4
votes
1answer
55 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
4
votes
1answer
54 views

(How) Can we use HOTP for file encryption?

I recently went through the list of available KeePass plug-ins and noticed one that advertises support for HOTP as a means to derive the database key. Now I trust the developer of this plug-in who is ...
4
votes
1answer
68 views

How does order-preserving encryption work on string?

I have read “How does order-preserving encryption work?”. After that, I completed order-preserving encryption on integer data. Now, I have four questions in this subject: Is it possible to apply ...
4
votes
1answer
37 views

Rainbow Table - Number of Chains and Chain Length

Is there a difference between having 10,000 of chains (with 1,000 chain length) and 10,000 chain length (with 1,000 of chains)? How does it affect the success rate of the rainbow table? I understand ...
4
votes
1answer
69 views

Is there an example of a “robust, yet not private” SMC protocol?

I have been trying to understand the interplay between robustness and privacy of an SMC protocol. It is easy to come up with a protocol that is private but not robust. Can someone provide an example ...
4
votes
1answer
51 views

Is there any IND-CPA secure stream cipher with a “standard” hardness assumption?

I've read our recent question: "One-time pad using RSA and Diffie-Hellman functions" which asks about the security of a particular way to convert RSA and discrete exponentiation into a stream cipher. ...
4
votes
1answer
72 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
4
votes
1answer
57 views

Padding password before SHA-512 hashing to avoid info leak via timing

I've noticed that SHA-512 password hashing leaks some information about the password length. There's a weak correlation between password length and time to hash. It's roughly linear, but in steps of ...
4
votes
1answer
35 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
4
votes
2answers
122 views

Using One Time Pad with a block cypher

The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ...
4
votes
1answer
56 views

How is McEliece chosen plaintext secure?

Suppose a challenger creates a McEliece encryption system where there is a public key consisting of a matrix $G$ representing some linear code, and a number $t$ for the number of errors. Then the ...
4
votes
1answer
67 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
4
votes
1answer
137 views

How to generate fingerprint for PGP public key

I would like to know how to generate a fingerprint for an openPGP public key. To be clear, I'm interested in how the fingerprint is generated. I'm aware that I can get the fingerprint with a ...
4
votes
1answer
105 views

How does the Flickr length extension attack work?

I am currently reading about the length extension attack on Flickr (pdf) but not understanding what's going on there. ...
4
votes
1answer
85 views

Diffie-Hellman: *assumed* largest prime factor of order of $g$?

I've read in several places: some of my confusions about DDH assumption - comment by Thomas Pornin on his own post Is there a key length definition for DH or DHE? - the answer by Tom Leek that ...
4
votes
1answer
87 views

Is my pin algorithm secure?

I'm a hobby programmer and very new to this field. I opened a bank account recently and got two pins. One for the girocard and the other for a creditcard. And I needed two more pins for the online ...
4
votes
1answer
48 views

Blake2: truncate 512-bit hash is safer than 256-bit by Config?

I need to calculate 256-bit hash in my code, using BLAKE2. I know I can set BLAKE2 to generate itself a 256-bits hash for any data but I´m curious to know what can be safer and faster: 1- Create the ...
4
votes
1answer
89 views

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the ...
4
votes
1answer
142 views

Private and Public Keys

I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ...
4
votes
2answers
291 views

Is there a difference between asking for a signature and asking for a decryption in challenge-response authentication?

Consider the following two authentication schemes. In both cases the server knows a public key of the client (for a signature system in the first and an encryption system in the second case). Scheme ...
4
votes
3answers
124 views

Fast forwarding hash functions

We know that a good hash function is a one way/trapdoor function. Easy to calculate one way, harder to work out a previous state. I was wondering if anyone knew a good hashing system that allowed you ...
4
votes
1answer
73 views

Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator. Should we encrypt $S|M$ or $M|S$? Does it even matter?
4
votes
2answers
108 views

Probabalistic Polynomial-time Algorithms & One-way functions

I've been reading up on probabilistic polynomial-time algorithms and one-way functions, and I was hoping to get some guidance on the topic. A textbook I'm reading states the following for one of the ...
4
votes
1answer
279 views

How can a Encrypt-And-MAC scheme be insecure if the encryption is CCA secure?

I was presented with this seemingly paradoxical information, and am hoping someone can explain what I'm missing here. I have an encrypt-and-mac scheme here.If I want to transmit message m to Bob, I'd ...
4
votes
2answers
143 views

Do we have to consider the cryptographic properties of the decryption, if we're only using the encryption?

Treyfer for example has slower diffusion in decryption. It has full diffusion between words in 2 rounds for encryption and 7 rounds for decryption. Do we have to consider the (bad) cryptographic ...
4
votes
1answer
125 views

ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
4
votes
1answer
205 views

Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
4
votes
1answer
116 views

OpenPGP Public-Key algorithm

What means when pgpdump shows this kind of algorithm in the Public-Key Encrypted Session Key Packet? ...
4
votes
2answers
400 views

Why must we generate the signature before any compression being done at PGP?

I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ...
4
votes
2answers
103 views

Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
4
votes
2answers
174 views

Is there any such thing as “proof of location”?

I'm looking for a way for someone to prove to me their geographical location without a trusted third-party. Imagine wanting to prove to someone you're actually physically in a specific place. I'd ...
4
votes
2answers
82 views

Is there a signature scheme for the Cramer-Shoup cryptosystem?

I have a project that I have to use cryptosystem and signature scheme for it. I've read about Cramer-Shoup cryptosystem and I want to use it since it is more secure the ElGamal cryptosystem, but, I ...
4
votes
1answer
189 views

Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
4
votes
1answer
174 views

Generating PGP key *without* random generator? (using fixed input only)

I understand why in general, a strong random generator or source of entropy is used when generating PGP keys. However, I have a use case where I want to generate PGP keys deterministically, i.e. ...
4
votes
1answer
162 views

How to generate new LWE samples

Assume we are given a small fixed number of LWE samples with secret $s$ and error $e$, where the error distribution is taken so that the LWE problem is hard. My question: How can one further ...
4
votes
1answer
232 views

what are the NTRU keysize and application in industry ?

I'm a student currently working on a research project on the NTRU cryptosystem, I've read some papers about this cryptosystem, and in those papers they are talking about keysize, is it the size of the ...
4
votes
1answer
132 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
4
votes
1answer
311 views

Is there a format preserving cryptographically secure hash?

I want a way to 'scramble' strings (like words, names) in a predictable way but I don't ever want to (myself or anyone else) be able to 'unscramble' the strings. I found that perhaps what I am ...
4
votes
1answer
166 views

What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
4
votes
1answer
144 views

Spritz cipher sponge function capacity

Rivest and Shuldt proposed a new sponge like cipher algorithm called Spritz: http://people.csail.mit.edu/rivest/pubs/RS14.pdf In this paper they say that the strength of the cipher is related to the ...
4
votes
1answer
199 views

Is it safe to derive a password from a signature provided by ssh-agent?

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
4
votes
1answer
661 views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
4
votes
1answer
80 views

NIZK Proof of knowledge N of M discrete logarithms (threshold)

It is well known how to produce a NIZK that curvepoints $aG$ and $aP$ have the same discrete logarithm $a$ with respect to the curvepoints they are multiplied by. There is also a way to prove that a ...
4
votes
2answers
1k views

Efficient AES - Use of T-tables

I'm really in trouble! I'm trying to understand how the T-tables in AES encryption work. But I don't know if I get the point. What I understood is that they are used to reduce the whole computation of ...
4
votes
1answer
280 views

“Practical” operations supported by functional encryption?

I'm curious about what operations have been developed into functional encryption schemes. What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic ...
4
votes
1answer
212 views

Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
4
votes
1answer
197 views

Session-specific Symmetric Key Derivation Using SHA256

I was wondering if there were any security implications of deriving session keys from a symmetric key using SHA256 in the following manner: $Ks = SHA256(Nonce||K)$, where $Nonce$ is the session ...
4
votes
1answer
115 views

Clarification of the terms “brute force” and “guess”

In the answer to the question “What exactly is a negligible (and non-negligible) function?” There is a part in the explanation that – as far as my knowledge goes – is conflicting: But instead of ...
4
votes
1answer
326 views

Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing?

Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ...
4
votes
1answer
161 views

Multiplication-homomorphic schemes

I'm looking into multiplication-homomorphic schemes now and basically I see that there are 3 options: RSA, Boneh-Goh-Nissim and ElGamal. RSA was proved to be insecure unless message is randomly ...

15 30 50 per page