# All Questions

119 views

### How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
77 views

### What is the complexity of finding SHA-1 collisions?

Given the recent news about SHA-1 collisions, what is the complexity of finding a SHA-1 collision? Marc Steven's HashClash is still detailing about 260. Does the previous complexity still hold?
147 views

### Use of q-ary lattices in developing cryptosystems

Why q-ary lattices are used to most cryptosystems rather than lattices. In most of the papers q-ary lattices are used. Is there any advantage? and Given $$B=(v_1,v_2,v_3,.....v_n)$$ is the basis, ...
54 views

### apprSVP in lattices

The approximate Shortest Vector Problem (apprSVP) is a problem where, given the basis and the approximation factor $\gamma$ (a function of the dimension $n$), one must find a vector $v$ belonging to ...
43 views

### Given occasional LFSR samples can the next sample be computed?

Suppose I have access to an LFSR generator output used in a radio communications system, with the LFSR being used to authenticate devices. The system cycles an internal unknown length LFSR (greater ...
90 views

### Is there a practical security difference between OTP with letters and OTP with numbers?

Is there a practical security difference between “OTP with letters” and “OTP with numbers”? If, for example, I encrypt a letter message using Tabula Recta with a random letter key, I would get: <...
75 views

### Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?

I recentely asked "IND-CCA1 RSA padding?" about whether there is a IND-CCA1 secure variant of RSA. The original version of the question also allowed usage of ECC which would allow usage of ElGamal, ...
460 views

### How hard is the Solitaire cipher to crack?

Assuming your deck is completely random and that it is not retrivable, how hard would it be for a casual person to decrypt a message encrypted with the Solitaire cipher?
134 views

### UKS attack on KEA protocol

I'm trying to understand the UKS attack on KEA protocol. This is described in this paper: Security Analysis of KEA Authenticated Key Exchange Protocol So to summarize: KEA protocol: UKS ...
98 views

### AES storing the length within the encrypted data versus storing it outside

I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload ...
122 views

### Does exponentiation by squaring work on Montgomery curves?

Consider the point multiplication $Q=[d]P$, where $P$ a point on elliptic curve multiplied with an integer $d$ to get another point $Q$ on the same curve. This operation can be computed by a ...
96 views

### Why is the re-encryption algorithm in Universal Re-encryption for Mixnets more complicated than apparently necessary?

This is the paper. On page 6, the paper describes a variant of El Gamal and a way of re-encrypting ciphertexts. I thought an easier way to do encryption is to output $(m(g^x)^y,g^y)$, and universal ...
810 views

### ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
157 views

588 views

### Does RSA operate over a Finite Field (Galois Field)?

Is it correct to say that RSA operates over a Finite Field (Galois Field)? In this case GF(p)? I do understant that the modulo in RSA is not itself a prime number, but all the operations (...
4k views

### Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
167 views

### Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
712 views

### True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
180 views

154 views

### Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery?

In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message ...
217 views

### How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?

Imagine Alice wants to encrypt for Bob and post this encryption publicly, so that only Bob can decrypt but no one can other than Alice or Bob tell that the message was encrypted for Bob. The naive ...
2k views

### Pseudocode for constant time modular exponentiation

I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with ...
474 views

### FHE over the Integers - reduction to approximate gcd problem

I have three quick questions concerning the reduction of the scheme to the approximate gcd problem: What exactly do the authors mean by $q_p(z_1')$ being the odd part of the gcd? (last line of step ...
598 views

243 views

### Does changing the random number selected for each message increase security in Schnorr's scheme?

I was reading about Schnorr's scheme and in that for signing the signer generates a random number and continues with his operation. I am trying to implement this in a scenario where the signature ...
238 views

### AES: Is it safe to encrypt same cleartext with same key but with million diferent IV?

The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit. I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV. My ...
211 views

### Is differential calculus related to RSA?

I'm writing a high school math paper on RSA and I'm wondering if it's possible to relate calculus to RSA. Is calculus used for any part of RSA? It can be for proving equations/theorems, for generating ...
764 views

### ECB weakness and its exploitation

Lets say that I have a server which encrypts information at the server side using ECB mode with the blocksize of 16. If the server appends data that I control with a secret and sends back the ...
589 views

### RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
156 views

### Why are security against eavesdropping and security against CPA equivalent in the setting of public-key cryptography?

Why are security against eavesdropping and security against CPA equivalent in the setting of public-key cryptography?
121 views

### What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
438 views

### Fully Homomorphic Encryption over the Integers - Runtime Question

I have a question regarding the paper "Fully Homomorphic Encryption over the Integers" (http://eprint.iacr.org/2009/616.pdf): On page 6 after they set their parameters, it says "This setting results ...
348 views

### Random session key + predictable IV

I'm using Blowfish in a toy Diffie-Hellman communications scheme. Random session keys are generated for each connection. In this case I can simply feed a null array to the IV right? The same ...
539 views

### Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm?

I have constructed a stream cipher from a secure hash algorithm and a HMAC. Here is a brief description of the algorithm: Let: (Actually Objective-C styled pseudo code) ...
408 views

### Why no swapping block in the last round of DES?

Round 16 on the encryption side, and round 16 on the decryption side of DES have no swapping module. Why is it like this? Can anyone provide any justification? This is my homework question.
284 views

### OMAC/CMAC constant for different block sizes

OMAC/CMAC only specifies constants for 64-bit (0x1B) and 128-bit (0x87) block size. I would like to know how to get constants ...
364 views

### Is this method of deterministically using CBC secure?

I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ...
213 views

### Does any public key crypto support and/or allow a 3rd party “control-key”?

My question is based on the following situation: Bob and Alice work for a company that expects them to exchange data encrypted. They could do so using regular public-key cryptography, but Joe (their ...
409 views

### Is asynchronous perfect forward secrecy possible?

DH key agreement protocols require the participation of both parties, so are only suitable for synchronous connections. Is it possible to implement PFS in a fashion usable for asynchronous protocols, ...
870 views

### Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
851 views

### Trying to better understand the failure of the Index Calculus for ECDLP

So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong). So basically the index calculus for the ...