# All Questions

49 views

I have just started reading the Scale-Invariant Fully Homomorphic Encryption over the Integers paper and I'm a bit confused about something: When decrypting the ciphertext: $c = r + (m+2r^*) \cdot ... 0answers 54 views ### Using a product of a series of curve25519 scalars as a private key There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key. Are there any caveats to ... 0answers 46 views ### Construct points with the same discrete logarithm Assume we have an elliptic curve$E$with a Tate (or Ate,...) pairing$G_1 \times G_2 \mapsto G_T$Now the task is to find$g_1, g_1' \in G_1$and$g_2, g_2' \in G_2$such that the discrete logarithm ... 0answers 20 views ### Does the length of the keyword used for keytable for Playfair matter? So for Playfair, we choose a keyword and put that in the keytable with no duplicates. Then, we fill the rest of the table with alphabets in order that are not in the keyword without 'J'. Does the ... 0answers 69 views ### Problem with applying threshold scheme For a report on threshold signature schemes, I have to explain a threshold signature scheme and give a simple example with numbers. A threshold signature scheme is a scheme in which a network of n ... 0answers 89 views ### RSA: special parameters construction I have to show that the following construction of$q$allows to factorize$N$:$p \in \mathbb{P}$, the set of primes$q \gets p \cdot \left((p - 1)^{-1} \bmod e\right) \bmod ek=1$while$q \not ...
53 views

Let's say we have Alice and Bob sharing a symmetric key $k$. Alice wants to leave a number of messages for Bob on an untrusted server (honest-but-curious model) that is also used by many other people ...
81 views

### Bobcat hash, trying to find a 48-bit hash collision for x

I am trying to find a collision with the Bobcat hash of the 48-bit hash. I am a beginner coder so please point out any flaws in my modification of the bobcat program. It does find a truncated 12-bit ...
24 views

### Quantitatively measure the private information revealed by a matrix?

Suppose I have a private matrix $A$ that I want to conceal. I do the matrix multiplication $A^\prime =AK$ and $A^\prime$ is public. How can I quantitatively measure "how well" the matrix $A$ is ...
39 views

### Are the values of Tate and Ate pairing the same?

Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup. Do then the ...
81 views

### Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
88 views

### Is there a way to slow down collision attacks using iteration?

The simple way to iterate a hash function $H(H(m))$ only makes brute force preimage finding slower, but leaves collision attacks as fast since a collision in the inner hash function is a collision in ...
59 views

### Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text. I suspect, the steganography changes (elevates) ...
31 views

### How does FileVault2 Recovery actually work?

I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :) I am about to enable FileVault2 FDE on the new macbook ...
62 views

### How did G.H. Hardy's work contribute to today's public-key cryptography?

I know that Hardy's work in number theory was used by Clifford Cocks in 1973 to develop the basis for public-key cryptography. What specifically was this work, and how is it used today in ...
59 views

### Test vectors for TLS PRF function

Does anyone know where I might be able to find test vectors for the PRF function in TLS? (either 1.0 or newer). I'm trying to implement a client and I am getting the BAD Record MAC return after ...
31 views

### Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
75 views

### CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
55 views

25 views

### Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
76 views

### Does SHA-1 meet the strict avalanche criterion?

Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ...
61 views

### How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
43 views

### Determine safety of exercise hash functions

There have been several attacks against hash functions such as $h_{sha1}$ and $h_{md5}$. Professor A suggests a new function $h_{666}$ with an output length of 666 bits. Professor B suggests ...
70 views

### Worst case one way function

the worst-case one way function is defined as follows $$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$ can you give any example of such function?
30 views

### Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
54 views

I have this curve in E(F131) : $$Y^2 = X^3 + X + 2$$ I want calculate the sum P + Q considering that $$P= (5,1)$$ and $$Q = (60, 49)$$ For calculate the result i use these formulas:  xr = ...
94 views

### Is there a mental poker algorithm that does not rely on commutative encryption?

The algorithm for mental poker that I saw on Wikipedia and everywhere else relies on an encryption algorithm such that $E_k(E_j(P)) = E_j(E_k(P))$, but I can't find a modern and secure algorithm for ...
102 views

### DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
54 views

### Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
76 views

### RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
47 views

### Proposed unidirectional authentication scheme

I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ...
93 views

### SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ...
87 views

### Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
64 views

### Energy necessary for brute-forcing or decryption

I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it. ...
101 views

### Pseudorandom Function Proof

Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: ...
39 views

### During electronic voting, how does one hide the choice from Voting device?

Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially ...
145 views

### How to calculate the non-linearity of an s-box?

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
90 views

### Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 v2.20 section 12.1.6 PKCS #1 v1.5 RSA is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 signature of data hashed externally to a ...