2
votes
0answers
194 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
0answers
105 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
2
votes
0answers
123 views

Computer appliance protocol

I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
2
votes
0answers
176 views

Structure of encrypted office files

I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document ...
2
votes
0answers
221 views

How to properly format a PGP Message Block?

As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
2
votes
0answers
159 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
2
votes
0answers
162 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
1
vote
0answers
23 views

Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
1
vote
0answers
34 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
1
vote
0answers
35 views

Ciphertext size of any CPA-secure public-key encryption scheme

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ...
1
vote
0answers
20 views

Is there an existing AE protocol with forward secrecy for embedded devices?

I'm working on an embedded device that is connected to a computer over an untrusted channel. According to my threat model I need authentication and encryption on the wire with perfect forward secrecy. ...
1
vote
0answers
30 views

Small subgroup attack on Diffie-Hellman

I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime, so the ...
1
vote
0answers
30 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
1
vote
0answers
24 views

Small n attack, how it works

I'm studying the Lamport's Hash one-time password scheme. This is the scheme: Alice wants to authenticate herself to Bob from a workstation that knows nothing about her. Alice only knows her ...
1
vote
0answers
106 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
1
vote
0answers
42 views

How can I calculate the probability of collisions of a hashing algorithm?

I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ...
1
vote
0answers
77 views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
1
vote
0answers
59 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
1
vote
0answers
39 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
1
vote
0answers
14 views

memory hard password based key derivation functions?

How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine. What design could work well with skein? The ...
1
vote
0answers
28 views

FFX Encryption over alphabet of arbitrary radix

I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ...
1
vote
0answers
34 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
1
vote
0answers
32 views

What consequences do the plaintext space size has on the performances in the BGV scheme?

In the BGV paper [1], the authors say in §5.4 that you can have $\mathbb{Z}_p$ as plaintext size with a large $p$. What is the impact of the size of $p$ on the ciphertext size and computational work ...
1
vote
0answers
51 views

ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...
1
vote
0answers
34 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
1
vote
0answers
32 views

Improve security of transposition ciphers

As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not $d$-gram frequencies though, given that $2 < d < L$), or ...
1
vote
0answers
46 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
1
vote
0answers
38 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
1
vote
0answers
31 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
1
vote
0answers
23 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
1
vote
0answers
72 views

Where can I find names for cryptographic notation I don't recognize?

I'm new to this space and find myself stumbling over come cryptographic/mathematical notation. Search engines are not very helpful when copying and pasting Greek letters. Is there any reference that ...
1
vote
0answers
27 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one ...
1
vote
0answers
28 views

Determine safety of exercise hash functions

There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$. Professor A suggests a new function $h_{666}$ with an output length of 666 bits. Professor B suggests ...
1
vote
0answers
30 views

Voting protocol - How many dishonest tallying centres can the protocol cope with?

We have the voting protocol that is described here. I am looking at the following exercise: Determine how many dishonest tallying centres the protocol can cope with before the following properties ...
1
vote
0answers
34 views

Digital signature in a group chat scenario?

I understand that RSA is great for 1-to-1 digital signature. In the group chat of N people, other than storing and maintaining N public keys, is there a simpler way of authenticating each and everyone ...
1
vote
0answers
34 views

What is the general idea of truncated differential attack on hash functions?

What is the general idea of truncated differential attack on hash functions ? i'm using stream cipher and sponge hash construction and i want to know what is the general idea of differential attack ...
1
vote
0answers
34 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
1
vote
0answers
48 views

Secure content-defined chunking

I am writing an app that needs to split a stream of plaintext bytes into variable-sized chunks (for deduplication). The way this is traditionally done is using a rolling hash function defined over ...
1
vote
0answers
61 views

Lightweight hash function

I am researching about lightweight hash functions and I've got two related questions: What is the standard or requirement for a hash function in general to be considered lightweight ? Why can it be ...
1
vote
0answers
65 views

Is there a mental poker algorithm that does not rely on commutative encryption?

The algorithm for mental poker that I saw on Wikipedia and everywhere else relies on an encryption algorithm such that $E_k(E_j(P)) = E_j(E_k(P))$, but I can't find a modern and secure algorithm for ...
1
vote
0answers
37 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute ...
1
vote
0answers
55 views

Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
1
vote
0answers
68 views

Does the encryption algorithm DES perform random permutations? If so how is information not lost?

Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are separately permuted (shuffled) My question is this : Is the shuffling of the bits performed ...
1
vote
0answers
44 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
0answers
47 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
1
vote
0answers
47 views

How do I verify a reset token if the token is hashed in DB?

I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, ...
1
vote
0answers
41 views

Commitment scheme to share money

I have such problem: party $X$ has an amount of money $M$, which it needs to share with $n$ other parties. Every week the amount of money is different. Let say not, that I am a party A, which is one ...
1
vote
0answers
139 views

Proper way to generate symmetric keys

I'm trying to educate my self in key management, how to store them, how to generate them, how to use them properly. I've been trying to find how you would generate a key for symmetric encryption (say ...
1
vote
0answers
74 views

Why is it a bad idea to use Diffie-Hellman with a prime such that $p - 1$ is smooth?

I recently stumbled upon another question in which somebody menitoned that using custom primes for DH is safe if you keep in mind, that $p-1$ should not be a smooth number. Why is that?
1
vote
0answers
57 views

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the ...

15 30 50 per page