0
votes
2answers
43 views

What info should be signed with a digital signature to provide entity authenticaton for DH?

$i \to r\colon\; g^x\bmod p$ $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$ $i \to r\colon\; \langle g^x,g^y\rangle_i$ Looking at run 2, I am trying to work out why it is necessary to include $g^x$ ...
-1
votes
0answers
29 views

Finding Probability in simulation of identity-based encryption [duplicate]

I have found such kind of demonstration in security proof. I don't know concept of $\epsilon$ and why $\frac{1}{2}$. Moreover, why subtraction is done $$|Pr[B(P,aP,bP,cP,e(P,P)^{abc}=1]-Pr[B(P,aP,bP,...
0
votes
0answers
9 views

Error when decompress smime file [migrated]

I receive this file from my friend. I use command to decompress it: openssl cms -uncompress -in myfile.txt -out content.txt but there are error: ...
3
votes
2answers
76 views

Are Paillier and El Gamal encryption schemes secure against quantum attacks?

I was wondering if there is a security difference between Lattice based homomorphic encryption schemes versus an partially homomorphic encryption scheme like Paillier, and El Gamal encryption schemes ...
1
vote
2answers
236 views

RSA cipher: ambiguous or break by eth root?

Confused about RSA message cipher: $c = m^e (mod\ n)$ So if $m^e$ can be greater than n, then you can get duplicate ciphers for the same message. Most postings I've read say that $m^e$ must always ...
1
vote
2answers
415 views

How to obtain 256-bit security from Ed25519?

It is said that breaking Ed25519 has similar difficulty to breaking RSA with ~3000-bit keys" 1 When using RSA, I prefer 4096-bit keys, but I would like to use Ed25519. If I wanted to double the ...
6
votes
1answer
85 views

What does Shor's algorithm tell us about the complexity class of RSA and the DLP?

If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these ...
0
votes
0answers
53 views

Why do openssl elliptic curve digital signatures differ by one byte [duplicate]

For some curves defined in Openssl 1.0.2h if I generate a key and generate a digital signature the size of the signature block changes by one byte. Why does this happen? My test file is, y.sh ...
1
vote
2answers
380 views

How can I control the output of a hash function to output to specific data according to similarity?

I do not know if the question lies exactly in that field but I'll give it a try unless rejection. I want to study methods of applying LSH functions to feet in a specific area of digest values. ...
8
votes
2answers
136 views

SAT-Based Public Key Cryptosystem

I am researching post quantum cryptography and I've stumbled upon this article which presents a PKC with an np-complete (SAT) trapdoor. I was wondering if someone could help me understand the way the ...
0
votes
1answer
64 views

Multiplicative sharing of 1

Let R be a ring. Is there a known/standard way for N parties to perform some exchanges, such that at the end each party holds an element $r_i\in R^\ast$ and $r_1r_2\dots r_N=1$ (and each party $i$ ...
4
votes
1answer
89 views

If a PRG is constructed by iterating a PRF, is it backtracking-resistant?

Say we construct a pseudo-random generator from a pseudo-random function $f$ (using some constant key $k$ and some initial value $v_0$). We do this by feeding the output block of the PRF back into the ...
2
votes
1answer
49 views

Is it safe to use a key as message in keyed hashing (HMAC)?

Scenario: User gives password. A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied. The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with ...
6
votes
1answer
280 views

Is HMAC-SHA-1 secure?

Although SHA-1 theoretically has collisions, HMAC-SHA-1 which is based on SHA-1 is still widely used (in TLS for example) and is considered to be secure. How is that possible?
3
votes
1answer
123 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
1
vote
2answers
57 views

How can I be sure the RNGCryptoServiceProvider is able to produce 12 bytes that can have 2^96 values?

I am writing code that needs to produce a truly random number of 96 bits. The requirements are: The code must be able to produce all $2^{96}$ values. The likelihood for any value to come up must be ...
1
vote
2answers
49 views

Layman's description of the padding oracle attack

I understand that the MAC-then-encrypt approach is susceptible to several attacks including the so called padding oracle attack. I understand that in this attack the attacker modifies the padding and ...
3
votes
2answers
73 views

Proving a function is one way hash function

I am working on a project which computes the hash of the given input, I have to prove that the function is pre-image resistant that is given an output we cannot get back to the input. While proving ...
4
votes
2answers
257 views

The main differences between Sketch of Proof and Full proof

My question in general is: Question 1: What are the differences between sketch of proof and full proof? In simulation-based proof, in semi-honest model, we construct a view that is computationally ...
4
votes
1answer
102 views

Is it possible to perform an MPC protocol to compute a product in a polynomial ring?

I hope not to be asking much, but I have N parties, each one holding a polynomial in with 0-1 coefficients and fixed degree $n-1$. I was wandering if it is possible (I mean feasible) to compute the ...
-1
votes
3answers
111 views

Why is RSA decryption the inverse of encryption?

In RSA, to encrypt a message, the following formula is used: $$c=m^e\bmod n$$ For decryption, $$m = c^d\bmod n$$ is used. However, when I try to substitute the value of $c$ from the first into the ...
8
votes
1answer
155 views

Where is the key in white-box AES cryptography?

After an initial study of white-box cryptography, specially around the first article (Chow et. al.), I understood each step of transforming the lookup tables of AES into new ones. If I understood it ...
3
votes
1answer
50 views

What is the LENGTH parameter in EEA2?

In the EEA2 option for encryption in LTE the AES-128 algorithm is mechanized. There, the nonce used in the CTR Mode is a 128-bit value. The first 64-bits are covered by a COUNTER, a BEARER, a ...
2
votes
1answer
38 views

Finding $f^{-1}$ in the YASHE keygen algorithm

In the YASHE (Yet Another Somewhat Homomorphic Encryption) algorithm, the beggining of the key generation step specifies: Sample $\ f',g ← χ_{key}$ and let $\ f = [tf' + 1]_q$. If $\ f$ is ...
12
votes
10answers
3k views

Are there any advantages in using proprietary encryption?

Proprietary software generally relies on the fact that in keeping the encryption algorithm private, it gets an extra layer of security implying "Security through Obscurity." Obviously this phrase has ...
3
votes
1answer
115 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
1
vote
1answer
35 views

ZK proof that two short solutions are equal

Let $A_1$ and $A_2$ two $m \times n$ matrices defining SIS problems. Does there exist a zero knowledge proof that two short solutions are the same, i.e. $$y_1 = A_1 x $$ $$y_2= A_2 x $$ $$ \Vert x \...
1
vote
2answers
181 views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...
-2
votes
0answers
73 views

How to calculate ϕ(n) from n?

I'm trying to fully understand all the steps of the RSA algorithm. I have clear so far that: $n$ comes from the product of two numbers: $p$ and $q$ The public key consists of the pair ($e$, $n$) ...
3
votes
1answer
98 views

Do equivalent RSA keys exist?

If $m^{ed} \bmod n = m$ for message $m$, public key $e$ and private key $d$, then adding any integer multiple of $n$ to $m^{ed}$ still equals $m$ modulo $n$. Supposing it exists, how do I find an ...
1
vote
1answer
662 views

Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
4
votes
1answer
158 views

Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
0
votes
1answer
59 views

How to do statistical analysis on encrypted / anonimized data

Let's imagine Alice wants to send Bob a table with 2 columns: ...
10
votes
1answer
119 views

K Friedman - two texts explanation

I read the $K$-Friedman test to determine the period of a Vigenère ciphertext, and I understand something like this: $K$-Friedman test tries to find out what period of the cipher by calculating some ...
6
votes
2answers
211 views

Can I use a differential that can be traced through the whole cipher with 100% probability?

I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
1
vote
1answer
69 views

Is brainpoolP512r1 safe?

I'm using brainpoolP512r1 elliptic curve for DSA and DH in my application. Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Unfortunately my curve wasn't ...
3
votes
0answers
22 views

Construct new SIS solutions from given ones

Assume we have a lattice SIS problem $A x = 0$, with $\Vert x \Vert < \beta$ and we are given $k$ solutions $x_1, \dots, x_k$ by, say an oracle. Is it then hard or easy to construct from there a ...
4
votes
1answer
393 views

Do all ciphers have equivalent decryption keys?

Do all ciphers suffer from the problem of multiple equivalent decryption keys? Is the existence of equivalent keys an essential property for the security of a cipher? If you could prove that a cipher ...
6
votes
1answer
145 views

Under what conditions did a Bletchley bombe stop?

I am trying to understand the conditions necessary for one of the Bletchley Park bombes to stop. Let me give an example. I have been experimenting with Enigma machine and bombe simulators to try to ...
0
votes
1answer
78 views
9
votes
2answers
481 views

How to deal with a cipher with addition and XORs combined together?

I am trying to cryptanalyze a cipher where bitwise XOR and addition mod $2^n$ are combined together. I've been working on it for a long time but with no result - the main difficulty, which I am unable ...
0
votes
0answers
15 views

How to set M parameter for frequency test within a block

I am using statistical tests to determine whether a sequence of bit is random, one of them is frequency test within a block. In a nutshell: Within a block of M a number of 1 is counted. A joined ...
1
vote
0answers
28 views

Freely available softwares for simulating/implementing MPC protocols [closed]

I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to ...
2
votes
3answers
202 views

What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?

As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^...
5
votes
1answer
44 views

How simple can the PRP used in the Even-Mansour scheme be?

For example, in the question “Is there any reason not to use Single-Key EM with AES and a constant key?” it is proposed to use AES with a fixed key as the permutation in a xor-permute-xor construction....
2
votes
2answers
336 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
0
votes
0answers
19 views

How to prove a key generation protocol based on blind RSA signature?

It seems like that a user may use blind RSA signature to obviously generate a key. My design is as follows. Please correct me if I get anything wrong. (Please refer to WiKi https://en.wikipedia.org/...
0
votes
0answers
14 views

how do i incorporate AES encryption into a text encryption hta in the form of a batch file? [migrated]

i made an hta app and a few batch file encrypters and decrypters used in the hta for encrypting text. how can i incorporate AES encryption into my hta? i would like to have an AES encryption function ...
3
votes
1answer
107 views

Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...

15 30 50 per page