2
votes
1answer
181 views

Crypto puzzle as proof of randomness?

I need an untrusted client to generate a random public/private keypair (in particular, an Ed25519 keypair, which can be generated really fast), but I'm only allowed to see the public key. The ...
2
votes
2answers
82 views

Zero-knowledge identification of the majority commitment

Alice is communicating with $n$ people. We do not assume that the $n$ people don't trust each other or trust Alice. Alice doesn't trust them either, and needs to assume that they will not form a ...
1
vote
1answer
603 views

AES CBC with fixed or predictable IV, what are the risks?

I am making a call with parameters from application "A" to a web application "B". Parameters are in the query string of the URL. They don't need to be hidden. But I want to be sure that nobody can ...
1
vote
0answers
121 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
1
vote
1answer
249 views

What are some different cryptography methods?

Some of the most effective cryptography methods and algorithms are based of factoring large prime numbers (e.g. RSA). I'm curious whether there are some other cryptography methods. Somethings that is ...
1
vote
1answer
112 views

Trapdoor implementation

Please refer to this secure index paper. On page#6, a trapdoor is defined as ...
1
vote
2answers
272 views

Store hashed email and compare hash values

I have a number of different systems sending me email addresses, but I don't actually need the underlying email, just a hash of the email address. I know I can compare hash values to find matches ...
1
vote
2answers
976 views

ECDH VS. DH benchmarking in JAVA

So basically my problem is the odd result i get when measuring the time it takes to generate a ECDH key in java vs. the time it takes to generate a DH key. I compare the time it takes to generate: ...
4
votes
2answers
241 views

Commutativity of keyed hashes

Definition ${H_1}^{K_1}(X)$ means data $X$ hashed by keyed hashing algorithm $H_1$ with key $K_1$. Short question Is $H_1^{K_1}(H_2^{K_2}(X))$ equal to $H_2^{K_2}(H_1^{K_1}(X))$? Is ...
4
votes
1answer
193 views

How do you construct a practical full-domain hash function?

I am looking for practical constructions for Full Domain Hash. I have read Random Oracles are Practical by M. Bellare and P. Rogaway, the construction suggested on page 8, under "Uniformity: a ...
5
votes
2answers
231 views

Why would this method of discrete logarithm finding not work?

Say we do know $b$ but not $k$, and are given $g$ such that $g\equiv b^k\pmod p$. And say there exist factors $E = e + m'p$ ($e \equiv b^i \bmod p$) and $F = f + m''p$ ($f \equiv b^j \bmod p$) of $g$. ...
3
votes
1answer
379 views

Visualization of cryptography

I think CrypTool is great software. And what I find most useful in it is visualization of algorithms such as Caesar, Vigenere, AES, DES. And my question is: does anyone know other tools which are ...
-1
votes
2answers
177 views

Is (2^333)-1 a prime number? [closed]

How can I see if $2^{333}-1 $ is a prime number? Does this have to do with Mersenne prime numbers ($2^n-1$) ?? Thank you!
6
votes
1answer
1k views

What is a tweakable block cipher?

Pretty simple question - but I can't seem to find much information about it. What exactly is a tweakable block cipher? How do they differ from traditional block ciphers? What is the 'tweak'? Is it ...
2
votes
0answers
75 views

Prevent/minimize replay attacks in public message board

Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
6
votes
3answers
405 views

How to best obtain bit sequences from throwing normal dice?

Throwing normal dice, one can get sequences of digits in [0,5]. Which is the best procedure in practice to transform such sequences into bit sequences desired?
1
vote
2answers
414 views

Kryptos : K2. What is the origin of the “abscissa” keyword?

I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. Similar to the "palimsest" keyword for K1, the keyword "abscissa" for K2 was determined by brute-force. To better ...
4
votes
1answer
242 views

Why is feed-forward mechanism used in hash functions?

The compression function of SHA-1 when used in Davies-Meyer mode adds its input to the chaining values at the final step. For the first message block, the IV is used as the input and in the next step, ...
2
votes
1answer
291 views

Decryption a chunk of file with AES

We are having a requirement to store large files (~1GB) encrypted and decrypt them when reading. We are looking to use AES-CTR or AES-GCM mode to encrypt the data. There are scenarios where we want to ...
1
vote
1answer
104 views

Question about use of IV in this cipher

Main cipher objective : Generate a keyed CSPRN stream, that does not expose useful information about the state of the CSPRNG, and xor this with the plaintext. To prevent an attacked who could somehow ...
1
vote
1answer
2k views

How do I derive the time complexity of encryption and decryption based on modular arithmetic?

I want to calculate the time complexity of two encryption and decryption algorithms. The first one (RSA-like) has the encryption $$ C := M^e \bmod N $$ and decryption $$ M_P := C^d \bmod N. $$ ...
2
votes
1answer
336 views

Using Chi-Square for Vigenère Cipher

I am writing a program which will use Chi-Square to determine which is the correct keyword for a ciphertext via Vigenère cipher. I came across a website that describes the Chi-Square statistics in a ...
4
votes
2answers
248 views

How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the ...
6
votes
1answer
192 views

Questions on rank-attacks in Multivariate Cryptography

While reading this article on rank attacks on STS (a public-key scheme based on Multivariate Quadratic (MQ) equations), I stumbled upon some claims that I've also seen in other presentations on ...
1
vote
0answers
42 views

School exercise on untrusted channel comunication [duplicate]

Possible Duplicate: Why is H(k||x) not a secure MAC construction? I've the following problem: two parties, A and B, share a secret key Kab. M is a plaintext message, H an unkeyed hash ...
1
vote
0answers
258 views

RSA and One Time Password (OTP) service

What is the expert cryptographic opinion on the following? Assume that there is a web server and a client on web page. User on the Client calls an OTP web service on the server which: creates a RSA ...
1
vote
1answer
142 views

Do practical key-less cryptosystems exist?

Hopefully the question isn't too broad or off. Basically, are there any practical, and by practical I mean secure enough that a ciphertext only attack is infeasible, key-less cryptosystems? For ...
2
votes
2answers
366 views

What are the differences between proofs based on simulation and proofs based on games?

what are the main pros and cons of proving the "security" of a crypto scheme under simulation proofs instead of game based proofs?
2
votes
0answers
180 views

Creating colliding x509 certificates: Crafting RSA moduli step

I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7). Now I have ...
3
votes
1answer
610 views

What is a smart card?

In many cryptographic protocols, some information is transmitted within smart cards. So, what is a smart card? Is it a physical card? What are they used for in cryptographic protocols?
0
votes
2answers
307 views

Cryptographic Symmetric Stream Cipher

Let me know a cryptographic symmetric stream cipher system with only two functions say S() and P() and it should satisfy the ...
2
votes
1answer
103 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
3
votes
2answers
415 views

Theoretical pi-based stream cipher

Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream ...
2
votes
1answer
129 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
1
vote
1answer
133 views

How can encryption software accept password lengths which are not one of the AES key lengths?

AES comes with key sizes of 128, 192, and 256 bit. But in Truecrypt or other crypto software we can use passwords of different length, even less than 128 bit or more than 256 bit. How is this ...
4
votes
1answer
463 views

Hashing passwords with a salt - why use different salt for everyone?

Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
4
votes
1answer
151 views

How much do we trust KEA1 Assumption?

Let $$(g,h=g^s,q)$$ be a tuple such that $g$ is a generator for a group $\mathbb{G}$ of ord $q$ and $s$ is uniformly random in $\mathbb{Z}_q$. The KEA1 Assumption saies that for any adversary ...
2
votes
1answer
151 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
2answers
125 views

GGM PRG construction: Why do we need to change keys all the time with underlying PRG

When constructing a PRF that has n bit input using the GGM PRG, why do we always have to recursively run the PRG using its previous output as a seed key n times. Instead, why don't we run the PRG n ...
3
votes
1answer
196 views

How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
1
vote
1answer
79 views

What is the most secure way to let Alice “input” her private key, transfer it to the server and decrypt the message?

What is the most secure way to let Alice "input" her private key, transfer it to the server and decrypt the message? (Then destroy the private key on the server) Every connection is using SSL. ...
0
votes
1answer
204 views

What is the most paranoid way to exchange messages? [closed]

I'm looking for a way for Alice to send a message or a file to Bob in the most paranoid way possible (over the internet). It can be asymmetric or symmetric. But According to some articles, AES ...
-1
votes
1answer
122 views

Cryptographic Primitive Method

Is there any cryptographic primitive bijective (one-to-one and onto) function for creating cryptographic tools like symmetric encryption/decryption, Hash code generator, MAC, HMAC and Random number ...
2
votes
3answers
157 views

Secure communication between multiple peers on a public channel

I am wondering how can I secure communications between multiple peers over a public channel, like an IRC channel. With two peers it is easy - they exchange their encryption keys and decrypt the ...
4
votes
3answers
222 views

What is a block cipher?

I have read about block ciphers, but I do not understand the topic completely. Is a block cipher a way to send data or a way to encrypt data? How is the data divided into multiply blocks before it ...
2
votes
2answers
256 views

Is there a length-preserving encryption scheme?

Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?
3
votes
1answer
147 views

Why does Rijndael with a 256-bit block require the bottom two rows to be shifted one more space than usual?

From Wikipedia: For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively. Why the change? Is there any ...
3
votes
1answer
111 views

Hashing a password with the password?

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
6
votes
3answers
516 views

Initialize a PRNG with a password

Let's assume that we have a secure PRNG. Is it "safe" to initialize it with password, or seed based on a password like SHA256(password)? If yes, is it "safe" to generate an RSA or DSA key from it? ...
4
votes
2answers
324 views

In the Paillier cryptosystem, is there a method to judge whether an encrypted number is less than 0 (without the private key)

Or, is there a cryptosystem that is both order-perserving and additive homomorphic?

15 30 50 per page