1
vote
2answers
57 views

Clarification regarding multiple modular exponentiation

If the base is same and exponents are different, for example: $R_1=b^x\bmod{p}$; $R_2=b^y\bmod{p}$; $R_3=b^z\bmod{p}$; ($p$ is large prime (2048 bit); $x$, $y$ and $z$ - 160 bit integers)) To ...
1
vote
1answer
365 views

Knowing pre-encryption data, can we find the private key CryptoWall used?

I'm just repurposing a question already asked about Cryptolocker for CryptoWall: "If we know exact contents of some of the files prior to them being encrypted, would it be feasible to use those ...
3
votes
1answer
190 views

Why multiple homomorphic operations on a ciphertext leaks no information about the plaintext?

Scenario: Assume I encrypt message $m$ using Paillier encryption, so I would get $c=E(m)$. I give the identical $c$ to two different parties, parties $D$ and $E$. Party $D$ computes: $c_{D}= E(m)^{...
1
vote
0answers
31 views

What is the shortest fingerprint of a Curve25519 public key that is secure [duplicate]

My clients have to exchange public keys. To ensure security they are exchanging fingerprints and typing them into the computer by hands. I want the fingerprints to be as short as possible. I am ...
5
votes
0answers
122 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
6
votes
1answer
138 views

What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
3
votes
0answers
90 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
1
vote
1answer
111 views

How to prove that a SKE scheme is IND-CPA secure

There's an IND-CPA SKE scheme 1 $(\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})$. Scheme 2 is defined as $(\mathsf{Gen}', \mathsf{Enc}', \mathsf{Dec}')$, where $\mathsf{Gen}' = \mathsf{Gen}$, $\mathsf{Enc}...
3
votes
1answer
106 views

Decisional Diffie-Hellman: compute Legendre symbol of $g^{ab}$ from $g^a$ and $g^b$?

From https://en.wikipedia.org/wiki/Decisional_Diffie%E2%80%93Hellman_assumption: Importantly, the DDH assumption does not hold in the multiplicative group $\mathbb {Z} _{p}^{*}$, where $p$ is ...
4
votes
2answers
125 views

Is it okay to use an HMAC of the plaintext and a (possibly distinct) key as the IV for symmetric cryptography?

I was thinking of how to create an IV for a block cipher that doesn't require stored state, and I came up with the idea of using an HMAC of the (padded) plaintext and a (possibly distinct) key as the ...
2
votes
1answer
63 views

Is (1 bit HW signal) XOR (8 bits PRNG output) sufficient for a HWRNG?

This is really a follow up question to a comment made regarding How to roll a HWRNG In the situation of whitening a hardware generated random bit stream, "XORing the two bitstreams should be fine ...
2
votes
3answers
390 views

What do numbers in a crypto algorithm stand for? Is there a convention?

What do the numbers stand for in the names of cryptographic functions, for example AES-256, RSA-1024 or ...
4
votes
1answer
88 views

Can I store the initialisation vector (IV) in the filename?

I'm encrypting a file and I'm using an initialisation vector. Given that the IV doesn't need to be a secret, is it secure if I add it to the encrypted file's name?
0
votes
0answers
16 views

Lightweight Asymmetric encryption algorithm [duplicate]

I'm an embedded systems researcher, and new in crypto field. Actually, I need to know if there are any lightweight asymmetric encryption algorithm especially from time needed for key generation. I ...
0
votes
3answers
161 views

Factorizing N to derive D [duplicate]

So I have the value of N. I have to use this value of N to find the value of D. N = 265291078722948385089717069136983657793 Now I read about RSA algos and found out that ...
0
votes
1answer
68 views

Are there AES128 keys such that first round key equals last round key?

I am looking for AES128 keys such that the last round key is exactly the first round key (which is simply the key). Any pointer to a proof that they exist or that they don't would be welcome. In the ...
14
votes
1answer
6k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
1
vote
1answer
46 views

Secure Multiparty Computation with Secret Output

Is there any MPC scheme that allows a function with several secret inputs to be computed, while the output can only become known to one specific party? If not, is this even possible?
4
votes
2answers
190 views

Why are some x-coordinates unsuitable for an ECDSA generator point?

For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$? That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + ...
4
votes
0answers
62 views

Why SIVP Is Worst Case Problem?

I just started to study lattice cryptography. I'm now studying worst-case to average-case reduction for SIS. In previous question, "worst means any and average means random". And I wonder why ...
12
votes
1answer
181 views

Structure for an introductory course on cryptography?

Many introductory courses on cryptography have their treatment of secret-key crypto start with OTP, then block ciphers, and for public-key cryptography revolve around RSA with no notion of padding (...
2
votes
2answers
92 views

What is the purpose of Pseudorandom Function Families (PRFs)?

I'm currently in a course in Cryptography, and was wondering why pseudorandom function families exist at all. If there existed one pseudorandom function f(x), based on its definition, could that not ...
0
votes
1answer
130 views

Combining a block cipher with a (pseudo) OTP

One of the drawbacks of OTP is that it can require an inconveniently long key. Besides that, it doesn’t provide data authentication. Therefore, I have been working on an algorithm idea, which I hope ...
8
votes
0answers
994 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
2
votes
4answers
628 views

Does it make sense to have a 4000 bit long key?

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?
2
votes
1answer
3k views

When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?

Quoting the article Gone in 60 Months or Less: The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. ...
2
votes
1answer
106 views

Would SHA-1 be safe for certificates with short validity?

There are articles floating around the topic of SHA-1 deprecation. The gist of it is that in (mostly) developing countries, people are still using mobile/computing devices that are 5 years old (or ...
0
votes
1answer
79 views

How can I study the math behind cryptography? [closed]

I am a junior in high school and I am currently studying algebra 2. Where can I go to learn about the mathematics behind cryptography? I have a very basic knowledge of cryptography, but I am really ...
0
votes
0answers
54 views

Translation of Schorr Ring Signature to ECSchnorr Ring Signature

I have to write an EC version of Schnorr Ring Signature Scheme. I've already wrote regular ECSchnorr Signature Scheme using this (page 128). I've found a scheme of Schnorr Ring Signature Scheme (page ...
3
votes
2answers
171 views

Best modern cipher for morse code?

I am looking for a modern cipher to encode morse code, ie. input is [A-Z 0-9] (base36 as I learned in the comments below) and output is the same, one character at a ...
3
votes
2answers
121 views

Implementation of ECC over binary field

I am supposed to implement ECC over binary field (in C++) for equations of the type - $y^2 + xy = x^3 + ax + b$, as my project. I wish to include the following features : The user will enter a prime ...
2
votes
1answer
72 views

Elliptic Curve ElGamal and DSA - smooth group order and element of large prime order

In regular ElGamal and DSA, we choose large primes $p$ and $q$ such that $p\equiv 1\pmod{q}$, and a group element $g$ of order $q$ by computing $a^{(p-1)/q}$ for some random $a$. This is to prevent ...
6
votes
1answer
114 views

Non-deniability of data sent over TLS

Andy is going to connect to a server Selma over TLS. Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent ...
2
votes
2answers
177 views

Given a pseudorandom function F, is $(F_k(r) \; | \; F_k(r + 1))$ also a PRF?

Given: F is a pseudorandom function, G is a pseudorandom generator with $l(n) = n+1$. The following schemes should be classified as being insecure, IND-COA secure, IND-CPA secure. To encrypt $m \in \...
2
votes
1answer
51 views

Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
2answers
102 views

RSA and difference between factors

As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two $1024$-...
1
vote
1answer
76 views

Username and Password: How does it work?

Suppose a client (Alice) goes to an HTTPS website (Bob) over TLS 1.2. Alice sends Client Hello with some random number $r_a$. Bob sends Server Hello with another random number $r_b$. Suppose they ...
2
votes
4answers
3k views

Is a Mersenne-twister cryptographically secure if I truncate the output?

I want to create an online roulette game. Is it OK if the PRNG is seeded only once, when the user starts the game, or is it recommended to re-seed sometimes during game? Maybe just seeded once a day ...
19
votes
1answer
39k views

How is SHA1 different from MD5?

On the surface, SHA1 and MD5 look pretty similar. Their diagrams include chunks of bits, bit rotation, xor and special functions. Their implementations are roughly the same length (at least the ones I'...
2
votes
1answer
126 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
3
votes
2answers
140 views

Security analysis of this one time password based scheme for copy protection

Imagine such protocol. Client and server initially share secret K[0]. When client wants to contact server she sends server K[0] and her ID. Server accepts request, and generated new random K[1] and ...
2
votes
1answer
181 views

How broken is a xor of two multiply with carry generators?

How broken is a xor of two LCGs? How Brittle Are LCG-Cracking Techniques? Based on the above two questions, I have simply one additional question: how broken is a XOR of two 64-bit multiply with ...
5
votes
2answers
550 views

Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed – see Moshe Rubin's Chaocipher Revealed, the Algorithm (PDF). While a known plaintext attack successfully finds ...
4
votes
3answers
897 views

Is there any area where AES-CBC cannot be used ? If so, why?

I would like to know the domains or specific applications where using AES-CBC is not advised due to any drawbacks like sequential encryption of AES-CBC ?
4
votes
2answers
132 views

Hash functions vs Stream Ciphers in terms of Speed

We know that it's possible to create a hash using a stream cipher (for instance, RC4 or AES in Counter Mode). As stated here: "A Pseudo Random Generator (PRG) and a hash function are both Pseudo ...
3
votes
1answer
133 views

DES: How to find the Inverse of the Initial Permutation?

I am doing a DES problem by hand and I want to know how you calculate the inverse of the initial permutation. I know what the permutation is, but how do you find it based off the given initial ...
1
vote
0answers
17 views

RSA incorrectly translates for small keys [duplicate]

I've been learning about RSA and wrote my own implementation. I don't pretend to have intuitive understanding of RSA or that I understand why it works, but I believe to have some basic understanding ...
6
votes
2answers
737 views

On AES, is a true random string enough for a key?

The string (32 ASCII characters) is entered by a human, and considered truly random. Should a key derive from this string, or it is secure to use this string as a key directly? In other words, does ...
5
votes
2answers
124 views

Data Leakage and Data Switching

I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow: $v_1=r_1a+r_2$ $v_2=r_1(b-a)$ where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ ...
1
vote
4answers
325 views

Message exchange with textbook RSA

I am working on this exercise but can't work out the answer to the question b. I have solved the question (a) by decrypting the ciphertext $C = 2$ using the formula: $$ M = C^d \bmod n = 2^{17} \bmod ...

15 30 50 per page