3
votes
1answer
268 views

One-way permutation over a small interval?

I am wondering what concrete computable functions we know that are a permutation over an integer interval of parameterizable size $s$, for relatively small $s$ starting circa $2^{64}$, to perhaps ...
3
votes
1answer
396 views

Calculating amount of time for brute forcing ciphertext depending on the size of the key

I am a graphic design student and for my information graphic project I have chosen the topic of the history of encryption and how the security level developed over the centuries. It’s basically an ...
3
votes
1answer
113 views

A confusion about HMQV?

As the full version of HMQV is very long, I will give a graph of it below \begin{array}{@{}l@{}c@{}l@{}} \hat{A} && \hat{B} \\ (a,A=g^a)&&(b,B=g^b) \\ x\in_R[1,q-1],\quad X=g^x ...
3
votes
1answer
291 views

Single Party Encryption, Multi Party Decryption

I am looking for an adequate protocol for public key decryption, which would allow $n$ parties to jointly decrypt a cipher text. The usage scenario for such a protocol would be a mixnet that wouldn't ...
3
votes
2answers
403 views

Two-timing a one-time pad [duplicate]

Is a one-time pad still breakable on a depth of 2+ if the plaintext is completely random? I'm assuming this idea is wrong, mostly because it occurred to me, but let me walk you through my logic so ...
3
votes
1answer
121 views

Why is Lamport-Diffie secure?

Why is Lamport-Diffie secure? I note that there is a demonstration based on onewayness (in the book postquantum cryptography). But a one way function is not sufficient to ensure that it can not infer ...
3
votes
1answer
226 views

Can minimum encrypted message length be used to identify public key algorithm or derived some of its features?

Encrypting a very small message using public key cryptography always result in larger encrypted messages. Is it possible to deduce the algorithm used, key length, etc just by looking at the minimum ...
3
votes
1answer
85 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen thet ...
3
votes
1answer
238 views

Is $q(n)=1/n$ a negligible function?

By definition - $q(n)$ is a negligible function if for every positive integer $c>0$ there exist an integer $N_c$ such that for all $x>N_c$ : $q(n)<1/x^c$ So for the function $1/x$, if we ...
3
votes
1answer
296 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
3
votes
1answer
73 views

Private Information Retrieval with a pre-prepared database

Informally, Private Information Retrieval (PIR) is a protocol between a user $U$ and a Server $S$, that meets the following conditions: $U$ obtains enough information about a database hosted by $S$, ...
3
votes
2answers
877 views

Determine the Key given ciphertexts and plaintexts?

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ...
3
votes
1answer
192 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
3
votes
1answer
171 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
3
votes
1answer
391 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
3
votes
1answer
128 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
3
votes
1answer
117 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: ...
3
votes
1answer
2k views

Who uses the RSA BSAFE library?

Who uses RSA's BSAFE library? Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE? Background: BSAFE is one of the oldest ...
3
votes
1answer
365 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
3
votes
1answer
259 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the ...
3
votes
1answer
381 views

Explain the 'Breaking 104 bit WEP in less than 60 seconds' paper

Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details. Could you an answer questions, like: how is '1.24/256' a significant ...
3
votes
1answer
273 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
2answers
162 views

Why do fully homo-morphic constructions use 'ring' or 'lattice' structures?

Is there a significantly advantage to these data structures, or is it simply the status-quo and the easiest to use for describing constructions?
3
votes
1answer
72 views

Modes for encrypting small binary blobs?

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a ...
3
votes
1answer
60 views

Applications of 3-collisions

I recently read Improved Generic Algorithms for 3-Collisions by Joux and Lucks (Asiacrypt 2009), available as http://eprint.iacr.org/2009/305.pdf. I was wondering about applications of this technique ...
3
votes
1answer
2k views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
3
votes
1answer
311 views

Elliptic curve parameter generation

I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the ...
3
votes
1answer
362 views

Clipper chip (SKIPJACK) key exchange protocol

According to the Wikipedia page for NSA (emphasis mine): However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ...
3
votes
1answer
46 views

Distributing blocks with validation and non-dependant list generation

Problem Suppose I have a system of nodes that can communicate with a parent node, but not among each other. Suppose then a file on the parent node is split up into blocks and divided among the ...
3
votes
2answers
728 views

one-time pad key related attack [duplicate]

In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
3
votes
1answer
221 views

Any historical accounts of cryptanalysis of Jefferson's wheel cipher?

David Kahn in his book "The Codebreakers" wrote about Jefferson's wheel cipher, saying that To this day the Navy uses it… (the book was first published in 1967) Are there any historical accounts ...
3
votes
3answers
611 views

Searching over encrypted data [duplicate]

Is there any library/tool available which can allow me to search over encrypted data? I would like to encrypt data on client side, send it to cloud and perform search in cloud. I've been reading ...
3
votes
1answer
277 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
2answers
129 views

Distinguish messages

Since i cannot comment on questions, I give my own: If a secret key encrypt algorithm can encrypt messages of arbitrary length and the encrypt algorithm is probabilistic then: suppose the adversary ...
3
votes
1answer
94 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
3
votes
2answers
375 views

Encryption scheme with equivalent keys?

I've long been looking for a symmetric encryption scheme (or algorithm) with equivalent keys. Let me define what I want: Symmetric encryption algorithm with encryption function $E_k$ and inverse ...
3
votes
1answer
273 views

Chaum undeniable signature - justification for probability of misleading the verifier?

Can anyone explain me in details why does the following statement hold true in Chaum and van Antwerpen scheme for undeniable signature? The probability that a dishonest signer is able to ...
3
votes
1answer
212 views

Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...
3
votes
1answer
227 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
3
votes
1answer
292 views

DGK Cryptosystem Key Generation and Decryption Issues

I detailed here the DGK (Ivan Damgård, Martin Geisler and Mikkel Krøigaard) cryptosystem, and I managed to get it to work, most of the time... The BIG problem that I am facing at the moment is that ...
3
votes
1answer
305 views

Has there been any cryptanalysis of RC4-52?

Several websites ( such as Is there a secure cryptosystem that can be performed mentally? ) briefly mention RC4-52 as a modification of standard RC4. RC4-52 has only with 52 instead of 256 elements ...
3
votes
1answer
237 views

Elgamal test vectors

I know that Elgamal algorithms have fallen out of fashion, and they are not included in any widespread cryptographic standard nowadays. However, they are still present in several popular crypto ...
3
votes
1answer
437 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
1answer
448 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
3
votes
1answer
343 views

Security analysis of a matrix multiplication protocol

Suppose Alice would like to obtain the product of two mXm matrices i.e. A and B. Alice has A, whereas Bob has B. Since Alice does not want to reveal A to Bob, she chooses a mXm random invertable ...
3
votes
1answer
145 views

uniquely identify a symmetric key

Is there a safe way to uniquely identify a symmetric key? I know with asymmetric keys you typically use a hash of the public key, but I assume that using a hash of a symmetric key would reveal too ...
3
votes
1answer
305 views

ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse Show how one could exploit an implementation ElGamal signature scheme in which ...
3
votes
1answer
18 views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
3
votes
0answers
27 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the ...
3
votes
0answers
67 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...

15 30 50 per page