3
votes
1answer
119 views

Mixing Entropy Sources by XOR?

Assume that I have two sources of entropy (say, a hardware RNG and a CSPRNG) and that the two sources are independent (do not know anything about the internal state of the other RNG). Can I mix them ...
1
vote
1answer
63 views

How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system

I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others ...
1
vote
1answer
56 views

Fiat-Shamir security problem question

I am trying to understand the Fiat-Shamir identification protocol, but have a problem with understanding how this protocol is supposed to be save, even if you repeat it several times. I am using ...
3
votes
2answers
132 views

Generate a unique 64 bit numeric database key from a string without collisions at $2^{32}$ birthday threshold?

What is the best way to generate a unique 64 bit numeric database key from a string? For example: if the string is a URL, you could generate a 64 bit key using SipHash or by truncating a SHA256 hash ...
3
votes
2answers
98 views

Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery?

In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message ...
0
votes
0answers
145 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
5
votes
1answer
128 views

How can one detect if a hash function doesn't have a full image?

Suppose we have a hash function $H: \{0,1\}^* \mapsto \{0,1\}^n$, that doesn't get all the $n$ length bitstrings as a value for any input, but is otherwise secure. Can that fact be detected? For ...
1
vote
1answer
63 views

Familiar key signing over video call

Say that a friend of mine and I have both generated new PGP keys, and we want to use a video call to verify each other's new keys because we live on opposite sides of the planet. While we could both ...
3
votes
1answer
118 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
3
votes
2answers
68 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
1
vote
1answer
110 views

Are those RSA keys flawed?

I used rsa-json.native to generate RSA keys for a node.js application that will use secure-peer later to connect two clients with each other. Now I have 2 questions: In secure-peer/index.js I've ...
5
votes
1answer
135 views

Significance of rotation constants in SHA-512?

In a single round of SHA-512, in the operations $\Sigma_0(A)$, $\Sigma_1(E)$ why are the constants $28$, $34$, and $39$ used for the number of rotations? What significance do these numbers have? What ...
3
votes
1answer
109 views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
0
votes
1answer
77 views

ECDSA: Retrieving non-random k [duplicate]

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
-1
votes
1answer
131 views

What does it mean that a protocol realizes “strong mutual authentication”?

What does it mean that a protocol realizes "strong mutual authentication"? And What does it mean that a protocol realizes "weak mutual authentication"? Can you define them formally ? I have found a ...
2
votes
1answer
86 views

Why are there only positive value points on an elliptic curve?

I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ ...
5
votes
2answers
172 views

Obfuscate an “I'll reveal if you do” function

Is there any cryptographic obfuscation scheme that will let me obfuscate a program that reveals my secret, if you reveal yours? Formalization. Let $C(\cdot),V(\cdot)$ be a secure commitment scheme. ...
1
vote
2answers
70 views

Sender and receiver having different moduli conflicts with encryption and signing in RSA

I should implement a security protocol as a part of which I need to: Encrypt the message with receiver public key. Sign it with my private key. Send it to receiver. Suppose that the system uses a ...
1
vote
1answer
52 views

Must the ciphertext be longer than the key for symmetric encryption?

I am planning to encrypt the different fields of a database independently, using a symmetric encryption scheme (probably 3DES). Since some of the fields are as small as an integer, may that be ...
2
votes
1answer
74 views

What differences between Menezes–Vanstone ECC and ElGamal ECC?

After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ...
1
vote
2answers
159 views

Attack on a key-exchange,symmetric-key cryptography protocol

This is an exam question in Oxford 's Computer Security course: Here is the start of a protocol, based on a long-term secret key $k_{AB}$ previously shared between Alice and Bob, designed to offer ...
2
votes
1answer
62 views

Multiplication-homomorphic schemes

I'm looking into multiplication-homomorphic schemes now and basically I see that there are 3 options: RSA, Boneh-Goh-Nissim and ElGamal. RSA was proved to be insecure unless message is randomly ...
1
vote
0answers
106 views

RSA encryption and signature padding flaw

This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...
2
votes
1answer
111 views

What are differences between $E(F_p)$ and $E(Z_p)$?

When I read some books about elliptic curve cryptography noticed that. sometimes symbolized elliptic curve over $F_p$ is $E(F_p)$ and sometimes symbolized elliptic curve over $Z_p$ is $E(Z_p)$. I ...
1
vote
0answers
78 views

Commutative Encryption with RSA scheme?

I wanted to know how I could manage to do what I'm going to tell you next, with the RSA encryption/decryption scheme. So Alice and Bob each have a public key $(n, e)$ and a private key $(p, q, d)$; ...
2
votes
1answer
114 views

Pick faster private exponent

I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ...
1
vote
1answer
71 views

How (in)secure is a signature based on DSA with DSS1 (SHA1) in reality?

As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question). I’d prefer DSA over RSA in my ...
1
vote
2answers
115 views

Three different numbers with x³=x mod p

p is a prime greater than 2 and $a \in \mathbb{Z}_p$. Why are there exactly three solutions for a³ = a mod p? Obviously 0 and 1 are both in $\mathbb{Z}$ and valid solutions, but that still means, ...
1
vote
1answer
86 views

Modulo properties of two prime numbers

I am supposed to prove that x = y mod (p*q) <=> x = y mod p and x = y mod q with p and q are prime numbers. It somewhat sounds reasonable to me, but unfortunately I don't have any clue how to prove ...
0
votes
1answer
36 views

server aid secure equality test

The scenario is like this: $P_1$ has $m_1$, $P_2$ has $m_2$, they want to compare whether $m_1=m_2$ via the server $S$. After the protocol, only $S$ knows the result, and there is no interaction ...
4
votes
3answers
209 views

Can I create a fixed length output from a fixed length input?

I use AES256 for various purposes in my app. However, the purpose I am now trying to achieve is the following: Input is for example AU00000001 and I would like a ...
2
votes
2answers
95 views

Is there an oblivious decryption scheme?

Alice has $K$; Bob has $E(K, m)$; Is there such a scheme that enables Alice decrypts $E(K, m)$ without knowing $m$, and Bob gets $m$ ?
5
votes
1answer
85 views

Universal Circuits in Indistinguishability Obfuscation Candidate Construction

I am currently working on an implementation of the candidate construction for an indistinguishability obfuscator that was recently proposed by Garg et al. The relevant paper can be found here. ...
1
vote
2answers
135 views

Padding to increase entropy and size of (otherwise) small JSON objects

Maybe this better fits, the security stackexchange... I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I ...
2
votes
0answers
94 views

Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
2
votes
2answers
90 views

Comparing two values without revealing them

Suppose Alice wants to prove to Bob that t1 is less than t2. t1 and ...
1
vote
1answer
83 views

Are formal methods used for cryptographic protocol design?

I decided to learn more about the application of formal methods to cryptographic protocols and found this interesting talk by Cathy Meadows at YouTube. After doing research about how people are using ...
0
votes
0answers
47 views

P = NP security implications [duplicate]

If someone finds an efficient way (ridiculous or not) to turn NP into P (such as creating multiple universes, saving the one with the correct answer), would we have any good algorithms for encryption, ...
1
vote
1answer
91 views

Is CTS necessary on a AES-CBC DRBG?

As I understand it, CTS pads the last block and swaps it with the second last to compensate for a partial block of data. I have written a DRBG (Deterministic Random Bit Generator) using AES-CBC that ...
3
votes
1answer
131 views

Twisted curves in protocol

I've come to understand that twisted curves, as for instance defined in the Brainpool specifications, are $F(p)$-isomorphic to their regular $F(p)$ equivalents. So brainpoolP256r1 is isomorphic to ...
2
votes
1answer
96 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
-1
votes
1answer
48 views

Theory for pre-paid debit card: card-to-card transfer [closed]

In Sweden in the late 90's they deployed a electronic prepaid cash system system, and if I remember correctly you could transfer money between cards without online access. Wikipedia states that the ...
1
vote
1answer
60 views

Number of different substitution alphabet ciphers possible with given conditions?

If you consider a 26 letter alphabet, and a cipher where 24 of the letters are sent to themselves, and only 2 letters switch, how many different substitution alphabet ciphers are there, and what ...
0
votes
1answer
81 views

How can I process data within a cloud securely?

I'm new to programming and I'm getting ready to design a proof of concept for an app that I'm thinking of building. Problem is I'm a complete noob to cryptography and need a little nudge to point me ...
8
votes
3answers
335 views

Security of a security protocol for key exchange, using symmetric-key cryptography

This is an exam question: $A \to B$: Alice, $nonce_A$ $B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$ $A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$ Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$ ...
2
votes
1answer
322 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
1
vote
1answer
81 views

Use additional keys to thwart key compromise?

Is it good or bad practice to design crypto protocols for key compromise by using additional keys? Argument for bad practice would be: When you have a key you should trust it and not throw more keys ...
3
votes
1answer
85 views

Measure ECC key size

I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key. So I would ...
2
votes
1answer
180 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
5
votes
1answer
285 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...

15 30 50 per page