0
votes
1answer
28 views

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space?

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space? It the reason why this is not generally done because of a meet-in-the-middle attack?
3
votes
2answers
60 views

A bijective hash function

Suppose: $H: \{0,1\}^{n} \rightarrow \{0,1\}^{n}$. $H$ is bijective. It is difficult to derive $x$ from $H(x)$. Is this type of function possible? What would the strength of it be? I realize that ...
1
vote
1answer
25 views

Multiplexed stream cipher

Consider the stream cipher that consists of 3 LFSRs, with the output of one coming being used to determine which of the other 2 is used that clock cycle. Both the IV and the polynomials are secret. ...
3
votes
1answer
43 views

(How) Can we use HOTP for file encryption?

I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key. Now I trust the developer of this plug-in who is ...
1
vote
1answer
27 views

Encryption strength when using a PBKDF

Suppose: $m$ is a positive integer. $n=2 \times m$. $H: \{0,1\}^{*} \rightarrow \{0,1\}^n$. $p$ is a password. $s$ is a salt. $K=\{0,1\}^n$ is the derived key. $PBKDF(p,s)$ derives a key from $p$ ...
-3
votes
1answer
88 views

How to Perform Computation on AES Encrypted Data

I have this code that successfully performs symmetric encryption using AES algorithm. How can I go about performing computation on it to achieve somewhat homomorphic encryption? ...
3
votes
1answer
68 views

How to prove hardness of approximate-GCD problem?

I am trying to prove the security of my system using the hardness assumption of the approximate-GCD problem using contradiction, i.e. If the attacker is able to break in our scheme, then attacker ...
3
votes
2answers
539 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
0
votes
1answer
36 views

Robust combination of two Password Based KDFs

I am researching some different constructions for combining two Password Based Key Derivation Functions in a robust manner to prevent weaknesses in a single algorithm from reducing the security of the ...
3
votes
1answer
35 views

Is LUKS Anti-Forensic information splitter (AFsplit) indistinguishable from random data?

I want to know if AFsplit(random_data_input, stripes, digestmod=sha) output is indistinguishable from random data. The purpose ...
0
votes
2answers
49 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
8
votes
1answer
102 views

How do voters verify a Helios (v3) election result?

So from my understanding of verification specification version 3, a Helios election proceeds as follows: A voter retrieves the system's public key to encrypt their vote & submit it. The voter ...
0
votes
1answer
49 views

Is it possible to brute-force a hash algorithm of 32 bits

I have a 30000 user passwords and usernames stored in a table on a database in which the passwords are stored as hash where ,I need to guess the passwords for all users and I have the hash function ...
1
vote
1answer
33 views

How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
0
votes
1answer
50 views

Homomorphic Encryption or not

I am a beginner to homomorphic encryption scheme. As far as I think, it is just a kind of concealing real value without using standard encryption algorithms such as AES,DES or RSA. For example , for ...
1
vote
0answers
44 views

Format Preserving Encryption FF1 Samples

NIST published methods for Format-Preserving Encryption and there is a link in the document giving examples for FF1 methods. I am confused by the value of R given in the examples. $R$ is the output ...
0
votes
2answers
65 views

SHA1 collision for first 32 bits for two different message

Is it possible to create a program to find the collision of 2 different message but with same first 32 bits using sha1 hashing? I tried using a while loop but it run endlessly as though no match is ...
2
votes
0answers
57 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
2
votes
1answer
110 views

Top notation as exponent

In cryptography, what does the Top notation mean? It resembles a capital T: T In particular, I saw it in the follwing context: $c = (c_1,c_2)^\top$ where $c_1$ and $c_2$ are homomorphic ciphertexts ...
3
votes
1answer
100 views

Time taken for a brute force attack on a key size of 64-bits

You can do $2^{30}$ encryptions per second and the key size is 64 bits. $2^{64}/2^{30}$ should give me the time taken for a brute force attack? What if you double the key size? How can I calculate ...
3
votes
0answers
62 views

How to attack polyalphabetic affine cipher with only ciphertext?

How to attack polyalphabetic affine cipher with only the ciphertext? A polyalphabetic affine cipher can be seen as the composition of an affine cipher ($p \mapsto c \equiv a \times p + b \pmod{26})$ ...
0
votes
2answers
75 views

What is necessary for generating an elliptic curve?

Let's say I want to generate my own elliptic curve with an order whose bit length is $n$ (specifically 2048, 4096, and/or 8192)? How would I do this? What needs to be done? What software can do this? ...
0
votes
0answers
10 views

Do eCryptfs encrypt same source files into same retulsing encrypted files?

Can I assume that for given eCryptfs mount, files with byte-by-byte same content will map into byte-by-byte same encrypted files in underlying filesystem (i.e. after umount) ? (i.e. if resulting ...
1
vote
0answers
29 views

WPA-PSK authentication without password [closed]

Suppose I have a service in which I allow users to share their WiFi connection. When sharing their connection, users provide their WPA PSK password to my service. Now if somebody wants to use this ...
0
votes
2answers
25 views

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so ...
5
votes
1answer
61 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
4
votes
1answer
61 views

Beavers Triple Vs BGW Multiplication on MPC

Typically MPC protocols that are secure against semi-honest adversaries recommend the use of the revised GMW multiplication protocol by Gennaro et al. This is not the case against Active adversaries ...
0
votes
1answer
53 views

How does Hash with random cryptography work?

I am new in this world of cryptography and while reading some articles I got stuck into something that I did not understand correctly: the use of hash based on random cryptography. On my knowledge, ...
1
vote
2answers
86 views

Is Threefish the only cipher with 1024 bits of security?

Threefish has up to a massive 1024 bits of security. Is it the only cipher with such overkill security?
5
votes
0answers
53 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
3
votes
0answers
61 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every ...
1
vote
1answer
49 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
2
votes
1answer
171 views

What is the meaning of IND-CCA secure under standard model? [duplicate]

I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
0
votes
0answers
27 views

Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
1
vote
0answers
32 views

Increase in security with increase in size of salt [duplicate]

Does increasing or doubling the size of salt result in improved security? It will require some extra time to brute force the passwords, but any added advantage?
3
votes
1answer
75 views

Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
6
votes
2answers
95 views

Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...
-2
votes
0answers
37 views

What is the definition of Selective Security?

What exactly is the definition of "selective security"? For instance, it is used in [KSW'13] (Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products), but is there a ...
0
votes
1answer
71 views

Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $ \in $ $Z^*_{N}$ is a "good" point for 'I', ...
3
votes
1answer
99 views

ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
1
vote
1answer
29 views

SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,

From Wikipedia I read SHA-1 function produces an output of 160 bits and expects a max message size of $2^{64}-1$ bits. Is that right? If I order all possible inputs I would produce $\approx ...
3
votes
0answers
38 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
3
votes
1answer
83 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
0
votes
1answer
17 views

Deriving Minimum Description Length of Substitution Key

Given a plaintext: Now is the time for all good men to come to the aid of their country because the quick brown fox jumped over the lazy dog. and a substitution ciphertext: Mpe od yjr yo,r ...
3
votes
0answers
58 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
1
vote
1answer
51 views

Huffman coding is a prefix code, proof [closed]

How would you prove that Huffman coding $C$ is a prefix code, i.e $$\forall x,y \in C,\ \forall z \in \lbrace 0,1\rbrace^*,\ x\not=y||z$$ Using induction according to the number of items to code? ...
4
votes
1answer
42 views

How does order-preserving encryption work on string?

I have read “How does order-preserving encryption work?”. After that, I completed order-preserving encryption on integer data. Now, I have four questions in this subject: Is it possible to apply ...
-2
votes
3answers
534 views

How to reverse this hash function?

I have a function that takes an $m$ byte inputs $x_i$ and maps it a 32 byte outputs $y_j$. The hash function is defined as: $$y_j = \sum_{i=1}^{m} (x_i)^{i-1} \pmod {127}$$ The input is restricted ...
3
votes
3answers
71 views

Are there any hash functions that use integers of arbitrary bit size (e.g., int63)?

More precisely, I am looking for hash functions where the internal state can be decomposed as a vector of integers of size 63. That is, machine integers where one of the bits is fixed and unusable.
1
vote
0answers
16 views

Sigma protocol: witness hiding

I am working on an assignment and I am stuck with the last part of proving witness hiding for the protocol. I have previously proved it is witness indistinguishable, and it has q (primer number ...

15 30 50 per page