3
votes
0answers
60 views

What is SRP-Z from?

The Stanford license for SRP says: Broader use of the SRP authentication technology, such as variants incorporating the use of an explicit server secret (SRP-Z), may require a license; yet ...
3
votes
0answers
33 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the ...
3
votes
1answer
50 views

Why recently Edward curve formulas being developed that deviates from unification?

Edward curves were considered initially because it provides a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
3
votes
0answers
67 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
3
votes
0answers
69 views

How to recover $e$ from $f_A(e) = Ae \mod q$ when knowing trapdoor

I have a silly question, but I don't know a solution, so I need to question. Assume, with a algorithm $TrapGen(1^\lambda)$, it generates $A\in\mathbb{Z}_q^{n\times m}$ with a basis $B ...
3
votes
0answers
405 views

What are the vulnerabilities of this homemade encryption algorithm? [closed]

I decided to program a relatively trivial encryption algorithm in my downtime. This algorithm takes a seed from a user (supports floating point seeds), and then adds 1 to the seed for every iteration ...
3
votes
0answers
52 views

Are there any asymmetric composite order group bilinear pairings?

Are there any asymmetric composite order group bilinear pairings? Is there a drawback of asymmetric over symmetric bilinear pairings of composite order either in efficiency or in security ?
3
votes
0answers
232 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
3
votes
0answers
56 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
0answers
97 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...
3
votes
1answer
85 views

Build set with PKI from reliable broadcast / random beacon

I am trying to build a protocol (or find an existing one) for creating a set $S_2$ with PKI from a set of parties $S_1$ that initially does not know anything about the other parties. We assume ...
3
votes
0answers
77 views

Using machine-learning techniques for data-dependent operations in ciphers

From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich, The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
3
votes
0answers
102 views

Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency

I am asking for help in finding a signature algorithm with the following property: Given a message m and a private key prikey, ...
3
votes
0answers
66 views

Managing data permissions/access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how is it possible to share access of encrypted data with N entities, and be able to ...
3
votes
1answer
125 views

Secure Deduplication and Encryption in a data store

Assume: We have a centralized data store that can store whatever we need Every user is online Function $f : File \to Key$ gets access to the store, and is the same for all users. $g : Key \to File$ ...
3
votes
1answer
92 views

Implementing the Mceliece Encryption - making the Generator Matrix

I am working on an implementation of the Mceliece Encryption system (MCE) and the Niederreiter encryption system. I have been through the basics of finite fields, polynomial arithmetic and some coding ...
3
votes
0answers
87 views

Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality? In this question it would be allowed for the streaming mode to leak if ciphertexts ...
3
votes
2answers
180 views

PGP String to Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
3
votes
0answers
121 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
3
votes
0answers
65 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
3
votes
2answers
128 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
3
votes
0answers
42 views

Can anyone explain how the modified r-adding walk works?

I was going through a paper titled “Accelerating Pollard's Rho Algorithm on Finite Fields” by Jung Hee Cheon et al. I understand the table(Ml) creation part of it, but after that I somehow fail to ...
3
votes
2answers
199 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
3
votes
0answers
210 views

Pseudo-Hadamard transform, most significant bit

For clarification: The Pseudo-Hadamard transformation is a reversible transformation of a bit string that provides cryptographic diffusion. Splitting a bit string (with bit length of $2n$) into two ...
3
votes
0answers
56 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
3
votes
0answers
109 views

FHE over the integers - Is that paper's scheme known to be insecure against quantum adversaries?

I was reading the paper Fully Homomorphic Encryption over the Integers, and started wondering if there is a known quantum attack on their main scheme, because There is an efficient quantum attack ...
3
votes
0answers
192 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
3
votes
0answers
129 views

Paper about this secure P2P idea?

Two or three years ago, I was reading something interesting, but then I lost the paper. The paper described building secure and fast P2P networks (not like tor or I2P). Unfortunately, I only remember ...
3
votes
0answers
97 views

HMAC definition by using only one key

Suppose $H$ is a hash function; why is $H(k||H(k||m))$ not secure? See this HMAC definition. In there, indeed two keys are used and the mac algorithm is $H(k_1 ||H(k_2 ||m))$ . Why don't we use ...
3
votes
0answers
171 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
3
votes
0answers
101 views

What might be assumed about a PRF if the key has been chosen?

The defining feature of a PRF $f:\{0,1\}^k\times\{0,1\}^s\mapsto\{0,1\}^*$ is that, if the first parameter is selected at random, it should be indistinguishable from a function ...
3
votes
0answers
105 views

Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
3
votes
2answers
82 views

Group membership with unique anonymous claims

Is it possible to accomplish the following scheme? There is a Server (S) and many clients. Each client enrolls with S, exposing its real identity; S saves the real identity information in its ...
3
votes
0answers
842 views

Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements? [closed]

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, ...
3
votes
0answers
251 views

Key expiration policy for 3DES / TDES / Triple DES

I have a system that signs plain text messages using a message authentication code (MAC) encrypted with 3-key Triple DES. The short message is used on connection to establish a session key, so it ...
3
votes
0answers
274 views

Entropy of Androids motion-sensor data

My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation. The user is told to shake the device so ...
3
votes
0answers
109 views

How much plainext could be known without reducting security of RSA?

It is known, for example, that exposing 50% of most significant bits of RSA private exponent does not provide security risk (when a small public exponent it used). So how to qualify security ...
3
votes
0answers
203 views

Prove preimage resistance property

Let $ f : \{0,1\}^* \rightarrow \{0,1\}^n$ and $ g : \{0,1\}^* \rightarrow \{0,1\}^m$. $h$ is created by concatenate f and g: $ h : \{0,1\}^* \to \{0,1\}^{n+m}$ with $h(x) = f(x) || g(x)$. How do I ...
3
votes
0answers
138 views

Secret sharing - no dealer, modifiable, verifiable

I need to find a secret sharing scheme with these properties: The scheme is set up by all participants, ie no single entity called the dealer The parameters of secret sharing need to be ...
3
votes
0answers
220 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
3
votes
0answers
183 views

What aspects of information theory are used in modern cryptography? [closed]

In studying modern (and classical) cryptography, many notions from information theory crop up. Unicity distance, min-entropy, compression, encoding, etc. What parts of information theory should be ...
3
votes
0answers
86 views

Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking). Specifically this scheme: If you look at the ...
3
votes
0answers
93 views

Hi Sec National algorithm

I'm trying to create a remote controller compatible with HiSec algorithm. It's so old that National (now Texas Instruments) discontinued NM95HS01/02 and docs are unavailable. Does anyone have the ...
3
votes
1answer
324 views

How can I prove/disprove that a construction yields a secure PRG?

Let $G:\{0,1\}^{*} \mapsto \{0,1\}^{*}$ be a secure PRG. Prove or disprove that the following construction also yields a secure PRG. $$G'(k) = G(k||0),$$ where $||$ denotes the concatenation of two ...
3
votes
0answers
228 views

Logics for Cryptographic Information Games

Preamble: There is currently a zoo of various logics for evaluating (proving) security in cryptographic protocols. The idea is that, by expressing these protocols using some logic, you can create a ...
3
votes
0answers
128 views

Which encryption method supports random reads?

I have a file containing 16-bit samples and I want to encrypt it, but the problem is that I need to be able to read any random 16-bit value from the file, and be to able to decrypt it, without reading ...
3
votes
0answers
57 views

CBC with random prefix but no IV - secure? [duplicate]

I'm looking at a datagram-based protocol that encrypts a payload. The payload is encrypted with AES or blowfish in CBC mode, and the result is then authenticated with a HMAC. To save space, the ...
3
votes
2answers
219 views

Using single EC cert/keying material to derive symmetric encryption key (for storage)?

The situation involves a single party (single certificate) who would want to AES encrypt a file that they can later decrypt. Assume the EC certificate + EC keys have a purpose i.e. "File encryption" ...
3
votes
0answers
131 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
3
votes
0answers
114 views

Question about proof of knowledge defintion?

I am just reading the "soundness"-definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ to know a secret ...

15 30 50 per page