2
votes
1answer
129 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
153 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
163 views

Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
2
votes
1answer
302 views

What's a good P to use in ElGamal key generation?

I need to generate a 1024 bit ElGamal key on Android, and key generation takes forever (~10 minutes on a Galaxy Nexus), I suspect because it take so long to generate a safe prime. Is it dangerous for ...
2
votes
1answer
111 views

Is it safe to hold key file's hash in application

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)? Thanks
2
votes
1answer
234 views

Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
2
votes
1answer
764 views

Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
2
votes
1answer
345 views

Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
2
votes
1answer
320 views

Is there difference between Algebraic Homomorphic Encryption and Fully Homomorphic Encryption Schemes?

Is there difference between Algebraic Homomorphic Encryption and Fully Homomorphic Encryption Schemes?
2
votes
1answer
129 views

In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
2
votes
1answer
235 views

Finding a solution to a (sort of) discrete logarithm by asking questions

Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded by $log$ $n$. Let $g$ be a generator of the unique ...
2
votes
1answer
325 views

DGK Cryptosystem Encryption Speedup

Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
2
votes
2answers
291 views

Order of hashing concatenation

A = hash("blue" + X); B = hash("pink" + X); If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()? ...
2
votes
2answers
5k views

OTP from Sony BIOS password recover

From Dogbert's blog: Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the ...
2
votes
1answer
95 views

Educational videos for security topics [closed]

Is there anything like the famous "sorting out sorting" video in cryptography/security. I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2
votes
1answer
70 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
2
votes
1answer
167 views

RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
2
votes
1answer
515 views

HASH Algorithm for 8 bits MCU

I need to implement the HASH algorithm (MD5 & SHA-1) on an 8 bit MCU. I hear it can only be implemented on 32bit and sometimes 16bits MCU. Is that possible? I will appreciate link where possible. ...
2
votes
1answer
277 views

How does the energy consumption of the SHA-3 finalists compare?

I am curious, is there any paper where SHA-3 competitors are compared in terms of energy efficiency?
2
votes
1answer
222 views

Is the SILC protocol still used?

I'm looking into implementing a private SILC server for friends (and possibly their friends). And after visiting the Wikipedia entry for SILC protocol, it seems all the official pages linked at the ...
2
votes
1answer
354 views

Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
2
votes
1answer
490 views

Hash or encryption function for challenge-response protocol?

Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ...
2
votes
1answer
622 views

Verilog simulation of Data Encryption Standard

I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance .
2
votes
1answer
223 views

Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
2
votes
1answer
23 views

Is multiple encryption using NaCL and TLS better?

In general, the idea of multiple encryption sounds interesting - for creating stronger cyphers (especially against implementation bugs), one could always get the configuration details wrong and mess ...
2
votes
0answers
44 views

Managing data permissions/access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how is it possible to share access of encrypted data with N entities, and be able to ...
2
votes
0answers
41 views

Regular MACs vs Carter-Wegman MAC

Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc). ...
2
votes
1answer
68 views

Encryption method with master key and user keys

I am working on a concept for a game that in the end will allow data sharing via plain text, but I would like to give the user the option of encrypting the data so that other players cannot modify it, ...
2
votes
2answers
101 views

Computational Complexity - When is it really exponential time?

I'm currently working on the discrete logarithm problem and the relevant attacks. I'm fine on the mathematical side of things, but when it comes to estimation of running times I run into problems. ...
2
votes
0answers
82 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
2
votes
0answers
76 views

Understanding Lattice based cryptosystem [closed]

I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers ...
2
votes
0answers
51 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
2
votes
2answers
42 views

AES multiple devices to server communication

I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on ...
2
votes
0answers
64 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
2
votes
0answers
84 views

Protocol: Coin Flipping over phone

Protocol: Coin Flipping over telephone Hypothesis: Alice and Bob have agreed: a one to one function $f$ which is easy to compute $f(x)$ from $x$ and while given any value $f(x)$ it is nearly ...
2
votes
0answers
39 views

Malicious KGC attack in the identity-based authenticated key exchange protocol

There are two users $A$ and $B$ who are in different domain. Let's assume that $A\in KGC_1$ and $B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ...
2
votes
0answers
39 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
2
votes
0answers
84 views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
2
votes
0answers
65 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
2
votes
1answer
61 views

User-specified PBKDF2 password, salt, and iterations limits

For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced? In other words, because none are ever stored by the ...
2
votes
0answers
151 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
2
votes
0answers
100 views

Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
2
votes
0answers
79 views

How can I make a message into a blocks for NTRU?

I have more bits than the degree of the NTRU polynomial. For example: $x^{11}-1$ message: Hello (I am using ascii, 8 bits for 1 symbol) got: ...
2
votes
0answers
32 views

Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
2
votes
0answers
84 views

Can I decrypt the message having it encrypted with different keys?

I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to ...
2
votes
0answers
42 views

space complexity of quantum collision search

Is there a known way to reduce the space complexity of quantum collision search beyond what is offered by the built-in time-space tradeoff, while keeping the time complexity significantly below what ...
2
votes
0answers
125 views

HMAC-SHA1 vs HMAC-SHA256 for data storage

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
2
votes
0answers
179 views

implementing a cryptographic hash with a block cipher [duplicate]

How can a cryptographic hash function be implemented/created using the block cipher? I was wondering if we can use AES in cipher block chaining mode to implement it.
2
votes
0answers
77 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
2
votes
0answers
141 views

An example of Knapsack Cryptosystem cracks/attacks?

I have been studying papers on various ways to crack the knapsack cryptosystem, unfortunately the mathematics in these papers involves lattices and LLL which is over my head. The paper "New Attacks ...

15 30 50 per page