1
vote
2answers
147 views

Contruct a protocol to determine if three secret keys are different, without revealing any of them?

I am trying to find a protocol for this problem: Three persons, $A$, $B$, and $C$, know secret numbers $s_{A}, s_{B}$, and $s_{C}$, respectively. They want to know whether their numbers are all ...
2
votes
1answer
380 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
2
votes
1answer
149 views

Is this attack for RSA possible?

$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively. I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
2
votes
2answers
728 views

phi(P*Q) = (P-1) * (Q-1)

I was trying to understand RSA when I encountered the Euler Function. I do understand this: $\phi(P)$, where $P$ is a prime is $P-1$. However it seems that for a number $N$ such at $N=P\cdot Q$ where ...
1
vote
1answer
67 views

Is there a big RSA Data Set

Is there a big dataset containing RSA public $(n,e)$ and private keys $d$ and primes $p,q$ where $n = p.q$ ?
5
votes
5answers
2k views

Galois fields in cryptography

I don't really understand Galois fields, but I've noticed they're used a lot in crypto. I tried to read into them, but quickly got lost in the mess of heiroglyphs and alien terms. I understand they're ...
7
votes
1answer
699 views

Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme

Shamir's original paper (PDF, 197kb) describing a threshold secret sharing scheme states: To make this claim more precise, we use modular arithmetic instead of real arithmetic. The set of ...
1
vote
1answer
253 views

How do unkeyed hash functions (for MDCs) provide security?

Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
3
votes
1answer
659 views

A single password manager vs password generator/hash

I have been wondering about the options available for managing passwords. However, they all seem to fail if the master password is compromised (which isn't a big surprise). On one hand you have ...
1
vote
2answers
107 views

Polynomials and efficient computability

In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT. It's clear that adversaries should be at ...
1
vote
1answer
122 views

inverse element in Paillier cryptosystem

As I know, in Paillier cryptosystem, the encryption $c$ of a message $m$ is calculated as $c=g^m r^n \bmod n^2$. Now, I am wondering if I can derive $g^m \bmod n^2$ given that I know $c$, $r$, and ...
6
votes
1answer
412 views

What are the benefits of lattice based cryptography?

Previously we visited the benefits of elliptic curves for cryptography. Lattice based cryptography is starting to become quite popular in academia. The primary benefit of lattice based crypto is the ...
2
votes
1answer
154 views

S-box with differential uniformity = 2

I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right? Is ...
4
votes
2answers
798 views

RSA blind signatures in practice

Hi I have a problem with moving my blind signature implementation from educational (textbook RSA) to more practical (padded RSA) side. David Chaums paper gives a following figure: $r$ - blinding ...
2
votes
0answers
149 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
2
votes
1answer
165 views

What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
3
votes
1answer
172 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
1
vote
2answers
122 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
5
votes
3answers
244 views

Can I use PGP to sign a message without providing cryptographic non-repudation?

The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC ...
1
vote
1answer
136 views

Need for Twin Elgamal encryption

What is the need for two private/public keys in twin elgamal? I'm relatively new and would need some help.
1
vote
3answers
195 views

Deterministic key generation

In a situation where it is required to generate n number of keys deterministically from a single piece of seed information can we assume that b breached number of keys, no matter what the quantity ...
2
votes
1answer
289 views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
4
votes
1answer
277 views

Are there any Implementations of Secure Indexes? [closed]

There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions" and "Secure Indexes". ...
2
votes
1answer
220 views

Why are protocols often proven secure under the random oracle model instead of a hash assumption?

Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle? I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
3
votes
2answers
270 views

Public key cryptography - public key encrypts and cannot decrypt?

I understand the basics behind public key cryptography, in that each party has two keys - the public one encrypts, and the private one decrypts. What I cannot figure out is, How does the public key ...
3
votes
2answers
742 views

How can I break a Vigenère cipher with partial plain text?

I have an exercise to do regarding Vigenère encryption. I've got the cipher text: WNZTNVIEEGTJYKRRWYUELWNZTNV and a partial plain text: ...
1
vote
2answers
279 views

Are really, really long passwords any securer than short ones?

Just for fun, I want to encrypt a message that will take about 10 or so years to decrypt. My idea is to encrypt a message with AES-512 with a password one million decimal digits long. Knowing not ...
2
votes
1answer
158 views

RSA Key generation Public exponent too big

I'm currently writing a paper about RSA (a self-chosen subject). I'm writing about the key-generation in RSA, and I have problem finding the public exponent e. I have chosen p = 61 and q = 53. Then ...
4
votes
4answers
340 views

Is there a secret sharing scheme which allows delegation/re-sharing without reconstructing the original secret?

EDIT: Ilmari Karonen's answer below well not exactly what I want, gives a very good idea of what I am trying to accomplish. Are there any known secret sharing schemes that allow new parties to be ...
1
vote
0answers
105 views

Factorize RSA knowing several N and E

I did a CRT challenge yesterday and there`s one problem I was unable to solve, probably due to my lack of understanding advanced crypto math. It`s about RSA. There are ten given pairs of N and E ...
1
vote
1answer
350 views

Diffie-Hellman is Post-quantum secured?

If Alice and bob have a secure channel for key-exchange and mallory don't man-in-the-middle attack them but in the future eavesdrop connection and see the key exchanged, can mallory break it like RSA ...
2
votes
2answers
261 views

The security proof for Key Policy Attribute Based Encryption

My question relates to the original KP-ABE paper: http://research.microsoft.com/en-us/um/people/vipul/abe.pdf I'm having trouble understanding the proof (pages 10–13) that the scheme is secure in ...
3
votes
1answer
207 views

RSA Without Padding?

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message. Given that an ...
4
votes
4answers
301 views

How to prove membership of a list without disclosing the list members?

I'm designing a messaging system where the sender A sends a message m with a signature s to n Receivers. A Receiver Ri should then be able to prove to a Verifier V that he is one of the receivers of ...
2
votes
2answers
374 views

AES key expansion vs. a hash

Is there something special about the AES key expansion algorithm that makes it secure, or it is a compromise between security and speed? For example, say with a key I expand it by taking pbkdf2(key) ...
1
vote
1answer
170 views

Does RSA-OEAP have integrity and authenticity properties?

RSA-OAEP is IND-CCA2 secure (indistinguishable under an adaptive chosen ciphertext attack). Does it also have the INT-CTXT (integrity of ciphertext) and INT-PTXT (integrity of plaintext) properties? ...
2
votes
2answers
211 views

Speeding up partially known plaintext preimage recovery attack on MD5

Suppose there are three messages A, B and C of different length, that are 16 DWORDs in ...
1
vote
2answers
522 views

decrypt AES without whole key

Is there a way to decrypt a AES cipher Text which was encrypted twice with some key, when having a part of this key? (the last 3 bytes of the key are missing)
7
votes
1answer
2k views

Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC ...
2
votes
2answers
355 views

How can I add more rounds to AES?

I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional ...
5
votes
1answer
713 views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
1
vote
2answers
226 views

Non-Interactive Zero-Knowledge-Proof for discret Logarithm?

In a Non-Interactive $Zero-Knowledge-Proof$, the challenge is chosen by the Prover. I am trying to find a Non-Interactive Zero-Knowledge-Proof based on the following problem: DISCRETE LOGARITHM ...
1
vote
1answer
300 views

AES Secure key generation and storage

I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: ...
1
vote
1answer
144 views

Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
5
votes
4answers
283 views

How is it possible to parallelize a hashing function to crack an iteratively hashed password?

Suppose I have an algorithm that relies on multiple iterations of a hash function like SHA1 to slow down an attacker trying to bruteforce a hash. ...
1
vote
2answers
463 views

AES key padding

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
4
votes
1answer
411 views

In RSA encryption, does the value of e need to be random?

I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. ...
4
votes
2answers
241 views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
0
votes
0answers
135 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...

15 30 50 per page