1
vote
1answer
284 views

What is adversary's advantage in cryptography and why we use it?

The definition of adversary's advantage seems a bit odd for me and I am wondering why do we use it to measure the power of an adversary rather than just use the probability of a PPT adversary ...
1
vote
1answer
155 views

Curve parameter for hyperelliptic curve cryptography?

RFC5639 defines some curve parameter for Elliptic curve cryptography. Aren't there any curve parameter database for Hyperelliptic curve cryptography? What I can only find was that written in this ...
3
votes
2answers
349 views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
2
votes
1answer
403 views

How hard/easy will be to break a SHA-1 or SHA-256 hash if the attacker knows part of the original text?

I'm creating an algorithm to hash some text variables (20/30 characters long) to send them across an insecure channel. I'm not dealing with high security data, so no credits card numbers or any other ...
10
votes
6answers
2k views

How exactly is “true randomness” defined in the realms of cryptography?

Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream". What's ...
7
votes
2answers
1k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
3
votes
1answer
88 views

Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
8
votes
1answer
946 views

Three-way hash collision

According to the birthday paradox we need approximately $O(|T|^{1/2})$ samples from the tag-space to find a collision for a hash function $h:K\times M \to T$. But how many samples are needed to find a ...
3
votes
2answers
547 views

Difference between salted hash and keyed hashing?

A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ...
1
vote
0answers
472 views

Decrypting a message without the private key using CRT

I am given 5 different encryption modulus, $N$, each ranging from 78 to 88 numbers long. Then for the encryption exponent, each has the same which is 5. Then I am given 5 different encrypted messages, ...
3
votes
2answers
335 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?
2
votes
1answer
214 views

Elliptic curve cryptography attack vector

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" ...
0
votes
1answer
929 views

My encryption message system & question about security

I made this small tool for make & read easily an encrypted message without nothing to install, just a simple private key like a word or a couple of words to share. (Without say it directly of ...
2
votes
3answers
157 views

How should I interpret this note on diffusion of the internal state of a PRNG?

This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here. ...
7
votes
1answer
156 views

Specification of the scream stream cipher is unclear

I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S. The specifications of the ...
3
votes
2answers
177 views

Calculating ciphersize of Paillier, SSE and OPE

If I have to encrypt a 32 bit plaintext in each of Paillier, SSE and OPE, how can I make an estimate of the ciphertext sizes respectively in order to reserve the amount of space in a database?
1
vote
2answers
190 views

Re-using parts of a one time pad to encrypt a new one?

The main problem with OTP's is the fact that they can only be used once. Would it be possible to use a random number that's, say, 512 digits, then use 256 of those for the (non-random) message, the ...
2
votes
2answers
348 views

Please punch holes in this authentication scheme

Folks, I am undertaking a crypto course in Uni. Our professor asked us to try and design some authentication schemes which are resistant to active attacks. This was just a in class exercise to get us ...
2
votes
1answer
290 views

Generate key pair deterministically from a particular seed [duplicate]

I've been reading "SQRL Secure QR Login" at Gibson's website, and I'm wondering if there is a way to generate an RSA private/public key-pair based on some cryptographically secure input, so that if ...
3
votes
1answer
1k views

Can an RSA private key have several public keys?

Ok, so my crpto lecturer in Uni posed this question at the end of the RSA key generation lecture as a brain teaser. I have been thinking about this and I think I have come up with a way ( I am aware ...
3
votes
2answers
232 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
4
votes
5answers
212 views

Using multiple secret keys

I have two secret keys. One is a secret key generated by OpenSSL (primary secret key). Second key is generated by performing one way hash operation to GPS co ordinates and time parameters (geo secret ...
-1
votes
1answer
78 views

Paillier Crypto System : Pros and Cons? [closed]

Can you please list the pros and cons of the Paillier crypto system you have encountered or found?
4
votes
3answers
1k views

NIST temporarily closed — will that have a negative impact on the future of cryptography?

For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA. The text at their ...
0
votes
1answer
555 views

Attribute-based cryptography [closed]

I am trying to create a social network, in which I want to use attribute-based cryptography. One professor told me it is possible to do it only in J2EE, but he can barely code! Some friends of mine ...
5
votes
1answer
135 views

Shamir's Secret Share Over the Reals

What about using Shamir's secret share over the real numbers leaks information? I know there is a problem with random number generation, and someone suggested it leaks the parity of the polynomial, ...
2
votes
1answer
992 views

When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?

Quoting the article Gone in 60 Months or Less: The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. ...
6
votes
2answers
446 views

Would RSA make sense if we used no computers?

I was recently wondering - would RSA be useful if we brought it to, say, medieval times? Could you choose the keys so that you could encrypt/decrypt messages quite easily, but factoring the private ...
4
votes
2answers
178 views

how to iteratively calculate a^emod n with modulus n sized 4096 bits

In most sites the exponent of the RSA public key is 24 bits. But the modulus can get to 4096 bits size. I have an accelerator that can get max. 2112 bit size modulus. It calculates ...
7
votes
1answer
414 views

Why are cryptography algorithms not exported to certain countries?

There have been strict laws about the export of crypto software to certain countries. I can understand the intent, but never gauged the fact that there is nothing stopping these countries from ...
5
votes
2answers
2k views

Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

I've done research about this subject, but I can't find the answer I'm looking for. The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during ...
2
votes
1answer
197 views

Rijndael: explanation of Rcon on Wikipedia?

I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it. The example for Rcon indicates that Rcon(9) is 0x1b. That could make sense… ...
3
votes
1answer
127 views

Is this really the correct way to do an IND-CPA test?

In a description of IND-CPA (indistinguishability under the chosen plaintext attack), I have been reading the following, simple test: The adversary can generate as many messages as he wants. Then, ...
2
votes
1answer
220 views

Verifying Self-signed SSL Client Certificates

I have a service and I want to authenticate my clients using SSL client certificates. Now I want the key exchange process to be as simple as possible, kind of like SSH: You generate a keypair and ...
2
votes
0answers
330 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve (mod p). Suppose I have the following elliptic curve: y^2 ...
2
votes
1answer
394 views

Why must curve25519 shared secret be hashed?

When using the curve25519 DH function, D.J. Bernstein recommends hashing the shared secret before using it as a session key for a symmetric block cipher. Why is that? Hashing won't increase the ...
1
vote
1answer
97 views

Who's talking to who encryption - does this concept work?

With all the NSA stuff in the news, I've been thinking about how to ensure the "who's talking to who" is just as private as the contents of the messages. I had an idea on the subject, about which I've ...
2
votes
0answers
30 views

Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
13
votes
3answers
785 views

Are NIST's changes to Keccak/SHA-3 problematic?

NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as ...
1
vote
1answer
194 views

how to mathematically prove a key exchange algorithm [closed]

I want to know the basic methodology that can be used to prove that a key exchange algorithm is secure. I am not asking about any specific algorithm. I want to know what should be proven and how to ...
5
votes
4answers
676 views

Is it possible to create an open-source SecurID?

As far as I understand it, the hardware key-fob two-factor systems such as RSA SecurID depend on secret algorithms, and employ tamper-resistant hardware to prevent reverse engineering. Is there some ...
4
votes
1answer
124 views

Non-interactive proof that an element is in a subgroup

I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| ...
10
votes
2answers
814 views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
4
votes
1answer
101 views

What security do digital signatures provide (like used when signing PDFs)?

I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs. We know that if our document has a digital signature, we can detect if the original ...
7
votes
1answer
809 views

How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the ...
3
votes
1answer
210 views

Friedman Index of Coincidence, pruning multiples of the keylength

I'm trying to write a Vigenere decipher script. I defined a couple of possible keylengths using the Kasiski method, using roughly this method: find recurring strings in the ciphertext between 3 and ...
2
votes
1answer
58 views

How are the lower levels calculated using upper levels in an optimized Merkel Hash Tree?

I was reading about the TIK protocol for thwarting wormhole attacks on adhoc networks. It uses a Merkel Hash Tree to store keys. But since the number of keys can be large, the tree is optimized by ...
0
votes
1answer
73 views

Advise key management protocol

Assume that sender and recipient both already have each others public keys(certificates). Sender needs to generate session key to encrypt some data and sends encrypted data to recipient. All offline - ...
1
vote
1answer
145 views

what is an injective trapdoor function?

The answer to this question at Crypto.SE is clear about what a trapdoor function is, but what makes a trapdoor function "injective"?
2
votes
3answers
251 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...

15 30 50 per page