answer
248 views

Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known

I been going through some cryptography exercises and stumbled across this problem. Discover message $m$. You know that $m = p * q$. Also $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known ...
2
votes
1answer
259 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
1
vote
0answers
103 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
-3
votes
1answer
115 views

RSA public key security issue

The public key for RSA is $[e,n]$. Since $n = p * q$, are $p$ and $q$ already exposed because it takes no effort to figure out $p$ and $q$ from $n$?
1
vote
0answers
66 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
6
votes
3answers
2k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
3
votes
3answers
472 views

Searching over encrypted data

Is there any library/tool available which can allow me to search over encrypted data? I would like to encrypt data on client side, send it to cloud and perform search in cloud. I've been reading ...
2
votes
1answer
214 views

Homomorphic encryption for vector addition

Building on the question and answer from Addition-only PHE in F# which ponders homomorphic cryptosystems to navigate, relatively, a single dimension without revealing absolute position (an encrypted ...
1
vote
0answers
42 views

Retrieve cryptographic key knowing cyphertext and plaintext [duplicate]

I was curious about cryptography so I started to learn about symmetric encryption. From what I understand a symmetric encryption works as follow: PlainText -> (Encrypt)K -> Cipher text -> ...
1
vote
0answers
121 views

What is the forward cipher function of AES-XTS?

We're using OpenSSLs EVP_aes_265_xts encryption on data (with unique, random, IVs for every new message encrypted) - which is working well. But, I've been asked; what is the forward cipher function ...
2
votes
1answer
309 views

Strange Password Hashing

I know about PBKDF2, bcrypt, scrypt, etc. and while I'm not a crypt professional, I think I understand why are they better than just "hash(pass+salt)". But a colleague of mine surprised me with the ...
2
votes
1answer
119 views

Detecting steganography in the stream of short messages

I have stream of millions of short n-bit (n<30) messages generated by some random number generator. The source of random number generator is not available to me. I suspect there are messages used ...
1
vote
0answers
95 views

Attacking hashed password by timing attack and other means

This question is inspired by this recent one, which raises a point that need to be made quantitative to be meaningfully discussed. I chose an unusual approach: a new question worded as homework that ...
2
votes
0answers
55 views

How to generate initial vectors during DPA attack on stream cipher in real life?

I was trying to understand the procedure of the DPA attack on Stream cipher (like Mickey-128). I learned that, the attacker need to build hypothetical power consumption matrix with different initial ...
9
votes
1answer
2k views

Are there any Secp256k1 ECDSA test examples available?

Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
3
votes
1answer
107 views

Sextic twist optimization of BN pairing - cubic root extraction required?

I found the following paper really interesting: http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf It allows ...
2
votes
1answer
132 views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
1
vote
2answers
257 views

pbkdf2 password validation

My question is related to PBKDF2. I am unsure how to validate user entered password with already existing hashes and salts. I have heard of the so called "length-constant" comparison which basically ...
2
votes
0answers
110 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
-1
votes
1answer
75 views

$f : \mathbb{Z}_n \rightarrow \mathbb{Z}^\times_n$?

Is there any function $f : \mathbb{Z}_n \rightarrow \mathbb{Z}^\times_n$ that is invertible? By invertible, I mean it given $y \in \mathbb{Z}^\times_n$, it should be easy to find $x \in \mathbb{Z}_n$ ...
5
votes
3answers
253 views

Get permutations from password

Are there any "good" ways to get a permutation from a password/pass-phrase? If one, for example, wanted to get a permutation of letters from a password, how might one do that in a smart way? I would ...
2
votes
2answers
813 views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
2
votes
1answer
292 views

Find out which keying option is being used in Triple DES?

As far as I know, there are three standard options for the three keys $K_1$, $K_2$ and $K_3$ used by 3DES: Three distinct keys. The first and last key are equal: $K_1$ = $K_3$. Three equal keys: ...
9
votes
1answer
4k views

Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
1
vote
2answers
121 views

Standard or guidance for entropy collection

I need to write some high-level security requirements which include a random number generator suitable for use in cryptography. I don't need something very formal, this isn't a security certification ...
4
votes
1answer
227 views

Timing Attack on RSA

So far I have researched on timing attack on RSA, We all know the ransomware named Cryptolocker it uses RSA 2048 bit encryption. Now is it possible to break the encryption using timing attack. I have ...
4
votes
0answers
73 views

How has the “power” of cryptography evolved from its beginnings till today? [closed]

I'm looking for a historical overview for the change in cryptographic power, which I hereby define as How far state-of-the-art cryptography is ahead of state-of-the-art cryptanalysis. In other ...
1
vote
1answer
604 views

AES CBC Security

I am building an Apache webserver with TLS 1.2 and OpenSSL 1.0.1. So far, I have enabled 2 encryption algorithms - ECDHE AES256 GCM and ECHDE AES128 GCM. Firefox and Chrome(ium) use NSS which ...
9
votes
1answer
1k views

What stops the Multiply-With-Carry Random Number Generator from being a Cryptographically Secure Pseudo-Random Number Generator?

Despite the fact that Marsaglia's MWC PRNG (multiply-with-carry random number generator) is considered to be "the mother of all RNGs", it does not seem to be considered to be a CSPRNG ...
2
votes
1answer
408 views

How is LUKS dm-crypt secure if the key is stored with the encrypted data?

I've posted this question over at superuser, but haven't had any success at getting answers. That's why I've posted it here. Furthermore, I believe this is a more appropriate place for it as it is ...
14
votes
8answers
3k views

RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
2
votes
1answer
468 views

Burmester-Desmedt (BD) key agreement protocols

How do you perform the Burmester-Desmedt key exchange Protocol, in Diffie-Hellman extension protocol? I've been searching high and low, but couldn't locate an example on how to prove if all the party ...
2
votes
2answers
142 views

Can the passphrase of a PGP key be deduced from an old backup?

Let's assume that Bob, at some point in time, has created a PGP (key length and other parameters are not relevant at this point). For some reason, he has chosen a very poor passphrase, for instance ...
9
votes
2answers
684 views

Why do we use XTS over CTR for disk encryption?

I'm taking Prof. Boneh's crypto class from Coursera, and am unsure on the requirement for XTS mode for disk encryption. It seems that CTR mode would do exactly what XTS can do, but is simpler to ...
3
votes
3answers
109 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, ...
1
vote
2answers
77 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper. The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)$ ...

15 30 50 per page