2
votes
1answer
276 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
2
votes
2answers
550 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
1answer
621 views

RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
2
votes
1answer
108 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
207 views

Shannon entropy calculation: is $H(A|R·A) = H(A)$?

Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$. Now I take a non-random $m×m$ ...
2
votes
1answer
187 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
1answer
5k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
2
votes
2answers
472 views

DES Crack simulation

I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For ...
2
votes
2answers
236 views

AESManaged Trade Compliance Issue in United States

I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the ...
2
votes
2answers
499 views

Is there an effective way for public key generation in homomorphic encryption schemes?

Is there any way to effectively generate valid distributed public key in schemes like ElGamal or Benaloh for a number of participants? There's no need in private keys since there's no intent to ...
2
votes
1answer
47 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
2
votes
2answers
126 views

How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?

Edit: I know this isn't really a one time pad (as pointed out), though I don't really know what to call it aside from just a pad, I guess. I have been reading around (mostly various stackexchange ...
2
votes
1answer
49 views

mixing two asymmetrical random number generator streams

Knuth describes in "the art of computer programming part 2" an algorithm called "M" for mixing two streams of random numbers. This can be used to mix random number streams giving the assurance that ...
2
votes
1answer
75 views

What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
2
votes
1answer
45 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
1answer
29 views

Calculating IHVs from known message and hash output

Here is a somewhat silly and atypical problem I am currently facing. Usually, when it comes to hashes, one is bothered with finding collisions and preimages. My problem is, I need to find the IHV used ...
2
votes
1answer
88 views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
2
votes
1answer
72 views

Simplification of a pairing

The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification: $$e(C_i,\text{GPK}_{uid})\cdot e(D_i, ...
2
votes
2answers
93 views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
2
votes
1answer
81 views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
2
votes
1answer
62 views

Is a keyed PRF a MAC?

I remember I read that a MAC can be considered as a PRF. Can a variable-length input keyed-PRF be considered as a MAC?
2
votes
1answer
47 views

LFSR Output Sampling for Berlekamp-Massey

Looking at the use of Linear Feedback Shift Registers in cryptographic algorithms, I have learned that the Berlekamp-Massey algorithm can be used to find the (shortest) LFSR that generates a given ...
2
votes
1answer
54 views

What does it mean for an adversary to run in PPT?

I've been reading this question where a detailed description of mine is given, I've understood that a polynomial-time adversary is an adversary for which the only feasible strategy are those that take ...
2
votes
1answer
56 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
2
votes
2answers
90 views

Comparing two values without revealing them

Suppose Alice wants to prove to Bob that t1 is less than t2. t1 and ...
2
votes
1answer
62 views

Multiplication-homomorphic schemes

I'm looking into multiplication-homomorphic schemes now and basically I see that there are 3 options: RSA, Boneh-Goh-Nissim and ElGamal. RSA was proved to be insecure unless message is randomly ...
2
votes
1answer
180 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
2
votes
1answer
69 views

What's the advantage of using OFB/CFB/CTR modes over a stream cipher

As far as I understand: The primary disadvantage associated with stream ciphers is the need for a random and unique key for each run in order to protect against reused-key attacks. OFB/CFB/CTR block ...
2
votes
1answer
49 views

Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite ...
2
votes
1answer
103 views

How do P2P clients like uTorrent maintain authenticity of files?

I am very new to concepts of cryptography so bear with me and feel free to fill in any information that may seem obvious but something you think someone may not know. At first I was under impression ...
2
votes
1answer
93 views

Shamir's Secret Sharing of modular inverse

Given a secret $K \bmod q$ which is shared among entities $E_1,…,E_n$ using polynomial Shamir's Secret Sharing, how can the inverse of $k$ be shared without revealing $k$ and $k^{-1}$?
2
votes
1answer
24 views

Is the CONF key sharing Problem equivalent to discrete log problem?

If there a proof in the literature which says the CONF Problem is equivalent to solving the discrete log ? Let $g$ be a generator of a cyclic group $\mathbb{G}$ of prime order $q$ CONF problem: ...
2
votes
1answer
59 views

How can I validate my implementation of Ansi 9.19?

I implemented an Ansi 9.19 mac generator in java, but now I don't know how to validate its functionality. I couldn't find any sample of a {plain text,key,mac} on the internet, and I want to know if ...
2
votes
4answers
252 views

Pseudocode for constant time modular exponentiation

I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with ...
2
votes
1answer
114 views

Schnorr Identification protocol sometimes wrong?

I'm implementing the Schnorr Identification protocol as part of a larger protocol. In a large percentage of cases, around 20%, my test fails. I don't think it's a code problem, although possible, but ...
2
votes
1answer
89 views

How to specify a NIST SP 800-108 KBKDF

Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters. How ...
2
votes
1answer
61 views

Can I publish the accumulator trapdoor and still keep it secure?

I'm implementing the Camenish-Lysyanskaya dynamic accumulator. It seems to me that the accumulator is provably secure because the trapdoor is unknown to the attacker. The risks should be the fact ...
2
votes
1answer
89 views

FHE over the Integers - reduction to approximate gcd problem

I have three quick questions concerning the reduction of the scheme to the approximate gcd problem: What exactly do the authors mean by $q_p(z_1')$ being the odd part of the gcd? (last line of step ...
2
votes
1answer
59 views

difference between leveled FHE and normal FHE scheme

What is/are difference/s between leveled Fully Homomorphic Encryption and normal Fully Homomorphic Encryption?
2
votes
2answers
101 views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
2
votes
1answer
102 views

Solving Vignere Encryption

I'm currently trying to crack a cypher that I believe is Vignere Encrypted and I'm currently stuck. I calculated the key length by finding repeated sequences in the cypher and calculating the the ...
2
votes
1answer
119 views

Why does HMAC need a fixed length padding?

As everybody knows in order to calculate HMAC we have to concatenate padding to the message. I am just curious why the padding needs to be fixed-length. Why do we need the blocksize parameter here? ...
2
votes
1answer
208 views

Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?

We have a multiplicative cyclic group $G$ which is a subgroup of $(\mathbb{Z}/n\mathbb{Z})∗$. There are two parties, Alice and Bob: If: Alice knows: $b$ and $x$ such that $x^x = b$; Bob knows: $b$. ...
2
votes
1answer
45 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
2
votes
1answer
61 views

Implementing AugPAKE over ECC

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about ...
2
votes
1answer
110 views

Compare RFC 5246 SessionID re-use versus RFC 5077 Session Resumption?

Can you help me understand the differences, both algorithmic and practical, between RFC 5246 SessionID re-use and RFC 5077 Session Resumption? Both appear to be ways to nail up a second TLS session ...
2
votes
1answer
259 views

Mapping of message onto elliptic curve and reverse it

I would like to perform a variant of Elliptic Curve ElGamal in java using the BouncyCastle libraries. I currently face the difficulty of mapping a message $m$ onto the elliptic curve $E_p$. I have so ...
2
votes
1answer
77 views

What is the practical relevance of the wordsize when using a Hash?

I understand that the word size is the internal "working package size" below the block size of a cryptographic hash function (and a block cipher), as each block is broken into words an than processed ...
2
votes
1answer
165 views

SHA-256 Partial Collision of initial 36 bits and more

I was lucky enough to, by brute force, have found two different messages, whose SHA-256 hashes collide in the first 9 hexadecimal characters, which are 36 bits, ...
2
votes
1answer
166 views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...

15 30 50 per page