2
votes
1answer
88 views

Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
2
votes
1answer
361 views

How can I calculate the time complexity of modular arithmetic?

I'm doing modular arithmetic in a Java program, and I want to calculate the time complexity of the individual operations. $$ c= a · b \bmod n $$ $$ m = a^{-1} · b \bmod n $$ How do I get an ...
2
votes
1answer
156 views

Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle-Damgard hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
2
votes
1answer
279 views

Why is proof-by-reduction needed (for Elgamal proof of security, for example)?

The textbook proof for Elgamal encryption basically reduces to the Decisional Diffie-Hellman assumption (DDH). Elgamal: $Gen(.): x \xleftarrow{R} \mathbb{Z}_p$; $Enc(m,g^x): r \xleftarrow{R} ...
2
votes
1answer
653 views

Ideal passphrase length: old diceware method (5 words) vs. your Bitcoin wallet.dat passphrase lenght (8 words) and doubling passwords?

I made a cool 5 word passphrase back then using the old Diceware method and use it as a master password. The question is as computing power increases will we need to add more and more words to our ...
2
votes
2answers
287 views

Why does Fortuna (RNG) require entropy sources to specify accumulator pool?

Re-reading my copy of Cryptography Engineering for the holidays, I was struck by the following question about the Fortuna RNG: Why require an entropy source specify which pool a random event should ...
2
votes
1answer
183 views

Choosing good parameter for Lenstra's elliptic curve factorization

In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
2
votes
1answer
4k views

AES vs Blowfish taking key-length into account

I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people. My question is, how do the two compare when a 256-bit key ...
2
votes
1answer
87 views

Individual bits of Textbook RSA

This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem. Does RSA hide all ...
2
votes
1answer
149 views

Is this attack for RSA possible?

$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively. I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
2
votes
1answer
379 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
2
votes
2answers
629 views

Optimising Pollard's Rho algorithm for large semi-primes

I have programmed an implementation of Pollard's Rho factoring algorithm using C++ and the GMP library. It is reasonably fast with large numbers, however I haven't implemented any form of cycle ...
2
votes
1answer
2k views

What exactly is addition modulo $2^{32}$ in cryptography?

EDIT: I've been confusing this the whole time. What I've been wanting to say this whole time is addition modulo $2^{32}$ not addition modulo 32 as the question originally said. Thanks for pointing ...
2
votes
1answer
225 views

Exact mathematical definition of simulation based security?

I've been trying to understand cryptographic protocols and how to define their security. The problem is that while I can understand what the intuitive definition says, I have trouble understanding how ...
2
votes
1answer
197 views

Constructing secure key exchange protocol

I have $\Pi=(Gen,Enc,Dec)$ and let it be semantically secure public-key encryption scheme. Security parameter is $n$, then the message space of plaintext is always $\lbrace 0, 1 \rbrace^n$. By using ...
2
votes
1answer
720 views

BouncyCastle Elliptic Curve implementation

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve). ...
2
votes
1answer
273 views

implications of SSH server key compromission when authenticating users against a public key

Friday we had a disagreement with a colleague of mine about the implications of SSH server key compromission The question was stated as this : What could a hacker do while provided with the SSH ...
2
votes
2answers
572 views

Difference in one time key and one time pad and many time key

These terms are confusing me. One time pad is when you use one key for one message. That is what One time key is. Secondly, what is the connection of many time key, can i use one time pad many ...
2
votes
2answers
265 views

Is it possible to match encrypted documents using user-defined search terms?

Suppose I am storing a number of encrypted documents in a database. I would like to make it possible to identify the subset of documents whose contents match user-specified search terms without a) ...
2
votes
1answer
412 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's some sort of OpenSSL interoperability thing a b c. Is there some ...
2
votes
4answers
312 views

Signature and Timestamp for Long Term Document Archival Question

I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity. As far as I understand, I ...
2
votes
1answer
902 views

Format-preserving encryption implementations

I'm looking for a general, free implementation of Format-preserving encryption as described in this article and on wikipedia. Possibly in a well established cryptography toolkit. My intention is to ...
2
votes
1answer
183 views

Signing 14 bytes of data

for an embedded device I need to sign a 14-byte string and want to verify that string on the device. Since there is already an AES-Library on the device, I thought about using the following scheme: ...
2
votes
2answers
266 views

Encryption with private key?

we normally always encrypt by public key and decrypt with private key. If i encrypt with private key, then its still secure as normal PKI ? i mean known-plain-text will not take private key on the ...
2
votes
1answer
247 views

Vulnerabilities of encrypting data with known regularities

I need to encrypt data that has a pre-defined header and footer structure, and furthermore the data follows pre-defined patterns. The header and footer structure follow a defined structure but cannot ...
2
votes
2answers
165 views

Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
2
votes
1answer
2k views

In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step? Is it the 10th round key? For example, is this the right order? ...
2
votes
1answer
445 views

Linear Feedback Shift Register Taps

Linear feedback shift register tap charts are availale for registers of length 3 to 168. Does anyone have a chart for register lengths from 168 to 256 or beyond? Thank you.
2
votes
1answer
967 views

AES-NI implementation examples

Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ...
2
votes
1answer
2k views

Is AES restricted to only 64 characters for the key/password?

I am wondering if AES only supports 64 character passwords? When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters. ...
2
votes
1answer
104 views

McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
2
votes
2answers
172 views

How can I store a combination of multiple pass phrases?

Let's assume we have 2 phrases, one is the real password from a user, and the other is generated from the real password and almost impossible to guess. You would need both to authenticate a user. What ...
2
votes
1answer
134 views

Is there a way to provide proof of batch RSA security?

Suppose we have two encrypted messages with two different public key issued from the one server. There is a client who wants to send these to messages to the server. In the middle there is an ...
2
votes
1answer
928 views

Cryptanalysis Affine Cipher: Brute-Force Search Vs. Meet-in-the-middle

Affine Cipher: $Enc(x) = (ax + b) \mod m$ $Dec(x) = a^{-1}(x-b) \mod m$ For a brute-force key search, we need to do $a \cdot b$ encryptions in the worst case. For a meet-in-the-middle attack, how ...
2
votes
1answer
89 views

How do we find the last two correspondences in an otherwise known even permutation?

A secret even permutation $P$ of the set of non-negative integers less than $n$ is chosen. That might be a Feisltel cipher with a random key. We are given in sequence the $P(x)$ for $x$ from $0$ to ...
2
votes
1answer
100 views

Is it possible to spoof an identity cert modulus?

I was looking at FOAF+SSL and wondering if its possible to spoof the modulus of the browser certificate so that the FOAF and browser certificate's modulus match?
2
votes
1answer
561 views

Where can I find Secp256k1 ECDSA test vectors?

I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like ...
2
votes
1answer
78 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
2
votes
1answer
103 views

Convert m-Sequence into a de Bruijn Sequence

In his paper Alternating Step Generator Controlled by de Bruijn Sequence, C.G. Günther states on page three that a de Bruijn sequence (..) can easily be obtained from an m-sequence (maximal length ...
2
votes
1answer
90 views

Proof of storage scheme

I'm familiar with client puzzles, where the client performs some work and there is a way to prove to the server that the client has done so. Is there a way to do this, but where the client's resource ...
2
votes
2answers
97 views

secure integer comparison

I have been going through a huge amount of papers to find a simple and a practical method to compare integer numbers without revealing their original values. I know that this falls within the area of ...
2
votes
1answer
43 views

Where did Martin Hellman acknowledge Ralph Merkle's contribution to public-key cryptography?

I am trying to find the article to reference when discussing the Diffie-Hellman key exchange. According to Wikipedia Hellman said that The system...has since become known as Diffie–Hellman key ...
2
votes
1answer
69 views

Hill cipher cryptanalysis - known plaintext known key size

Hello I want to know how to go about this problem I know the plaintext "abcdef" and the ciphertext. The key size is 2. I really can't figure out how to find the key for decrypting and encrypting.
2
votes
3answers
155 views

Is it overkill to run a key generated by OpenSSL through pbkdf2?

I'm generating a key & iv with OpenSSL via: ...
2
votes
1answer
111 views

Fast modular reduction

I am looking at ways to speed up modular reduction for the polynomial $$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$ I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not ...
2
votes
1answer
153 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
2
votes
1answer
81 views

Detecting steganography in the stream of short messages

I have stream of millions of short n-bit (n<30) messages generated by some random number generator. The source of random number generator is not available to me. I suspect there are messages used ...
2
votes
1answer
68 views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
2
votes
1answer
84 views

Is it possible to tweak AES-GCM so that it is satisfactory for whole-disk encryption (like XTS mode)?

Is it possible to leverage a preexisting implementation of AES-GCM to provide the key security benefits essential for full-disk encryption (similar to AES-XTS)? GCM is a popular encryption mode ...
2
votes
2answers
129 views

RSA: What happens to restrictions of plaintext n, dependent on p and q?

Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused. We have a plaintext $x$ and ciphertext $y$, with $x ...

15 30 50 per page