2
votes
0answers
119 views

Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
2
votes
0answers
110 views

Formal proof of theorem concerning the Random Oracle Model

Reading a book on cryptography by Douglas R. Stinson I've met the following theorem, which is stated without proof (see here). Thereby, $\mathcal{F^{X,Y}}$ denotes the set of all functions from ...
2
votes
0answers
75 views

What is the fixed point attribute of DES (when used with weak-keys)

I've heard in some lecture that the weak keys in DES implies the existence of $2^{32}$ fixed points in the algorithm, i.e. that $DES_k(x)=x$ for $2^{32}$ such $x$'s. I couldn't find anything about ...
2
votes
0answers
356 views

Existential Forgery on textbook RSA signatures

Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen $σ_1 = (m_1)^d \bmod N$ and $σ_2 = (m_2)^d \bmod N$ He forges $m' = m_1\cdot m_2$ $σ' ...
2
votes
0answers
57 views

How exactly is the output of the XOR step in PBKDF2 used?

I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ...
2
votes
0answers
107 views

Are all binary-additive stream ciphers reciprocal?

I'm writing a thesis focused on Maurer's provably-secure stream cipher. Long story short, this cipher works by expanding a short key into a long keystream and then XORring this keystream with the ...
2
votes
0answers
324 views

Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
2
votes
0answers
61 views

Permutation parity after cycle-walking

Let $E$ be a random even permutation of the set $\{0\dots n-1\}$. We construct a permutation $P$ of the set $\{0\dots m-1\}$, for some $m\le n$, using cycle-walking; that is, computing $P(x)$ is as ...
2
votes
0answers
101 views

Does the SSH protocol preserve integrity if an endpoint is cloned?

I am trying to find out if the SSH protocol preserves integrity of the transferred data in the following scenario: The SSH client is running on a virtual machine, at some point in the middle of the ...
2
votes
0answers
155 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
2
votes
0answers
82 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
2
votes
0answers
104 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
2
votes
0answers
108 views

Multi-round Transposition/Playfair as a secure hand cipher in the computer age

Given that computers can be easily compromised, there is a need for a hand cipher that can withstand computer attack. Clearly the traditional hand ciphers fail. One time pads work. They also have ...
2
votes
0answers
99 views

Using same key for encryption and ECBC-MAC k2

ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$ If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?
2
votes
0answers
61 views

How good is middle cube method with jumbled digits?

I had to make my own prng for a stream cipher for an inter school science project (I am mentioning that a lot). So I thought of cubing the seed instead of squaring it (like in the middle square ...
2
votes
0answers
119 views

How to compute the decompositions used in fast FHE bootstrapping?

Leo Ducas and Daniele Micciancio's recent paper "FHE Bootstrapping in less than a second" gave an exciting result that one can compute the `atom operation' of Fully Homomorphic Encryption (i.e. ...
2
votes
0answers
70 views

Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...
2
votes
0answers
181 views

Encrypted database: how to deal with general queries?

My question is quite related to the concept of homomorphic encryption, which is not practical at all nowadays. In short, I would like to know how to query encrypted databases. Simple queries which ...
2
votes
0answers
102 views

See any problems with this search-specific homomorphic encoding strategy?

I'm imagining this for use in the scenario of cloud-stored client-encrypted email, where, when seeking to do a string search across messages, you don't want to have to download every stored message in ...
2
votes
0answers
303 views

What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
2
votes
0answers
70 views

exchanging private key between service and iPhone app - digital signing

I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally ...
2
votes
0answers
572 views

Understanding the FMS attack on WEP

I am trying to implement the Fluhrer, Mantin and Shamir attack, one of the ways to break WEP. I seem to have hit on a problem. I have no idea whether or not it is a programming error, or if I don't ...
2
votes
0answers
383 views

Chi-Squared Step of Vigenere Cipher Decryption

So, I have been assigned an assignment where I had to solve a Vigenere cipher. Following along with this webpage I managed to get all the way to the chi-squared step. But, that is the problem. Upon ...
2
votes
0answers
571 views

What does “G2” mean when used with X509 certficates and certificate authorities?

For example "Google Internet Authority G2"?. I thought it was another way of specifying Class 2 (for organizations, for which proof of identity is required) but then see certificates such as "VeriSign ...
2
votes
0answers
98 views

Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks?

As the question suggests, I wanted to get a sanity-check on this issue... is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay ...
2
votes
0answers
70 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
52 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
2
votes
0answers
90 views

What does Set Membership actually prove?

While going through this paper, I came across the idea of Set Membership proofs. The proof allows a prover to prove that a value is contained in some set. The point where I am confused is, all the ...
2
votes
0answers
75 views

IND-CCA2 secure schemes without Plaintext Awareness?

I have been reading up on IND-CCA2 security and was wondering: Are there efficient IND-CCA2 secure schemes that do not require plaintext awareness? I'm guessing yes - could someone point me to these ...
2
votes
0answers
83 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions ...
2
votes
0answers
141 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
350 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
2
votes
0answers
75 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
2
votes
0answers
130 views

A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
2
votes
0answers
101 views

Protocol: Coin Flipping over phone

Protocol: Coin Flipping over telephone Hypothesis: Alice and Bob have agreed: a one to one function $f$ which is easy to compute $f(x)$ from $x$ and while given any value $f(x)$ it is nearly ...
2
votes
0answers
45 views

Malicious KGC attack in the identity-based authenticated key exchange protocol

There are two users $A$ and $B$ who are in different domain. Let's assume that $A\in KGC_1$ and $B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ...
2
votes
0answers
135 views

Convergent encryption has dictionary attack, but why hash function doesn't?

Convergent encryption (CE), $E_k(d)$, is a way to encrypt the data $d$, with the characteristic that the encryption key $k$ is $k=h(d)$, where $h(\cdot)$ is a cryptographic hash function. Consider a ...
2
votes
0answers
74 views

Type 2 to Type 1 pairing transformation - why not considered?

How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) ...
2
votes
0answers
327 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
2
votes
0answers
141 views

Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in Python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
2
votes
0answers
102 views

How can I make a message into a blocks for NTRU?

I have more bits than the degree of the NTRU polynomial. For example: $x^{11}-1$ message: Hello (I am using ascii, 8 bits for 1 symbol) got: ...
2
votes
0answers
215 views

Secure Secret sharing

I'm trying to come up with a new way to do oblivious transfer that is faster and requires less computation than existing methods. The basis of my method is shamir secret sharing. Below is an example ...
2
votes
0answers
121 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
2
votes
0answers
91 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
2
votes
0answers
77 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
2
votes
0answers
46 views

Delinearization in whitebox techniques

I'm reading through Chow et al.'s paper and Link et al.'s paper. There's a part I don't understand about Delinearization. They convert some steps of AES/DES into a Matrix, then divide the matrix in ...
2
votes
0answers
66 views

Expand 1-n Oblivious Transfer to retreave only an item I, for which permissions exist

To my understanding in a 1-n Oblivious Transfer the Sender has some Values $X_1...X_N$ and the receiver wants to retreave some $X_I$, with $1 \le I \le N$. Can one now somehow guarantee, that the ...
2
votes
0answers
204 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
2
votes
0answers
69 views

Client puzzle using hash

When a server is under attack, it send the client the following data: Nonce - a byte array of Y length Hash - the hash digest of the puzzle solution The client has to find X such as ...
2
votes
0answers
136 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...

15 30 50 per page