2
votes
1answer
98 views

What is adaptive zero-knowledge?

In this paper on pg. 1241 the authors discuss bullet point on Adaptive Zero-Knowledge : I am new to Zero-Knowledge and I am having trouble understanding what they are saying. I think they are ...
0
votes
1answer
56 views

applying HKDF at both the client and the server

I have two keys (K1 and K2) at both the client and the server. I hope to use HKDF in both client and server side to concatenate the keys. I will use the same salt value at both the client ad the ...
0
votes
0answers
65 views

Example of CL PKC

I am trying to solve the example of algorithms of Certificateless Signature by manually and solving the mathematics of Algorithms but not succeed while doing mathematical calculations. Please ...
0
votes
1answer
49 views

Asymptotic Hash Function and Concrete Hash Function

I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical, and they say that its formalization is non-asymptotic. Why is the formalization non-asymptotic? What is an example of hash ...
1
vote
1answer
74 views

What is the difference between a bijective random oracle and a random permutation?

Assume $S$ be a finite set $O$ be a random oracle from $S$ to $S$, such that $O$ is bijective $f$ be a random permutation of $S$ Is there any difference between $O$ and $f$? Does it makes any ...
2
votes
1answer
208 views

Why is this MAC based on secure PRF with ordering and randomization insecure?

Is this MAC secure: To authenticate a message $m=m_1||\ldots||m_l$ where $m_i \in \{0,1\}^{n/2}$, choose $r \leftarrow \{0,1\}^n$ at random, compute $$t:=F_k(r)\oplus F_k(\langle 1\rangle || ...
0
votes
0answers
42 views

Merkle-Damgard transform: necessity of the Length block [duplicate]

The Merkel-Damgard transform append the message length (in blocks) to the message itself and then computing the 'chained hash' algorithm. Does the last block (which contains the length of the ...
2
votes
1answer
53 views

How to pronounce RIPEMD 160?

Do I pronounce it as a word or do I make it sound like "R-I-P-E-M-D" like by pronouncing each individual letter.
0
votes
0answers
29 views

Finding ECDSA public key from signature samples [duplicate]

How many plain ECDSA signature samples are needed to guess the corresponding public key from it like RSA? Otherwise, is it impossible to guess public key from ECDSA signature/encryption messages?
0
votes
1answer
278 views

How to put the hash of a PDF file in the PDF file? [duplicate]

I know it sounds strange.. but, are there any ways in practice to put the hash of a PDF file in the PDF file? And after geting the hash in the PDF file - if someone would do a hash check of the PDF ...
1
vote
1answer
123 views

Is encrypting a public key with a symmetric key safe?

Assume the sender wants to share their ephemeral/long-term public key with intended receiver only and both share symmetric key. Is it secure to encrypt the (full/partial) public key (of RSA, ECC) ...
4
votes
1answer
493 views

Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
1
vote
1answer
159 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
1
vote
1answer
96 views

Creating a secure key

Imagine that your lecturer and the undergraduate office have conducted a key exchange protocol after which both of them hold the string $X$. Yet, it is possible that a curious student sitting next to ...
1
vote
1answer
74 views

Decimal point in keyspace notations? (eg 2^54.15)?

I was reading up on CryptoCat's (pretty ridiculous) programming issues and how is dramatically reduced the key search space (link to bug synopsis) One thing that caught my eye was So 2^54.15 ...
3
votes
3answers
564 views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
2
votes
1answer
329 views

Prime number theorem - RSA

I am having trouble understanding the prime number theorem. As part of some revision for an exam, I am trying to answer the following questions (but seeing as I don't understand the concept of the ...
1
vote
1answer
147 views

Homomorphic Encryption, LWE, and Practical Applications

I've been reading Brakerski and Vaikuntanathan's Efficient Fully Homomorphic Encryption from (Standard) LWE. When the authors discuss a small modulus p used for the transition from (n, log q) to (k, ...
1
vote
0answers
37 views

Computing A, B given A+K and B+K [duplicate]

In his writeup of the Solitaire keystream generator algorithm, Bruce Schneier warns not to use the same key for two different messages: The first rule of an output-feedback mode stream cipher, any ...
1
vote
2answers
106 views

Encoding multiple fields with same AES key and vector?

I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites. I'm using AES-256 with random key and ...
0
votes
1answer
112 views

Hashing/encrypting an integer to produce an unique integer in the same range

I'm looking for a function or set of functions that can produce a pseudo-random permutation on an input set of arbitrary size. Given a set of $M$ values in range $0..M-1$, where $M$ is positive ...
1
vote
1answer
99 views

How does the length of the plaintext affect the cipher strength?

Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force. ...
7
votes
2answers
495 views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ...
2
votes
1answer
108 views

Authentication of machine before installation (to stop piracy) [closed]

I have a web-software project which needs a bit of protection in form of authencitation… This web based software runs on an intranet. There is no access to the internet from these terminal machines. ...
3
votes
1answer
65 views

Private Information Retrieval with a pre-prepared database

Informally, Private Information Retrieval (PIR) is a protocol between a user $U$ and a Server $S$, that meets the following conditions: $U$ obtains enough information about a database hosted by $S$, ...
1
vote
1answer
92 views

Applying differential cryptanalysis to ciphers with addition mod $2^{32}$

I am studying differential analysis and have a question. Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ (Plaintext $m_1$ xor with key $K_1$, then result goes into an ...
0
votes
1answer
118 views

Is it possible to decrypt an RSA ciphertext with only $N$ and $e$?

Is it possible to perform RSA decryption if one only knows $N$ and $e$? Failing that, what is the maximum key length where brute-force is still practically feasible?
2
votes
1answer
289 views

Is CBC mode encryption vulnerable to a reordering attack?

I know that, if CBC-MAC is used in such a way that the tag is the concatenation of all the blocks' outputs (and not just the last one), it's insecure under CPA for the simplest case of 2 blocks ...
1
vote
2answers
184 views

Why can we always assume that $Gen$ algorithm choose key uniformly?

Talking about a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ take the security parameter $n$ as input and generates a key $k$ of length $n$. Generally speaking we say that $Gen$ ...
0
votes
3answers
199 views

Why not just generate random strings for one-time password (OTP)?

http://en.wikipedia.org/wiki/One-time_password#How_OTPs_are_generated_and_distributed Why have so many methods to generate OTPs, why not just use just random strings?
1
vote
1answer
134 views

Secure function evaluation

Consider 3 parties, Alice, Bob and Charlie. Suppose each party has a bit as input, i.e. Alice, Bob and Charlie hold $a, b, c \in \{0, 1\}$ respectively. Show how construct a scheme with which ...
0
votes
0answers
72 views

hybrid PKE scheme CCA2 insecurity

I'm reading a paper here say: As we know, in hybrid PKE schemes XOR alone cannot perfectly hide challenge bit to the CCA2 adversary The author does not define hybrid PKE schemes. What is ...
5
votes
1answer
328 views

Why does the crypto_box functionality in NaCl library exposes the nonce to the programmer

The idea of crypto_box API in NaCl library is to shield the programmer away from the technical details and provide an easy to use functions for encrypting and encrypting messages. Given what I've ...
5
votes
2answers
466 views

Has threefish successfully been attacked (practically or theoretically)?

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating: Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a ...
1
vote
1answer
70 views

Is the following aggregation scheme private?

Is the following scheme private? By private i mean an untrusted aggregator (UA) cannot reveal anything other then an aggregate function output on plaintext data Each party holds a secret key $k_i$ ...
1
vote
2answers
119 views

PPT eavesdroper able to output $m_{0}$ and $m_{1}$ of different lengths

I've read the following two questions and their answers: Messages of different lengths and one-time computationally-secret Why is a non fixed-length encryption scheme worse than a fixed-length one? ...
2
votes
1answer
170 views

Bellovin 96' attack on IPsec ESP protocol on encryption only option

Can you explain the actual attack? Why does the attacker need to firstly send some arbitrary UDP packet? How can the attacker break the privacy between A and B? Link: The article of Bellovin I'm ...
1
vote
1answer
68 views

Why send a challenge with CHAP?

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP). Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash ...
3
votes
2answers
95 views

Can we build authenticated encryption using Feistel Networks?

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality . Can we build authenticated encryption using Feistel ...
3
votes
1answer
179 views

Any historical accounts of cryptanalysis of Jefferson's wheel cipher?

David Kahn in his book "The Codebreakers" wrote about Jefferson's wheel cipher, saying that To this day the Navy uses it… (the book was first published in 1967) Are there any historical accounts ...
5
votes
1answer
3k views

Avalanche effect in DES

I couldn't understand the avalanche effect in DES. Could someone explain how avalanche effect happens in DES
-2
votes
1answer
92 views

use the same pad reversed

Suppose I have a random number (eg 625 467 921). I use it once to encrypt a message OTP style, and when I want to use them again, I reverse them (eg to ...
1
vote
1answer
107 views

Efficient parameters for group Diffie-Hellman

I want to implement a basic version of Diffie-Hellman key agreement for groups. So, my key is $K=g^{abc} \mod p$. Following this, the parameters I would need to transfer would be $K_a = g^{bc}$ etc. ...
0
votes
1answer
87 views

Biometric authentication [closed]

I see in some “Authentication schemes with biometric” papers that those authors wrote a phase as password and biometric update phase. My question is that why we may needs biometric update phase? Is ...
2
votes
2answers
925 views

What happens when a root CA has its private key compromised?

What happens when a root CA has its private key compromised? Then all children in the tree are compromised too? And then all certificates are compromised? What needs to happen then? Related: - How ...
5
votes
2answers
337 views

Can you break a multi language code using Frequency analysis?

Let say that I wrote a 26 letter alphabet, each letter of my alphabet represent a letter from the latin alphabet. I'm writing in 3 languages, only I know which languages. Grammar is the one from my ...
7
votes
1answer
582 views

Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
4
votes
2answers
565 views

With a true random number generator at hand, how to implement one-time pad?

I have a Raspberry Pi single-board computer that happened to have an hardware true random number generator, based on some quantum effects on the processor silicon, baked into its BCM2835 chip and I ...
1
vote
2answers
294 views

How practical is proxy re-encryption for AES?

In proxy re-encryption schemes, a proxy is given special information that allows it to translate a ciphertext under one key into a ciphertext of the same message under a different key. How ...
6
votes
1answer
2k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ...

15 30 50 per page