All Questions
5
votes
1answer
123 views
Correct way to map random number to defined range?
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.
What is the best way to map this random number to a ...
2
votes
1answer
106 views
DLP based crypto systems with multiple independent generators
One example of a DLP based crypto system (or rather DDH based crypto system) where the public key parameters include two independent generators of the subgroup, is Cramer Shoup. Since the security ...
2
votes
0answers
114 views
Correct way to truncate data to a range
2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm.
I want to take a stream of k trusted random ...
0
votes
1answer
86 views
decryption many time pad
I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
5
votes
1answer
135 views
Is there an existing AEAD scheme with minimal IV requirements?
Is there an existing AEAD scheme such that, for inputs with the same AD and IV
ciphertexts are allowed to leak whether or not their plaintexts are equal,
if the scheme can process the plaintext in a ...
1
vote
1answer
51 views
Comprehension question on a signature protocol based on the RSA assumption
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
2
votes
0answers
65 views
How can I prove that this encryption scheme from a random oracle is secure?
I am reading this example:
A random oracle is an ideal object.
What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
1answer
99 views
How to use salt if I am sending hashed password?
If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
4
votes
2answers
174 views
Signature schemes for underpowered devices (8bit microcontroller)
I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel.
Recently ...
2
votes
2answers
146 views
Assymetric password encryption - Viable? Which algorithm?
We have an application that requires cleartext passwords for user authentication because of the authentication mechanism in use (RADIUS/CHAP), which unfortunately we cannot change. Since we don't want ...
0
votes
2answers
66 views
ElGamal: Generation of “g” value?
I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures:
$p$ = safe prime
$q = (p-1)/2$
$g$ = an ...
1
vote
1answer
98 views
Proper uses for CTR and CBC AES block cipher modes
Assuming the following:
Key is randomly generated is being used (32 bytes+)
IV is also randomly generated
Crypto random key generator is used
Data being encrypted contains common bytes like ...
1
vote
1answer
36 views
Pseudo Random Generator (PRG) from Rabin function
I'm trying to make a PRG using the Rabin function. The code (in Java) I wrote to implement the function is:
...
8
votes
3answers
2k views
What is the relation between RSA & Fermat's little theorem?
I came across this while refreshing my cryptography brain cells.
From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
1
vote
2answers
185 views
What data is saved in RSA private key?
What data is saved in RSA private key in openssl? How to view it?
Wikpedia says these variables are saved.
1
vote
1answer
144 views
Tree hash and multithreading for parallelism
I am using tree hash mode of Skein on a 16 core processor. Will it automatically employ parallelism using more than one cores or do I have to use multi-threading within the tree hash for parallel ...
2
votes
1answer
73 views
Why unit vectors should be encrypted bit per bit in that case?
At this work at section $2.2$ concerning a possible application for the BGN cryposystem the author points out that if you want to encrypt a unit vector $\overrightarrow{u_l}$ of size $l$ then the ...
1
vote
2answers
156 views
AES+CTR+HMAC Encryption and Authentication on an Arduino
In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel.
We have chosen AES in CTR ...
4
votes
1answer
245 views
Any point in waiting for the SHA-3 standard?
The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter?
That is, can we just assume it's going to be as specified by the submitters ...
0
votes
1answer
89 views
ECKS-PS algorithm: searching in encrypted data; bilinear maps
I have found an encryption algorithm named ECKS-PS (published in the paper Efficient conjunctive keyword search on encrypted data storage system) that allows an user to search in encrypted data. All ...
0
votes
2answers
75 views
Using salted hash as password for easy memorization without reuse?
I had an idea earlier:
Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example:
...
2
votes
0answers
45 views
Relaxed trust criterion for mental poker server?
I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
1
vote
1answer
116 views
AES Message Authentication Vulnerability
My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out.
Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
1
vote
1answer
71 views
What does “adaptively secure” mean?
In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
0
votes
1answer
47 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
0
votes
0answers
19 views
ECKS-PS algorithm: searching in encrypted data; bilinear maps [duplicate]
I have found an encryption algorithm named ECKS-PS (published in a paper named 'efficient conjunctive keyword search on encrypted data storage system', written by Jin Wook Byun, Dong Hoon Lee, and ...
4
votes
2answers
166 views
Why are the constants so simple in Keccak?
Keccak, the construction selected for SHA-3 is very interesting. It seems unlike other primitives and has chosen very simple constants. (Keccak talk PDF)
The initial values of the state in Keccak is ...
6
votes
3answers
512 views
What security does Keccak offer against quantum attacks, specifically Grover's algorithm?
In the face of non-quantum attacker, Keccak[r=1088,c=512] with 512 bits of output provides:
Collision resistance up to $2^{256}$ operations
Preimage resistance up to $2^{256}$ operations
Second ...
5
votes
1answer
244 views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
4
votes
0answers
57 views
MD4 First preimage - state of the art
What's the state of the attack to get the first preimage on MD4?
Is it still this http://www.di.ens.fr/~leurent/files/MD4_FSE08.pdf in 2^102 ?
1
vote
1answer
71 views
Ciphers in CBC mode reveal place of change in plaintext
Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, ...
5
votes
3answers
291 views
“Weaknesses” in SHA-256d?
According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:
SHA-256d(x) = SHA-256(SHA-256(x))
Apparently, the motivation for ...
2
votes
1answer
153 views
Understanding one-way hash functions construction
I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools.
But, as a programmer, I am conditioned to see them as ...
1
vote
0answers
64 views
Known-plaintext attack on Blowfish in ECB mode
The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
-3
votes
1answer
178 views
Multi layer encryption with ECB mode [closed]
if i use the 2 of the same key with 2 of the same algoritm when encrypting in ECB like when i have 2 blocks of the same color and i encrypt the 2 blocks with the same color the cipher text should
not ...
2
votes
1answer
90 views
Does the IV need to be known by AES (CBC mode)?
I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
1
vote
1answer
81 views
Zero-knowledge proof that a group element is a quadratic residue?
In a paper it says: "To convince a verifier that a group element is a quadratic residue, the prover executes the following proof with the verifier":
$PK \left\{ (\alpha) : y = \pm g^\alpha \right\}$
...
0
votes
0answers
53 views
How do I generate decryption keys for the IDEA algorithm from the 128 bit key?
I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code:
...
0
votes
0answers
71 views
How secure is this perl script to use an AES encryption on files? [closed]
I am not entierly sure if it is appropriate to ask such a question here, but then again, I don't know a better place. If it is the wrong place, let me know, and I will remove it.
Could someone share ...
0
votes
1answer
38 views
PBKDF2 when dkLen and hLen have the same size
I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
2
votes
1answer
72 views
Question about the definition of a secure PRF
I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF.
I understand the test goes as follows: A challenger picks a function $f$ such that
$f \leftarrow ...
0
votes
2answers
89 views
Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?
If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
1
vote
2answers
278 views
Searching over encrypted data
Is there any library/tool available which can allow me to search over encrypted data?
I would like to encrypt data on client side, send it to cloud and perform search in cloud.
I've been reading ...
2
votes
2answers
63 views
Case insensitive verification of HMAC / Base64 signature
I am signing a short message using the base64 of an HMAC, like this (python):
...
3
votes
2answers
78 views
DSA signatures with related k and unknown payloads
Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
4
votes
0answers
37 views
Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem
If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
0
votes
0answers
54 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
2
votes
1answer
53 views
Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?
I need your help with a very basic concept in cryptography which I can't understand/prove on my own.
I'm trying to prove and understand why, under "indistinguishability in the presence
of an ...
2
votes
1answer
42 views
How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?
I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
