All Questions

266 views

Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
532 views

What are rounds in the context of ciphers?

Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
145 views

GGM PRG construction: Why do we need to change keys all the time with underlying PRG

When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
269 views

Finding a collision for a hash function

I'm trying to find a collision for the following (modified) Merkle–Damgård hash function. Suppose we already have a hash function $h : \mathbb{Z}_2^{2·n} \to \mathbb{Z}_2^n$ for fixed length bit ...
324 views

Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
2k views

Why does WPA-PSK not use Diffie-Hellman key exchange?

Is there a reason, why in pre-shared key mode, Wi-Fi session key is not secured with something like Diffie-Hellman but instead is derived from PSK key and some information exchanged in clear during ...
330 views

Simple homomorphic crypto for 32-bit integers

I'm looking for a simple way to perform homomorphic crypto on 32-bit integers. My only requirement is that I can add and subtract from the plaintext value without actually decrypting it. The crypto ...
362 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
142 views

High Power Computing for Crypto Research

Obviously, much of cryptography requires the assumption that adversaries have bounded computing power. So, I was wondering, are there any fields in cryptographic research for which high power ...
127 views

What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
1k views

ANSI X9.31 standards for generating random numbers

The NIST-Recommended Random Number Generator Based on ANSI X9.31 Appendix A.2.4 Using the 3-Key Triple DES and AES Algorithms has 3DES being used three times for each 64-bit block of random data ...
144 views

Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
320 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
221 views

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
127 views

Can you use the same key to provide a signature and a MAC?

Apologies if this is a stupid question, but I'd be grateful if someone could provide an answer. I'm assuming that you need to use different keys to provide these functions, is that correct?
615 views

Avalanche noise RNG for one-time pad use

I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad. The question is, would a HRNG ...
321 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...
265 views

Proving correctness of pseudorandom generator construction given existing pseudorandom generator

Say if I have a given pseudorandom generator G which takes a k-bit input and outputs a 3k-bit number. How should I show that a specific construction using this pseudorandom generator is valid? For ...
171 views

How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
3k views

How to decrypt AES in CBC

i am having problems understanding how CBC works! I know that it is a chain and the IV is XORed with the PT but then what? I mean we encrypt it with key k and the result is the CT which we use for the ...
512 views

Can I make a cipher (ex: Vigenère) harder to break?

The Vigenère cipher can relatively easy be broken when the key size is small compared to the size of the message. One first finds the length of the key, and then uses frequency analysis to actually ...
259 views

Conforming Randomness To An Alphabet

Imagine that we're trying to create a function to generate a random string conforming to a user-supplied alphabet. That way, users can generate random strings with given characters. Something like: ...
830 views

AES GCM implementation in c#

I am implementing an AES cipher in GCM mode in c# and have a few questions. My code is based on the code found here for reference. I'll copy in the relevant portions. ...
154 views

Format of NONCE in Initialization Vector (IV)

When we talk about a Number used ONCE (NONCE) in Initialization Vector (IV), is it required to use numbers only? Is is possible to use letters or special characters?
922 views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
591 views

Replay attack prevention under strict conditions

Say I have a request-response protocol and the task to make it immune to replay attacks. The requirements are as follows: The defense mechanism cannot rely on the clocks of the parties. The defense ...
314 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
242 views

Algorithm Design for only Mutual Information Sharing

Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
208 views

Can A PRNG Be Used To Generate Multiple Private Keys for ECDSA?

Suppose Alice seeds a cryptographically strong Pseudo Random Number Generator with a truly random number, and keeps it secret. Alice then uses the output of the PRNG to generate several 256-bit ...
740 views

How does Output Feedback mode use the initialization vector?

How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key? Will I encrypt the Initialization Vector like a block of plaintext? So ...
476 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
155 views

Signature scheme with two private keys, neither derivable from the other

Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ...
202 views

Is there a cumulative commitment scheme?

For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single ...
1k views

Dictionary attack on pass-phrases on common algorithms

I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
111 views

Why can't you just clone encrypted data and use it?

Let's take a contactless card for example (one for public transport lets say (i.e. MiCard)), the data is encrypted on the card and encrypted on the reader as far as I know. So how come somebody who ...
73 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
83 views

Can I simulate iterated AES-ECB with other block cipher modes?

I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding ...
78 views

What makes an algorithm “fast in software” vs. “fast in hardware”?

When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher ...
105 views

How to use ElGamal to encrypt zero?

ElGamal encryption algorithm is as follows: To encrypt a value $m$, it chooses a random value $r$, and calculates $c_1=g^r$ $mod$ $q$ $c_2=m*h^r$ $mod$ $q$ where $g$ is the group generator, $x$ is ...
62 views

OpenSSL des-ede3 not producing same output as test vector implies it should be

I'm encrypting one of the standard TDEA/3DES/DES-EDE test vectors with openssl: ...
156 views

How to customize a standard encryption algorithm?

I want to modify and customize AES encryption algorithm and develop a variant of it. What factors should I consider so that it does not become weaker? What skill sets would be required to undertake ...
88 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
111 views

Private Information Retrieval--Is it still theoretical?

Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers ...
55 views

Do data-dependent rotations have any advantage over fixed rotations?

There are many ARX ciphers, however most use fixed rotations. I know data-dependent compared to fixed rotations are: patented harder to implement constant time more expensive in hardware harder to ...
80 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
104 views

What is primary security in ECC?

I read the following paragraph in a book about Elliptic Curve Cryptography, but didn't understand it: The primary security in ECC is the parameter $n$; where $n$ is Order of point $G$, that is $n$ ...
50 views

Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
71 views

How secure is a lagged fibonacci sequence for encrypting brief messages?

Say I start with a 26-letter keyword and convert the letters into 26 integers (A=0, B=1...Z=25) nr[0] to nr[25]. Then I create a stream, nr[26] onwards, with a lagged fibonacci sequence where nr[n]= ...