# All Questions

43 views

### CBC MAC and DES combined question?

Suppose that we want to develop a MAC scheme which is as secure as Triple-DES CBC-MAC and at the same time as efficient as Single-DES CBC-MAC. We come up with the following idea: Except the last ...
103 views

### Generalize the Merkle-Damgard construction for any compression function

I am trying to figure out this question: Generalize the Merkle-Damgard construction for any compression func­tion that compresses by at least one bit . You should refer to a general input length ...
18 views

### Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
81 views

### Why does computing g^a * g^{-a} with the PBC library result in zero?

My example code is as follows: /* * Example 1 * 1) Calculate g^a * 2) calculate g^{-a} * 3) multiply g^a * g^{-a} * */ Note: here ...
81 views

### Cryptography Implementation in software

I am trying to implement a password manager in C and I had a question about the proper steps in implementing the crypto. I looked at some implementations, google talks on crypto and what the standards ...
41 views

### Is anyone aware of Du atallah multiplicative secret sharing scheme for dot products for > 2 party scenario?

I am working on Du Atallah's multiplicative secret sharing scheme for more than 2 party scenario. Is anyone aware of its multiparty version (more than 2 parties). The paper for 2 party can be found ...
64 views

For example: I have 3 plaintexts ($a$, $b$, $c$) and 4 keys ($K_1$, $K_2$, $K_3$, $K_4$), making a table map to the cipher text, key as row and plaintext as column $\begin{matrix} \ \ \ \ \ \ \ \ \ \ ... 0answers 79 views ### El Gamal encryption scheme and symmetric encryption scheme Consider the El Gamal encryption scheme, a symmetric encryption scheme (KG,E,D), and the following hybrid encryption scheme having an encryption algorithm that, on input a public key (G,q,g,h), where ... 0answers 75 views ### How we transfer 128bits cipher to a 4x4 matrix for AES input? Why the input cipher for AES encryption, can write in 4x4 matrix with 8 bits entires, and can said is 128bits? if each cell is 8bits in binary, how we said this matrix is represent 128bits? 0answers 37 views ### Index of coincidence for completely random text over k alphabets I'm confused about /Friedman's method 2 (using a table with column of k size of key, and n/k rows, n is the total size for cipher text) m = ... 0answers 76 views ### Is this a correct understanding of Universal Hash Functions? I'm studying universal hash functions and have been reading several papers but now i'm focusing on Wegman and Carters original paper from 1979 (Universal classes of hash functions) and the H1 class. ... 0answers 51 views ### Reliability of a single-pass deniable authentication protocol? I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ... 0answers 76 views ### Hill cipher key space Key space is the set of all possible keys that can be used to generate a key. We using the number of valid key to describe it. I've given a hill cipher of block size$k$over alphabet of size$p$, ... 0answers 66 views ### Is there a malleable pubkey digital signature scheme? I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature$s=\text{sign}(sk,m)$(for a private key$sk$and a message$m$) into a signature ... 0answers 63 views ### Definition of a Statistical Test In Professor Boneh's online Cryptography course at Coursera, I am a little puzzled by his definition of a statistical test where he writes: A(x) = iff |#0(x) - #1(x)| <= 10.√n Now, if – as ... 0answers 39 views ### Separate TLS Client Write and Server Write Keys in AES-CCM Mode I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ... 0answers 51 views ### Is timestamping possible without publishing? The Wikipedia article Trusted Timestamping states that we can timestamp data by publishing it's hash. Publishing can be done either independently or via a third-party publisher, as explained by ... 0answers 137 views ### For a one-time pad, which MAC method is information-theoretically secure? In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ... 0answers 38 views ### Delinearization in whitebox techniques I'm reading through Chow et al.'s paper and Link et al.'s paper. There's a part I don't understand about Delinearization. They convert some steps of AES/DES into a Matrix, then divide the matrix in ... 0answers 70 views ### How to compare different signature scheme's performance? I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ... 0answers 54 views ### Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist To my understanding in a 1-n Oblivious Transfer the Sender has some Values$X_1...X_N$and the receiver wants to retreave some$X_I$, with$1 \le I \le N$. Can one now somehow guarantee, that the ... 0answers 69 views ### Is Encryption without knowing the input directly possible at all? I know the question is rather unusual, but let me clarify what I'm searching for: There is one person, lets call her$Alice$.$Alice$has$n$plaintexts$t_1..t_n$and$n$public keys$pk_1..pk_n$of ... 0answers 115 views ### Defending hybrid encryption schemes against padding oracle attacks I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ... 0answers 115 views ### Challenge–response authentication which can be done in head? Say we have door where you have to say a password to pass. If theres someone standing nearby he would hear the password and could also use it. So therefore the doorman gives you a different number ... 0answers 38 views ### Distributed authentication in low trust environment I would like to inquire if there is any Method to achieve the following: There is a list$L$of$n$entities that are allowed to perform a certain action.$L$is cryptographically signed by some ... 0answers 51 views ### 1-1 trapdoor function mapping the set of$n$-bit numbers to themselves I am looking for a trapdoor one-to-one function$f : \{0,1\}^n \rightarrow \{0,1\}^n$(that is, mapping the set of$n$bit numbers 1-1 onto itself [any$n$is OK]). I was considering the use of ... 0answers 44 views ### Client puzzle using hash When a server is under attack, it send the client the following data: Nonce - a byte array of Y length Hash - the hash digest of the puzzle solution The client has to find X such as ... 0answers 73 views ### RSA timing attack Given an RSA implementation that uses Montgomery multiplications and CIOS exp algo, but NOT CRT. Given a decryption1 oracle that takes chosen cipher text and responds the plain text and the time it ... 0answers 34 views ### McEliece information set decoding attack vulnerability Wikipedia states that McEliece is open to "information set decoding attack". What is an "information set decoding attack" and how serious is the vulnerability? (is it just a matter of choosing proper ... 0answers 77 views ### Public-key based on roots of polynomial In general it's hard to calculate the roots of a given polynomial P(x). But the other way back calculating the coefficients is much easier (Vieta's formulas). If this is a one-way function, is it ... 0answers 125 views ### Is this a secure (and correct) sign-then-encrypt technique for transferring messages? After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ... 0answers 69 views ### Problem implementing MixBytes functionality in Groestl Disclaimer: School work. I am trying to implement Groestl through Java, and have got stuck on the MixBytes section which can be found here section 3.4.5 page 11. As per the description of matrix ... 0answers 79 views ### Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ... 0answers 122 views ### AES encryption takes more time to decrypt than encrypt Please let me know if this is not the right place to ask this question. I will remove it. I am trying to find how much time an AES encryption and decryption takes for a given amount of data and key. ... 0answers 129 views ### Rainbow tables and blowfish I'm thinking of implementing rainbow tables for a specific blowfish problem, but I have trouble thinking of the proper way to apply the original paper (and its application to hash functions) to ... 0answers 104 views ### Sane implementations of Bitcoin cryptography routines w.r.t. side-channel attacks Bitcoin uses SHA-256, Base58Check, ECDSA (Sep256k1) and RIPEMD-160 as the basis of its encryption (see this article for a short guide on how addresses are created). I would like to create an ... 0answers 71 views ### Parallel-resistant proof-of-work scheme without hidden knowledge Follow-up to: Parallel-resistant proof-of-work scheme? Is there a proof-of-work scheme that: can only be solved serially; given the solution, can be verified in minimal time; deterministically ... 0answers 88 views ### Weil pairing implementation - low level programming language I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ... 0answers 81 views ### Is MITM possible after key exchange phase done successfully in RSA? Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ... 0answers 42 views ### Random numbers for Master Key and Key_block Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ... 0answers 96 views ### Should layered use of crypto always have a cryptographic binding between the layers? Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ... 0answers 204 views ### Using RSA key pair for file encryption I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server. A form of PK encryption seems ideal for this, as I can store the ... 0answers 71 views ### IND-CPA Security Given a key$K$(the key is fixed) and a nonce$N$(changes from one message to another) Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for ... 0answers 41 views ### Determine the iteration times using Pollard's rho Method for factoring Let's say, we have a large number$n=181937053$and$f(x)=x^2+1$. And also we know that$n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ... 0answers 59 views ### Sextic twist of BN pairing parameters vs security I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field$\mathbf{F}_{p^{12}}$for some ... 0answers 92 views ### Gallant-Lambert-Vanstone method I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split$K$into$k_1$and$k_2$etc. for the curve I'm ... 0answers 81 views ### What is the forward cipher function of AES-XTS? We're using OpenSSLs EVP_aes_265_xts encryption on data (with unique, random, IVs for every new message encrypted) - which is working well. But, I've been asked; what is the forward cipher function ... 0answers 119 views ### What RC4 key value will completely invert$S$after initial permutation? What RC4 key value will completely invert$S$after the initial permutation, so that$S[0] = 255, S[1] = 254, …, S[254] = 1, S[255] = 0$? 0answers 94 views ### Attacking hashed password by timing attack and other means This question is inspired by this recent one, which raises a point that need to be made quantitative to be meaningfully discussed. I chose an unusual approach: a new question worded as homework that ... 0answers 75 views ### Which gives better deterministic encryption SIV or Plain ECB mode? Lets say , if we encrypt a plain text message$msg$with key$key$in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$,$msg$) SIV($key\$, NIL , ...

15 30 50 per page