4
votes
1answer
307 views

Best choice of finite field for AES on a 4-bit microcontroller?

As the finite field of $GF(2^8)$ are isomorphic to $GF((2^4)^2)$, $GF((2^2)^4)$ and $GF(((2^2)^2)^2)$, which of the fields is best suited and most efficient for 4-bit MCU and why? Would it be ...
4
votes
1answer
110 views

Is there any serious discussion about using blinding intermediaries in digital currency scenarios?

A digital currency system like Lucre (OpenTransaction) creates a coin by a mint blind signing the output of a hash function, which the payer then unblinds and pairs with the input to the has function. ...
4
votes
1answer
325 views

How is the MJH double-block-length hash function constructed?

I'm looking for information on the MJH double-block-length hash function, but the best free source I could find is the diagram on page 18 of Efficient hashing using the AES Instruction Set (submitted ...
4
votes
1answer
47 views

Padding schemes for asymmetric encryption with provable security in the standard model

Most padding schemes for asymmetric encryption (OAEP, OAEP+) are only proven secure in the random oracle model. Although no attacks are known, it would be nice to find a padding scheme with provable ...
4
votes
1answer
34 views

Which values to store in rainbow table generation?

According to the Wikipedia and Philippe Oechslin's Making a Faster Cryptanalytic Time-Memory Trade-Off (pdf), both starting points and endpoints are keys. Here is an example from Wikipedia: As you ...
4
votes
1answer
69 views

How do I validate the AES cipher?

I have used AES CTR mode of operation. Each time a file is uploaded an encrypted file is obtained and the corresponding cipher is got – this is a mini project I have done. I wanted to know so as to ...
4
votes
1answer
31 views

Why ssh-gen makes difference between PEM and PKCS8?

Correct me if I am wrong, but PKCS8 is format to store private key info. It could be binary-enoded (DER) or Base64 encoded ...
4
votes
1answer
68 views

Statistical tests for PRNG that generates a sequence which is not binary

Is there a pratical application to PRNG that generates a sequence which is not a binary one? A ternary, quaternary sequence, for instance. If so, how can we test this? Is there any alternative test ...
4
votes
1answer
83 views

How to prove that an integer is hard to factorize when sampled from a known distribution

Suppose that an $n$-bit integer $c$ has been randomly drawn from a distribution $\chi$, whose description is known. Is there a general method to check if this particular sampling helps factorize $n$? ...
4
votes
1answer
59 views

Small subgroup attack on Diffie-Hellman key exchange

Alice and Bob are using DHKE in the group $\mathbb{Z}_p^ * $, where $p = 1031 = 2 \cdot 5 \cdot 103 + 1$. Their generator $g = 2$, which generates a multiplicative group of order $515$ in ...
4
votes
1answer
87 views

How to choose the reduction function in rainbow tables?

I have a question regarding Reduction Functions in Rainbow Tables. If the hashing function is MD5 or SHA-1 etc then should the reduction functions also be MD5 or SHA-1? That is, should the Reduction ...
4
votes
1answer
103 views

Understanding Hellman's TMTO

I am trying to understand the basic TMTO by Diffie Hellman as described here. I am having trouble understanding this passage here: Hellman had the idea of storing the dictionary in the form of ...
4
votes
1answer
55 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin ...
4
votes
1answer
82 views

How to design a deliberately weak PRNG for experimentation?

I'm looking for a PRNG that is deliberately weak, that is, follows a set of rules stochasticly. For example: Encounters a set of bits that is a multiple of X, starts exhibiting bias, or starts to ...
4
votes
1answer
113 views

How to attack RSA-CRT with large public exponent?

Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message ...
4
votes
1answer
147 views

Determining if Server/Client's TLS configuration is Vulnerable to SLOTH

In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this. My idea is ...
4
votes
1answer
95 views

Comparison Vigènere vs. Monoalphabetic cipher

I have a question for a class of secure communication, but I have no idea about how to proceed in order to answer it. I'll be very grateful to whom replies to me. Assuming that brute force attack ...
4
votes
1answer
89 views

If the hash of the multiplication is equal to the multiplication of the hash, how can this be used to leverage an attack?

Assume a hash function $H:\left\{0,1\right\}^*\to G$ where $G$ is a group and assume that finding an inverse in $G$ is easy. How can a preimage efficiently be found using the fact that $H(M_1\cdot ...
4
votes
1answer
62 views

Information theoretical security of an inefficient Shamir based access structure

I have studied Sharmir's scheme as well as the multiple assignment scheme proposed by M. Ito. My question is if anyone can tell me if the following scheme is theoretically secure: Terms: P = set of ...
4
votes
1answer
90 views

Usefulness of Damgård–Jurik

I am trying to understand what are the benefits of using Damgård–Jurik over Paillier. I understand that expansion factor decreases as s increases. But isn't it the ...
4
votes
1answer
64 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
4
votes
1answer
123 views

Are there comprehensive alternatives to RSA?

If we wished to, is there a comprehensive alternative to RSA? I say comprehensive as I wonder if there is one which does both encryption and digital signature like RSA? If not, simply what ...
4
votes
1answer
168 views

How to generate a bilinear group of prime order p for key generation

I am trying to implement an IEEE Paper In Cryptography. I read many reference regarding an RSA key generation. But i am confused with above statement. Please someone explain me What it says with ...
4
votes
1answer
92 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
4
votes
1answer
99 views

How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth. I'm currently working on a project that ...
4
votes
1answer
175 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with ...
4
votes
1answer
68 views

Is it wise to use HOTP (raw bytes) as a key for HMAC?

Assume I have client and server applications with a shared master secret KEY_SECRET already in place. Also assume that the client and server have an implicit shared ...
4
votes
2answers
108 views

Weakness of SRP after server compromise

From SRP section 3: The host stores user passwords as triplets of the form { <username>, <password verifier>, <salt> } Password entries ...
4
votes
1answer
70 views

Is there a cryptographic protocol that let's me prove someone has a large binary?

I'm working on a system that has a P2P component. When an individual downloads a binary and decides to mirror it, they advertise themselves in a providers set. The binaries can range from 1-1000MB. I ...
4
votes
1answer
81 views

Creating own ciphertext after a padding oracle attack?

I've written a script that breaks a cipher text based on a padding oracle for an assignment, but was wondering how I would continue on to create my own cipher text with any plain text I desired? ...
4
votes
1answer
61 views

Secure “table-look-up” operation

I am thinking about this problem: The server has a two-column table $T=\{c_1,c_2\}$. A user has a query $q$ that is sent to server. The server find an item $x$ in the first column satisfying $x=q$ ...
4
votes
1answer
141 views

Effect of ESSIV when used with XTS

I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question. When formatting a partition to use LUKS, the two most common ...
4
votes
2answers
45 views

Does SRP also authenticate the server to the client?

The Secure Remote Password (SRP) protocol lets a client prove to a server that it knows a specific password without revealing that password to the server. The server stores a cryptographic verifier ...
4
votes
1answer
171 views

Cryptographic random numbers for key generation

I am trying to understand how a cryptographic library works (for example, one that provides assymetric encryption such as RSA), but I'm running into a few problems about the key-generation. There are ...
4
votes
1answer
215 views

64bit nonce in AES-CTR, why not 128?

I'm just a bit confused about the nonce/IV in AES-CTR ... it seems the suggested way to go is have a 64bit random nonce, and use the last 64bits as the counter, "starting at 0". I'm just wondering ...
4
votes
1answer
154 views

Quantum computing vs AES s-box equation

Do quantum computers have any affect on the ability to solve the non-linear AES s-box algebraic expression, or does solving it still fall under search algorithms (Grover's)? If quantum computer do ...
4
votes
1answer
112 views

Parallel authentication of encrypted data. What AE type to choose?

I've got a system with a slow data transfer channel. Transferring a message through several channels does increase the transfer speed significatnly. AES-CBC+HMAC is good except that verifying the MAC ...
4
votes
1answer
72 views

On Proving That a Primitive Does Not Exist

In the paper of Hsiao and Reyzin, Section $1.4$: Note that to show that no general reduction from $P$ to $Q$ exists requires proving that $Q$ does not exist Since the statement is about trying ...
4
votes
1answer
176 views

Implementing AES MixColumns with fewest XOR gates

I'm playing with Contiki (O.S. for constrained devices such as sensors and micro-controllers) and particularly with the AES encryption in software (the one available in Contiki source code). I'm ...
4
votes
1answer
73 views

possible MITM attack against servers that used to support weak DH?

from reading the TLS 1.1 RFC, it looks like it would be possible to break a previously recorded TLS <1.2, 512-bit DHE ServerKeyExchange and then send it (unmodified, with the original, valid ...
4
votes
1answer
120 views

Hard-core predicates: should the adversary be given $1^n$?

In most (all?) classical sources such as the book of Goldreich (2001), hard-core predicated are defined thus: A polynomial-time computable predicate $b : \{0,1\}^* \to \{0,1\}$ is a hard-core of a ...
4
votes
2answers
114 views

Discrete logarithm over prime modulo: small input, large exponent, larger prime

I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario. 1) Input ($m$): the input messages are small (16-bit) 2) Exponent ($e$): the ...
4
votes
1answer
163 views

Prime factorization

What is the largest integer that can be factored by modern algorithm like Msieve and GGNFS in a time less than 5 hours with normal computers? For example, can an integer like ...
4
votes
1answer
246 views

AES as Integer Program

I read that AES can be broken by solving a Linear Integer Program (IP). From a given encrypted text, how can one construct this IP? How big is the system?
4
votes
1answer
233 views

Factoring two RSA modulus with known $|p_1 - p_2| < \ell $

I have two 1024bit RSA modulus $N_1 = p_1q_1$ and $N_2 = p_2q_2$ such that $0 <|p_1 - p_2| < \ell$, and $\ell$ is at most 64bit integer. Can I factorise $N_1$ and $N_2$? What's the answer when ...
4
votes
1answer
422 views

What cryptography is suitable to motivate High School students to learn math?

A High School math teacher in the Bronx asked me if I knew of any way to use cryptography in a way that motivates students (15 to 18 years old) to learn math. I do know that many of them want to ...
4
votes
2answers
197 views

Power analysis and exponentiation by squaring

I am trying to understand how one can retrieve the secret exponent via a simple power analysis. Lets suppose that the exponentiation by squaring algorithm is implemented in its simplest form : ...
4
votes
2answers
245 views

Which multiplicatively homomorphic encryption scheme supports encryption of 0?

I want a multiplicatively homomorphic encryption scheme that supports encryption of 0 (e.g. Elgamal doesn't support). I also want the multiplication to be operated on the ciphertext of 0, i.e., if ...
4
votes
1answer
136 views

How did the power measurements translate to AES Key?

A side channel attack is described here. I did not quite get , how the power measurements are used to get the decryption key , can any body explain it?
4
votes
1answer
297 views

reducing false positives in searchable encryption

Practical techniques for searchable encryption proposed by Song et al. [1] have a false positive rate of $l/2^m$ where $l$ is left half of encrypted bits and $m$ is right half and $l+m=n$ where $n$ is ...

15 30 50 per page