All Questions

30 views

How can Käsper and Schwabe's Bitsliced AES Mixcolumns work

The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed. ...
15 views

DROWN - decrypting ServerVerify message is not enough?

I have read this article, but I can't understand why after decrypting ServerVerify, the client needs to send the export grade PMS again... When exploiting these flaws the attacker will send its ...
85 views

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = ... 0answers 67 views Simulation-Based Proof: When a Secret Key is Involved Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key. We want to construct a simulator for this party (so this party ... 1answer 41 views Access control problem in oblivious transfer I am not sure whether the title is proper or not, but this question comes to my mind when I was reading$k-n$oblivious transfers. In a$k-n$oblivious transfer (OT) protocol, a party A has$n$... 0answers 49 views Security of Fernet Construction Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ... 1answer 92 views RSA Encryption problem for Discrete Math I am doing practice problems for my upcoming final exam, and am having trouble with this RSA encryption problem. If any one could check to see if i did these correctly, it would be greatly ... 1answer 65 views ORAM over Third Party DB Oblivious Ram (ORAM) is a cryptographic technique that is used for secure DB querying without leakage on the access patterns. There are several schemes for ORAM, amongst the most popular ones, there ... 1answer 55 views Safe MD5 digest So I've heard that MD5 is broken because it's possible to engineer collisions. So instead we should use, say, SHA256. The problem which SHA256 digests is that they are long. So I've come up with this: ... 1answer 185 views State recovery of Micalli-Schnorr random number generator modulo a prime Let$p$be a public prime of$n$bits. Define the sequence$x_i=z_{i-1}^e \bmod p$, where$z_i$is the$k$high-order bits of$x_i$, and$r_i$the remaining$n-k$bits of$x_i$(thus ... 2answers 1k views NIST Diffie-Hellman prime: how was it picked? Where did it come from? According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ... 1answer 59 views Does sending the same message with 2 different keys in OTP leak information? Suppose a common message ($M$) is XOR'ed with two different keys$K_1,K_2$producing two ciphertexts$C_1,C_2$. Thus, $$M \oplus K_1 = C_1\\ M \oplus K_2 = C_2$$ On observing$C_1$and$C_2$, an ... 0answers 31 views Does revealing shares of the result reveals shares of the inputs? Suppose Alive and Bob have shares of two polynomials$P,Q$, say, Alice knows$P_A,Q_A$, Bob knows$P_B,Q_B$s.t.$P=P_A+P_B$and$Q=Q_A+Q_B$. They perform some operation$f$over the shared values, to ... 1answer 85 views Is Using Digital Signatures to prove identity a zero knowledge proof? Suppose Alice publishes a book with a public key in it, and later wants to prove that she wrote the book. She could sign challenge messages with her private key, and others could verify those signed ... 2answers 71 views Can CMAC be used as a 128bit Key Derivation Function? I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one. The logic looks something like this: ... 1answer 57 views How can I show RSA OAEP IND-CPA secure How can I show, that RSA with OAEP is IND-CPA secure by using G,H one way function? 1answer 99 views How much weaker is AES-64 than AES-128? It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ... 0answers 16 views finished message layout in TLS version 1.2 [duplicate] Is there anyone that can explain what wrong with my understanding about 'finished message layout' in TLS version 1.2 ? I'm trying to implement it for my own purpose, upgrading host-to-host ... 1answer 49 views Given a hash function how to find all/some inputs that hash to 0? [duplicate] Say I have a simple hash function where$x$is a sequence of integers: $$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$ where$a_1,a_2,a_3,...,a_n$is the coefficient ... 1answer 37 views Yao's Garbled circuit: Does Bob ever see the circuit? I asked a question about whether the circuit structure for Yao's garbled circuit needs to be rearranged. I understand from Yehuda Lindell's response that the circuit structure itself does not need to ... 1answer 34 views What are the pros and cons of SIP media encryption types SRTP, ZRTP, and DTLS? I'm just getting used to SIP for my first time using Linphone. Which encryption is better and why? My Settings > Network > Media Encryption has the options of SRTP, ZRTP, and DTLS. 0answers 46 views Encrypting/Decrypting using RSA and AES; standards? I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ... 1answer 54 views How to find collisions in a hash function knowing its coefficent? Say I have a simple hash function where$x$is a sequence of integers: $$h(x)=(a_1\cdot x_1+...+ a_n\cdot x_n) \bmod N=\sum_i a_i\cdot x_i \bmod N$$ where$a_1,a_2,a_3,...,a_n$is the coefficient ... 0answers 24 views Proving CCA security for scheme constructed from secure PRP We have a$PRP : \{0,1\}^{3n} \rightarrow \{0,1\}^{3n}$and encryption scheme constructed from this$PRP$.$E_k(x\|r\|0^n)$, where$r$is randomly chosen from$\{0,1\}^n$and$0^n$is a block of ... 1answer 64 views Diffie-Hellman: Calculating the private key from the public key with Java I have the task to calculate the private key from the given public key and have the hint that the secret exponent lies in the range from$-2^{31} < e < 2^{31}$. To find the exponent I ... 1answer 39 views DROWN Attack - Which is the SSLv2 vulnerability exploited? In order to get the session key used in TLS communication, an attacker must capture X TLS handshakes based on RSA key encryption, and switch to a server supporting SSLv2 protocol, and sharing the same ... 1answer 53 views Handshake SSLv2, SSLv3, TLS Can someone confirm that SSLv2, SSLv3, and TLS have the same Handshake process (ClientHello/ServerHello, ..., ClientKeyExchange ...)? If not, can you tell me the main differences between theses three ... 2answers 80 views Why are MACs not included when defining Protocols? I see often in literature related to cryptographic protocols that MACs (Message Authentication Codes) are not included in protocol definitions. For example: ... 1answer 89 views Noise in Homomorphic encryption What is the noise in homomorphic encryption schemes? (or where does the noise come from, I see that its inbuilt in the scheme and is not a side channel or disturbance noise) Is it also due to the ... 1answer 295 views An example of of an information theoretically secure protocol that is not cryptographically secure Does there exist a protocol$\pi$for some functionality$F$which is information theoretically secure protocol that is not cryptographically secure for some threshold number of corrupt parties? ... 1answer 45 views How do you prove an encryption scheme is IND-CPA or IND-CCA? I know for proving a scheme is not IND-CPA or not IND-CCA you can construct an Adversary which has an unfair advantage in an experiment/game, but how would you prove a scheme is IND-CPA or IND-CCA? 2answers 70 views RSA: select$e$given$n$and$\varphi(n)$I have a question for a course I am doing. In an RSA question, it asks "Is it possible to select$e$in such a way that it coincides with the corresponding private key$d$? If it is possible, provide ... 0answers 25 views A question about pseudo random generators with seed that starts with a 0 Given that G is prg, is the following always a prg? G'(s)=G(0•s) I know that if there was a random bit instead of the leading 0 it was a prg, but I don't know about the leading 0. Thanks a lot 2answers 49 views Yao's Garbled Circuit- Why does Alice need to rearrange the circuit? My understanding of Yao's Garbled Circuit (based mostly on this summary) is as follows: Alice creates a garbled circuit based on the function f to be computed. She then hard-codes her input into the ... 1answer 165 views How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer? So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ... 1answer 60 views How to find$e$when$p,q,d$are given? I have solved till here ..... $$n=p*q$$ $$n=5*11$$ $$\varphi(n)=(p-1)*(q-1)=4*10=40$$ Now, how to find$e$, when$d$is given as$27$and message for encryption is$\text{abcdefghij}$. We have to take ... 1answer 44 views How can bit slicing be constant time, when Mix Columns is in the cipher I'm reading about bit-slicing techniques, and one thing about it caught my mind. The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ... 0answers 43 views Attacking AES-CTR mode with known prefix [duplicate] My question is the following: Consider a 128-bit AES-CTR mode encryption on a plain-text$m$. The structure of$m$is constant. First comes a string, let's say : "JustSomeText\" followed by 5 ... 1answer 42 views BB84 quantum protocol In BB84 protocol, when Alice and Bob make key distribution, what is the private thing? They select randomly bases and then make a measurement according to these bases. Used bases are private? I mean ... 2answers 167 views Should HMAC-SHA3 be preferred over H(C(k,M))? If I understand correctly SHA-3 (Keccak) is resistant against more attacks than SHA-2. This would make it possible - again if I understand correctly - to use SHA-3 with a simpler scheme than HMAC. ... 0answers 39 views MD5 - Length extension I am currently trying to get a working understanding of MD5 length extension. I have been following the first exercise located here: https://www.cis.upenn.edu/~cis331/proj1.pdf (it looks like the ... 0answers 10 views Charm-Crypto: Got <terminated, exit value: 139> when trying to serialize object [migrated] I'm implementing a Dabe scheme with Charm and I need to share the public parameters over multiple entities. I'm trying to serialize the charm object containing these parameters using objectToBytes() ... 1answer 523 views Are there attacks on AES with 16-bit keys? [closed] Are there known attacks on AES that uses a 16-bit key? Assuming the data can be 95MB size, and that I can request the same data over and over. For example, can someone explain to me how this code ... 2answers 27 views Validating subset of a password Is anyone aware of an algorithm/method that allows me to validate just a few letters (or other characters) from a password. For example, the application asks for the 2nd, 3rd, 6th and 9th letters from ... 2answers 135 views Why do cryptographic hashing and symmetric encryption use different functions? Something about encryption and hashing has always bothered me. Given a cryptographically secure hash function$H$, I can produce an arbitrarily long key from any seed$s$by recursively applying$H\$ ...
46 views

I have hard time finding introductory book talking about details of secure multiple party computation. Is there any recommendations? Thanks for the help. Hope this is not off topic.
43 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is ...
45 views

Encrypting using “Cryptography.HMACSHA1”, how to decrypt (VBA)

I have an encryption routine that works very well in VBA. But now I need to program the decryption routine, and I'm stuck. For encryption I'm using HMACSHA1 and transferring the encrypted byte to base ...