3
votes
2answers
904 views

Determine the Key given ciphertexts and plaintexts?

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ...
3
votes
1answer
199 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
3
votes
1answer
172 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
3
votes
1answer
128 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
3
votes
1answer
118 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: ...
3
votes
1answer
369 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent ...
3
votes
1answer
264 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the ...
3
votes
1answer
402 views

Explain the 'Breaking 104 bit WEP in less than 60 seconds' paper

Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details. Could you an answer questions, like: how is '1.24/256' a significant ...
3
votes
1answer
276 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
2answers
164 views

Why do fully homo-morphic constructions use 'ring' or 'lattice' structures?

Is there a significantly advantage to these data structures, or is it simply the status-quo and the easiest to use for describing constructions?
3
votes
1answer
74 views

Modes for encrypting small binary blobs?

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a ...
3
votes
1answer
60 views

Applications of 3-collisions

I recently read Improved Generic Algorithms for 3-Collisions by Joux and Lucks (Asiacrypt 2009), available as http://eprint.iacr.org/2009/305.pdf. I was wondering about applications of this technique ...
3
votes
1answer
3k views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
3
votes
1answer
314 views

Elliptic curve parameter generation

I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the ...
3
votes
1answer
369 views

Clipper chip (SKIPJACK) key exchange protocol

According to the Wikipedia page for NSA (emphasis mine): However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ...
3
votes
1answer
46 views

Distributing blocks with validation and non-dependant list generation

Problem Suppose I have a system of nodes that can communicate with a parent node, but not among each other. Suppose then a file on the parent node is split up into blocks and divided among the ...
3
votes
2answers
738 views

one-time pad key related attack [duplicate]

In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
3
votes
1answer
223 views

Any historical accounts of cryptanalysis of Jefferson's wheel cipher?

David Kahn in his book "The Codebreakers" wrote about Jefferson's wheel cipher, saying that To this day the Navy uses it… (the book was first published in 1967) Are there any historical accounts ...
3
votes
3answers
633 views

Searching over encrypted data [duplicate]

Is there any library/tool available which can allow me to search over encrypted data? I would like to encrypt data on client side, send it to cloud and perform search in cloud. I've been reading ...
3
votes
1answer
281 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
2answers
129 views

Distinguish messages

Since i cannot comment on questions, I give my own: If a secret key encrypt algorithm can encrypt messages of arbitrary length and the encrypt algorithm is probabilistic then: suppose the adversary ...
3
votes
1answer
94 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
3
votes
2answers
376 views

Encryption scheme with equivalent keys?

I've long been looking for a symmetric encryption scheme (or algorithm) with equivalent keys. Let me define what I want: Symmetric encryption algorithm with encryption function $E_k$ and inverse ...
3
votes
1answer
297 views

Chaum undeniable signature - justification for probability of misleading the verifier?

Can anyone explain me in details why does the following statement hold true in Chaum and van Antwerpen scheme for undeniable signature? The probability that a dishonest signer is able to ...
3
votes
1answer
217 views

Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...
3
votes
1answer
227 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
3
votes
1answer
296 views

DGK Cryptosystem Key Generation and Decryption Issues

I detailed here the DGK (Ivan Damgård, Martin Geisler and Mikkel Krøigaard) cryptosystem, and I managed to get it to work, most of the time... The BIG problem that I am facing at the moment is that ...
3
votes
1answer
309 views

Has there been any cryptanalysis of RC4-52?

Several websites ( such as Is there a secure cryptosystem that can be performed mentally? ) briefly mention RC4-52 as a modification of standard RC4. RC4-52 has only with 52 instead of 256 elements ...
3
votes
1answer
242 views

Elgamal test vectors

I know that Elgamal algorithms have fallen out of fashion, and they are not included in any widespread cryptographic standard nowadays. However, they are still present in several popular crypto ...
3
votes
1answer
438 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
3
votes
1answer
456 views

Verilog simulation & synthesis of Diffie-Hellman key exchange

Is there any freely available verilog implementaion of Diffie-Hellman key exchange? I couldn't find anything using google. So, assuming its not there I started implementing on my own. The code is ...
3
votes
1answer
353 views

Security analysis of a matrix multiplication protocol

Suppose Alice would like to obtain the product of two mXm matrices i.e. A and B. Alice has A, whereas Bob has B. Since Alice does not want to reveal A to Bob, she chooses a mXm random invertable ...
3
votes
1answer
146 views

uniquely identify a symmetric key

Is there a safe way to uniquely identify a symmetric key? I know with asymmetric keys you typically use a hash of the public key, but I assume that using a hash of a symmetric key would reveal too ...
3
votes
1answer
305 views

ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse Show how one could exploit an implementation ElGamal signature scheme in which ...
3
votes
0answers
49 views

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...
3
votes
0answers
61 views

Example: pre-image resistance to second pre-image resistance

It is possible to convert a pre-image resistant function $f:\{0,1\}^{n}\rightarrow \{0,1\}^{n}$ to a second-preimage resistant function? I am thinking to use a pseudo-random generator and construct ...
3
votes
0answers
24 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
3
votes
0answers
24 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
3
votes
0answers
64 views

Explanation of part of a visual cryptography algorithm

I have been working on a project involving visual cryptography and I am stuck with the following problem. My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET ...
3
votes
0answers
124 views

Has anyone heard of matrix-based “Roman Doll” encryption techniques?

I've been told that prime-number factoring is based on a "roman-doll" sequence of matrices, where a seed matrix of height Y and width X exists consisting of all zeros except for a single 1 at row Y ...
3
votes
0answers
60 views

What is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; yet ...
3
votes
0answers
33 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the ...
3
votes
1answer
50 views

Why recently Edward curve formulas being developed that deviates from unification?

Edward curves were considered initially because it provides a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
3
votes
0answers
67 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
3
votes
0answers
69 views

How to recover $e$ from $f_A(e) = Ae \mod q$ when knowing trapdoor

I have a silly question, but I don't know a solution, so I need to question. Assume, with a algorithm $TrapGen(1^\lambda)$, it generates $A\in\mathbb{Z}_q^{n\times m}$ with a basis $B ...
3
votes
0answers
403 views

What are the vulnerabilities of this homemade encryption algorithm? [closed]

I decided to program a relatively trivial encryption algorithm in my downtime. This algorithm takes a seed from a user (supports floating point seeds), and then adds 1 to the seed for every iteration ...
3
votes
0answers
52 views

Are there any asymmetric composite order group bilinear pairings?

Are there any asymmetric composite order group bilinear pairings? Is there a drawback of asymmetric over symmetric bilinear pairings of composite order either in efficiency or in security ?
3
votes
0answers
232 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
3
votes
0answers
56 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
0answers
97 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...

15 30 50 per page