2
votes
1answer
72 views

Ring-LWE elliptic gaussian distribution

I am currently trying to understand this Ring-LWE article: http://www.cims.nyu.edu/~regev/papers/ideal-lwe.pdf and I have a question. Firstly, it is mentioned in the paper that we can view the ...
2
votes
1answer
280 views

Why should the primes used in RSA be distinct?

The two primes $p$ and $q$ part of the public key need to be distinct. What's the reason for them to be distinct? Is it because factorization of $p^2$ where $p$ is a prime is relatively easier, or is ...
-1
votes
1answer
36 views

What is the meaning for a vector mod a matrix in a lattice?

I'm reading about the lattice recently.In the paper, it gives a method of a vector mod a matrix: ⃗c mod B as ⃗c−⌊⃗c×B^(−1)⌉×B = [⃗c×B^(−1)]×B. I know that a integer A mod the other integer B is ...
1
vote
1answer
82 views

Is there a scheme that allows to use RSA based challenge response protocol limited to signing only 8 bytes to create a secure signature of any data?

I have a tiny device that has a challenge-response authentication mechanism where the device signs 8 bytes of any data with it's internal 2048 bit RSA key. I would like to be able to certify any data ...
1
vote
1answer
45 views

AES-CBC pre-determined IV vs. null IV

Is there any security advantage to using a pre-determined IV in CBC mode over a null IV? I'm implementing a license key system similar to this article on CodeProject, but I'm confused by the authors ...
7
votes
4answers
4k views

Simply put, what does perfect secrecy means?

I would like to ask for a clear (but maybe not so deep) explanation of what the term "perfect secrecy" means. As far as I have researched and understood, it has to do with probabilities of assuming ...
1
vote
1answer
37 views

Pseudorandom functions: how are functions stored?

I am wondering about the setup for testing if a function family is pseudorandom. We step into a room, and query the black box with $x$, which yields $f(x)$, etc... We don't know if $f$ is a random ...
0
votes
1answer
71 views

What is the meaning of h(r) in this protocol?

Could somebody tell me what the meaning is of $h(r)$ in the protocol below? ‎‎$A‎\leftarrow‎{B}\quad:{h(r)‎‎}{,B}{,P{_A(r,B)}}‎ \\A‎\rightarrow‎{B}\quad:r$
0
votes
0answers
19 views

how to implement order preserving encryption except cryptdb

Which cryptographic algorithm is suitable for implementing order preserving encryption with out using cryptdb
4
votes
1answer
81 views

How to generate new LWE samples

Assume we are given a small fixed number of LWE samples with secret $s$ and error $e$, where the error distribution is taken so that the LWE problem is hard. My question: How can one further ...
8
votes
1answer
293 views

Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

As I understand length extension attacks, they depend on the coincidental property of most cryptographic hash functions that the hash value is exactly the hash function state after hashing the last ...
3
votes
2answers
324 views

Is there a multiple asymmetric encryption algorithm, which requires all private keys to reveal the secret?

I am looking for an asymmetric encryption algorithm, which allows to encrypt a secret with multiple public keys, but to reveal the secret all private keys must be used. You shouldn't be able to tell ...
0
votes
0answers
5 views

Saving passwords in database [migrated]

I recently studied a lot about writing secure codes and choose secure method to save the password in database. My question is: is it secure to use ready made libraries or API's for this reason? How we ...
0
votes
0answers
6 views

where to store the salt for “crypto_pwhash” in a web application with no local storage [migrated]

I am developing a web application which stores encrypted data on a server. To derive the encryption key as well as the login key, I want to use libsodiums crypto_pwhash. To use this function it needs ...
0
votes
3answers
51 views

Computational indistinguishability: are function parameters known?

I would like to clarify something about the definition of computational indistinguishability and pseudorandom number generators. Suppose we wanted to show that linear congruential generators of the ...
0
votes
0answers
14 views

Massey-Omura three pass protocol prime modulus share

In Massey-Omura three pass protocol: how many bits long should be the prime modulus $M$ in order to be secure? should be the the $M$ secret? should be the $M$ generated every time or it could be ...
3
votes
2answers
87 views

What is the difference between the standard representants of $\mathbb Z/q\mathbb Z$?

The symbol $\mathbb Z/q\mathbb Z$ (given that $q$ is prime) represents the prime field $\mathbb Z_q$. Basically, the elements of this field are represented by $\{0, 1, \dots, q-1\}$, let's call this ...
0
votes
1answer
43 views

Ephemeral Diffie-Hellman in a symmetric crypto context

I'd like forward secrecy in a case where the two sides have a shared long-term symmetric key. I intend to use AES in GCM. It looks like ephemeral Diffie-Hellman is the best way to generate the session ...
2
votes
1answer
116 views

What's the differences among Blind Computation, Secure Multi-Party Computation, Secure Circuit Evaluation and Homomorphic Encryption

We know that Blind Computation, Secure Multi-Party Computation, Secure Circuit Evaluation and Homomorphic Encryption all can process the encrypted data, but I am puzzled by them. What are their ...
4
votes
0answers
39 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
0
votes
1answer
68 views

Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
0
votes
1answer
26 views

Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'

I would like to transpose the Ed25519 ref10 implementation to a similar twisted Edwards curve that is based on another prime, in order to have the same speed optimizations in place for the new curve. ...
0
votes
0answers
15 views

DSSP reduction to DSSI

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" by DeFeo, Jao and Plut (PDF), there is a reduction from the Decisional Supersingular Product (DSSP) problem to ...
0
votes
1answer
38 views

Distinguishing between two probabilities and the uniform probability

Say I have a polynomial adversary $A$ that can distinguish with a non-negligible adventage between $x$ generated from a probability $X$ and $y$ generated from a probability $Y$. Obviously, this ...
5
votes
2answers
285 views

SHA-256 exhaustive search

How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (together with a salt)? Are there any formulas that can be employed? For ...
1
vote
4answers
80 views

How is an epsilon of 1/1000 non-negligible?

Lately I've been studying cryptography and in the current course I'm taking we're reviewing statistical tests and how they can be used to determine if a pseudo-random generator is secure or not. ...
0
votes
1answer
44 views

Brute forcing the secret key in Elgamal encryption

Crypto noob here, I am attempting to do this programming challenge. I do not have the secret key that is used to decrypt the message. However, the key is small enough for a brute force approach. I am ...
2
votes
1answer
53 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
0
votes
2answers
50 views

How to compute two EC point multiplication?

I would like to know how to compute multiplication of two valid EC points over a curve E with generator G. i.e. Given only P and Q points then how to compute R = P * Q where $P = p G$, $Q = q G$ and ...
1
vote
0answers
27 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
3
votes
2answers
199 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
3
votes
1answer
102 views

Does exponentiation by squaring work on Montgomery curves?

Consider the point multiplication $Q=[d]P$, where $P$ a point on elliptic curve multiplied with an integer $d$ to get another point $Q$ on the same curve. This operation can be computed by a ...
2
votes
1answer
178 views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
4
votes
1answer
235 views

Fractal Merkle Traversal

I am studying Fractal Merkle Tree Traversal algorithm in the book “Post Quantum Cryptography” (PDF). On the [pag. 54] I don't understand this paragraph: We may determine the number of pebbles ...
1
vote
0answers
20 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
1
vote
2answers
44 views

Is this commutative encryption protocol secure?

My assumptions are: encryption must be commutative man-in-the-middle is not an issue I would like to implement the following scheme between 2 parties ($A$ and $B$) to exchange a key: Lets $C = P ...
1
vote
1answer
48 views

Is ElGamal IND-CCA1?

We all know that textbook ElGamal falls due to chosen ciphertext attacks, because of its multiplicative homomorphic property ($E(A)*E(B)=E(AB)$). However these attacks require the ciphertext ($E(A)$ ...
0
votes
0answers
26 views

implementation of digit serial architecture

I am working on architecture of SIMON cipher where I have to use either bit serial, parallel or digit serial to implement the algorithm for each round function and also for sub-key generation. So I ...
2
votes
1answer
98 views

Given only RSA public key parameters, what security issues might I be able to detect?

I'm attempting to automate some checks against a large list of .NET assemblies, and want to include a test to see if the RSA parameters used to sign the assemblies are sensible. However, since I don't ...
2
votes
2answers
204 views

Why do we need to hash both the message and the $h$ value in ElGamal signature?

The professor left us a question on ElGamal signatures: Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
2
votes
1answer
39 views

Salting in asp.net?

I have spent the past hour reading up on salting and still don't understand how it is achieved. Forgive me if im wrong, but the way I am thinking of salting is, storing an ArrayList of random strings ...
1
vote
1answer
53 views

RSA signatures without padding

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
2
votes
3answers
75 views

Are there transitive ciphers (either symmetric and asymmetric)

Say Alice has information that's already encrypted with Bob's key. She wants Bob to decrypt it without knowing what he just decrypted. So she encrypts it with her key and sends it to him, he decrypts ...
3
votes
1answer
52 views

Is there any good reason to chain HMACs in this manner?

I am looking at some decompiled Java code from an Android app. As a security measure, a signature is passed as a parameter to a number of JSON requests. The method that generates the signature is as ...
27
votes
4answers
4k views

How are primes generated for RSA?

As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
0
votes
1answer
51 views

How are messages from server secured when using SSL certificate

In case of using SSL the certificate server has a primary key and a public key that is published to all clients - as far as I understood. So in this case when message is encrypted by public key (on ...
2
votes
1answer
130 views

Is this variant of SRP useful?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
5
votes
1answer
80 views

What is degree of randomness in individual bits of MD5 hash?

I am researching on Hashing Algorithms and would like to know if we take individual bits of MD5, say we take first 8 bits or any random 8 bits of MD5 then what is the randomness probability of having ...
13
votes
1answer
792 views

Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
3
votes
1answer
50 views

Why recently Edward curve formulas being developed that deviates from unification?

Edward curves were considered initially because it provides a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...

15 30 50 per page