1
vote
1answer
147 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key ...
-1
votes
1answer
101 views

Why is it said that if we know few bits of pseudo random sequence we can predict the whole of it?

I am new to this cryptography and in the source from which i study it is said that if we know the first few bits of a pseudo random sequence we can predict the whole of it.How is it possible? The ...
2
votes
2answers
161 views

Pseudorandom functions

The usual case to distinguish a pseudorandom function from a random function is to assume that the adversary can choose the plaintext blocks. Is there another case (game) in which the adversary can ...
1
vote
1answer
246 views

RSA padding: what is it and how does that work?

If I am not mistaken, plaintext RSA is not secure. So, I have read that padding and hashing is needed to make the RSA algorithm secure. However, I am confused on what does padding or armoring mean in ...
4
votes
1answer
190 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
0
votes
0answers
147 views

How to safely sign a 6 characters String?

I have to decide, whether a document, which I am given, was correctly signed by a private key. my Ideas is to sign the document id using RSA with the private key and to print the following onto the ...
2
votes
0answers
116 views

Do Gap-CDH groups exist?

A Gap-CDH group is such that, given group elements $g, a = g^x, b = g^y$, it is hard to compute $g^{xy}$, but, given a group element $c$, easy to verify if $c = g^{xy}$. While such groups have been ...
2
votes
0answers
86 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
1
vote
1answer
99 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
2
votes
1answer
499 views

Is it possible to change PGP / GPG Key Size on an exisiting key?

Is it possible for myself to change the key size (say from 2048 to 4096) on an EXISTING PGP / GPG key, and just republishing that key? Or do I have to generate a new key all together? I want to say ...
4
votes
4answers
498 views

Decrypting files with an unknown method but a known result

I am assuming there is a very simple way of working this out by brute force, but I am not sure if there is a better way. I have a file of data that I wish to get (my data, generated by a machine). ...
1
vote
1answer
105 views

how does https key get shared?

I am only a beginner and doesn't know much about https. I have heard that they uses somekind of a key and is shared between them. If an attacker wishes to attack could he be able to capturebthe key ...
2
votes
1answer
209 views

Are SSL modes with forward secrecy vulnerable to the BEAST attack?

From the original BEAST paper, it seems to me that you need the same session key when encrypting data, so you can check if the original plaintext block is the same as your chosen plaintext (which is ...
7
votes
2answers
518 views

Is FIPS 140-2's “Continuous random number generator test” practical?

Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test." Here are the relavant bits: If each call to a[n] RNG produces blocks of n bits ...
1
vote
2answers
136 views

Is there a problem with this non-ECDSA message signing?

Is there a problem with signing a message like this? ...
3
votes
2answers
964 views

Using a Hash as a secure PRNG

I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
7
votes
1answer
398 views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
1
vote
1answer
73 views

Decimal point in keyspace notations? (eg 2^54.15)?

I was reading up on CryptoCat's (pretty ridiculous) programming issues and how is dramatically reduced the key search space (link to bug synopsis) One thing that caught my eye was So 2^54.15 ...
-6
votes
2answers
231 views

Snowden Challenge II: Can we solve Snowden challenge quantumly? [closed]

Suppose that tomorrow is July 7, 2050 and Snowden is still stayed in Sheremetyevo airport. Further, let us suppose that quantum computation and quantum commincation are available to everyone, and ...
3
votes
1answer
117 views

How to compute the attacker's probability?

Given a random bit string $R=r_1r_2\cdots r_n$, let us encrypt each bit $c_i=E(r_i,k_i)$ where $k_i$ is taken from the stream of encryption keys. Suppose that an attacker can guess the correct $r_i$ ...
2
votes
1answer
203 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has it's security based on the one-way ...
2
votes
0answers
132 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
4
votes
6answers
369 views

A block cipher with independent keys for each round

I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ? Thank you. EDIT Some missing ...
2
votes
0answers
118 views

Ideal system for an encryption scheme

What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
2
votes
2answers
265 views

DSA, RSA, ECDSA etc - which one is cheapest for signing?

For a protocol where the server presents its signature to prove authenticity (e.g. IKE/SIGMA/STS with only one party authenticated), it's essential that the signing is extremely cheap, while ...
1
vote
0answers
93 views

openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
1
vote
1answer
115 views

Lamport-Diffie + Security Proof

I am studying Lamport-Diffie signature scheme. In the lecture present the algorithm $A'$ for attempting to invert the one way function $f$, where $f$ is used to compute the public key. My question is ...
13
votes
1answer
7k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
1
vote
1answer
224 views

Encryption schemes and pseudorandom permutations

Can an encryption scheme (deterministic or not) be viewed as a pseudorandom permutation taking as input a message and returning a value of the same bit-encoding length ? Thank you.
2
votes
1answer
146 views

Generate a new public/private key pair for each new message?

When using PGP type public encrypted communication, would it be a good idea to generate a new public for each message and attach that in the new public key in the reply to back to sender mail body? ...
1
vote
2answers
81 views

Lamport-Diffie + attempting to invert OWF

I am studying Lamport-Diffie signature scheme and in my lecture present the follow algorithm for attempting to invert the one way function $f$, where $f$ is used to compute the public key of this ...
1
vote
1answer
143 views

Securely generating passwords based on a secret and a public identifier

I'm trying to create a good scheme for generating passwords in my systems management scripts. What I'd like to do is have a secret key (let's say hello123), which I ...
20
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
3
votes
3answers
152 views

Hash Family Example

I am reading my lecture and I found this definition: Let be $F$ be a family of hash functions, that is, a parameterized set $$F=\{g_k:\{0,1\}^{*}\rightarrow\{0,1\}^{n}|k\in K\},$$ where $n\in ...
4
votes
1answer
668 views

Fast Salsa20 in java?

For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4. There are plenty of libraries in C, but are there any good ...
1
vote
2answers
296 views

definition and meaning of semantic security

I'm taking coursera cryptography course. The definition of semantic security is hard to understand. I tried to slightly restate it (the word "efficient" was in the original definition). Do I get it ...
1
vote
1answer
91 views

constructing QR-like one way function

I am wondering whether the following form is a one way function with collision resistance: $$ax^2+by^2 \mod p$$ where $a$ and $b$ are given, and $p$ is a prime number. Since the QR (quadratic ...
2
votes
1answer
180 views

Why restrict nonce/IV and counter to specific sizes?

When setting up a nonce/IV and counter (e.g. for AES-GCM-128), why are the nonce/IV and counter restricted to specific sections (e.g. random nonce/IV in first 8 bytes and counter in last 8 bytes)? ...
0
votes
0answers
52 views

Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done. Are there any Asymmetric Encryption Algorithms where the ...
1
vote
2answers
1k views

How to find generator $g$ in a cyclic group?

As generator $g$ is use in DH how to find combination of prime $p$ and $g$? eg: if we choose $p=23$ its generator is $7$ (given in book) how to find it?
3
votes
3answers
200 views

Construct a random permutation from a random function?

How can we construct a (pseudo) random permutation from a (pseudo) random function ? I've seen a method from Luby-Rackoff which allows to construct a PRP of length $2N$ from a PRF of input/output ...
2
votes
3answers
413 views

additive ElGamal encryption algorithm

I'm performing ElGamal encryption algorithm and using the additive homomorphic property so the product of two ciphertexts is the encryption of the sum of the plaintexts. The problem is that I need to ...
1
vote
1answer
163 views

Is this key management scheme secure?

I'm designing a scheme for management of a small number of cryptographic keys (<100 at any given time) and I had an idea. Rather than storing all the keys, could I just store one master key and use ...
1
vote
1answer
225 views

Are there Cryptography certifications variants of CISSP?

Are there Cryptography certifications variants of CISSP ( Certified Information Systems Security Professional)? Like a CISSP exams, but only for cryptography?
3
votes
2answers
180 views

Using single EC cert/keying material to derive symmetric encryption key (for storage)?

The situation involves a single party (single certificate) who would want to AES encrypt a file that they can later decrypt. Assume the EC certificate + EC keys have a purpose i.e. "File encryption" ...
3
votes
2answers
84 views

Is it possible to insert a key derivation function when using EAX?

I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
0
votes
1answer
74 views

What kind of adversary is a compromised party?

Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine ...
2
votes
1answer
276 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
0
votes
1answer
121 views

Resources for basics of lattice crypto [closed]

I'm looking to fill in the gaps of my knowledge of lattices. Can anyone point me towards papers or books that introduce lattice crypto assuming a fairly solid math background? Mods: Feel free to ...
1
vote
0answers
85 views

can permutation matrix be found in parallel processing technique?

Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ ...

15 30 50 per page