All Questions

123 views

Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
115 views

How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
168 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
88 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
72 views

Predicate Encryption supporting disjunctions

I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
262 views

One-time pad and perfect secrecy properties

I have a homework problem: Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$ where P is probability and k is chosen uniformly. I do not know ...
128 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
93 views

Prevent/minimize replay attacks in public message board

Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
221 views

Creating colliding x509 certificates: Crafting RSA moduli step

I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7). Now I have ...
1k views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
532 views

Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
195 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
107 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
123 views

Computer appliance protocol

I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...
180 views

Structure of encrypted office files

I try to find out the structure of encrypted office files (I'd like to implement something like a carving tool for finding certain encrypted file types). I try to understand the Office Document ...
230 views

How to properly format a PGP Message Block?

As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
161 views

Setting protocol parameters to achieve concrete security

Background One issue with modern security proofs is that they are usually asymptotic. In other words, such proofs are usually formulated as follows: For any polynomial-time adversary $\mathcal A$, we ...
164 views

Security of stream cipher based on Matrix multiplication GF(256) with randomized padding

The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components: The keyed function ...
14 views

Bcrypt input length vs collisions

I am currently implementing oauth2 bearer token authentication and am storing the tokens bcrypt encrypted. My question is how long should the tokens be to achieve maximum security. E.g. at what length ...
29 views

I read this post from Ben Tasker describing how to take control of a powerline network. Since I am interested in security, I tried to do the same thing, to see if it was possible. I used Devolo ...
28 views

Is it possbile to get same set of public and private keys twice while creating CSR ? If so where does the conflict happens !?

I'm new to cryptography and please clarify if my below assumption is wrong. Lets assume, that two different banks creating CSR and they get identical public and private key pairs of RSA. In such ...
22 views

How exactly is an enigma simulation software supposed to encrypt alphabets?

EDIT: The model I'm trying to make is "Enigma 1". I learned initially about it from a book called "Code Book" and then looked at it in detail from its wikipedia page. The rotor wiring and other ...
44 views

Is there specific name for simple XOR with ADD/SUB encoding?

Several years ago a group of malware authors began using code like this: for (j = 0; j < length; j++) ptr[j] = (ptr[j] ^ VALUEA) - VALUEB; for encoding, and ...
21 views

Are there any existing ASN.1 structures for transferring symmetric keys?

Is there any reasonable ASN.1 standard to encode symmetric keys? I found PSKC, but it seems extremely heavy, and I can't quite find any library (e.g. bouncycastle) that would simplify using it. If ...
29 views

Let's say we have Alice and Bob sharing a symmetric key $k$. Alice wants to leave a number of messages for Bob on an untrusted server (honest-but-curious model) that is also used by many other people ...
19 views

LFSR, different bits from different initial states

Suppose we useLFSR, which gives output $x_1x_2x_3\dots$ from some particular initial state. From another state, different from previous, same LSFR though, it gives sequence $y_1y_2y_3\dots$ ...
30 views

Symmetric stream cipher, is it known?

I am thinking on a simple symmetric stream cipher. My first idea is the following: The key is a set of array of random bytes ($\underline{k}_1$ ... $\underline{k}_n$), whose length is $l_1$, $l_2$, ...
19 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
27 views

Hash-values's length in identification schemes

I am trying to understand the impact of applying a hash function in an identification scheme. It makes reference to the publication "On the length of cryptographic hash-values used in identification ...
42 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
38 views

I know that, for any CPA-secure public-key encryption scheme, the size of the ciphertext after encrypting a single bit is superlogarithmic in the security parameter. That is, for $(pk,sk) \leftarrow ... 0answers 40 views Small subgroup attack on Diffie-Hellman I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group$\mathbb{Z}_p^*$where$p$is a large prime, so the ... 0answers 31 views Testing PRNG quality from ECC public keys? Having a large set of ECC public keys$P_i = n_iB$on a fixed curve$E$over a prime field, is there a way to determine if coefficients$n_i$were generated using a bad PRNG? In other words, can a ... 0answers 111 views Example describing Baek and Zheng’s threshold identity-based decryption scheme I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ... 0answers 44 views How can I calculate the probability of collisions of a hashing algorithm? I'm pulling a “Dave” and I'm designing my own hashing algorithm. Not that I intend to use it, I'm not certifiable or anything, I just want the challenge of creating something. I'm not going to get ... 0answers 99 views How to calculate the avalanche effect in aes-256? I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ... 0answers 62 views Understanding a faulty Needam-Schroeder protocol Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses$N$(nonce) and sends to C (trusted ... 0answers 51 views What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)? I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ... 0answers 17 views memory hard password based key derivation functions? How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine. What design could work well with skein? The ... 0answers 29 views FFX Encryption over alphabet of arbitrary radix I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ... 0answers 34 views Prove that certain amount of data was stored I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ... 0answers 35 views What consequences do the plaintext space size has on the performances in the BGV scheme? In the BGV paper [1], the authors say in §5.4 that you can have$\mathbb{Z}_p$as plaintext size with a large$p$. What is the impact of the size of$p$on the ciphertext size and computational work ... 0answers 54 views ElGamal signatures systems Let$p$prime number$q/p-1$prime and$g\in (Z/pZ)^*$element of order$q$.Also$a\in \{1,...,q-1\}$the private key and$y\equiv g^a\pmod p$the correspoding public key.For each of the following ... 0answers 37 views How can I read the AE figures? This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ... 0answers 34 views Improve security of transposition ciphers As we know, breaking a Transposition Cipher is quite trivial and can be easily done by either exploiting single letter frequencies (not$d$-gram frequencies though, given that$2 < d < L$), or ... 0answers 52 views Why does encryption in STS protocol protect against identity attacks? The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ... 0answers 39 views One-Time-Signature based codes I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter$\lambda\$, choose a suitable ...
33 views

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
25 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
79 views

Where can I find names for cryptographic notation I don't recognize?

I'm new to this space and find myself stumbling over come cryptographic/mathematical notation. Search engines are not very helpful when copying and pasting Greek letters. Is there any reference that ...

15 30 50 per page