2
votes
1answer
288 views

How Multiplication Table is generated for GF(2^2) field

I was unable to solve the multiplication table given in the book for $\mathrm{GF}(2^2)$.However, I have managed to solve the addition table. Acoording to the Book multiplication is the AND operation, ...
2
votes
1answer
87 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
2
votes
2answers
147 views

Can the passphrase of a PGP key be deduced from an old backup?

Let's assume that Bob, at some point in time, has created a PGP (key length and other parameters are not relevant at this point). For some reason, he has chosen a very poor passphrase, for instance ...
2
votes
1answer
108 views

With Encrypt-then-MAC, and flexible protocols, do I need to authenticate the authentication?

Sorry, the question is not easy to state (or wasn't for me, anyhow). So I'm writing a very flexible format for security. It allows for full choice of cipher, key size, and so on, along with key ...
2
votes
1answer
132 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
2
votes
2answers
302 views

Graphically representing points on Elliptic Curve over finite field

I have taken elliptic curve $E\colon y^2=x^3-4x+20$, defined over $\mathbb{F}_{29}$. The number of points on the curve, $\left|E(\mathbb{F}_{29})\right|=37$. I took base point $P=(1,5)$, and got ...
2
votes
1answer
58 views

How to pronounce RIPEMD 160?

Do I pronounce it as a word or do I make it sound like "R-I-P-E-M-D" like by pronouncing each individual letter.
2
votes
1answer
442 views

A key-derivation function that is as strong as the stronger of PBKDF2 and scrypt

I want a key stretching system that's as strong as the stronger of scrypt and PBKDF2. The consensus now is that scrypt is by far the better system, but that might change if in the future, a weakness ...
2
votes
1answer
1k views

Is it true for Java that the transformation mode and padding is ignored when using RSA?

Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ...
2
votes
1answer
57 views

Weaker Notion of Target Collision Resistance

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: While it might be easy to find a collision $M,M'$ in $F_K$ by making both $M,M'$ depend on $K$ ...
2
votes
1answer
71 views

Dependence on Keyed Hash Function

I'm reading the paper “Collision-Resistant Hashing? Towards Making UOWHFs Practical” which states: With an ACR hash function $F$ the key $K$ is announced and the adversary wins if she manages to ...
2
votes
1answer
343 views

Forge CBC-MAC given the MAC of two messages and of their concatenation

I found this question about CBC-MAC forging and want to make sure I understand it: Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, ...
2
votes
1answer
87 views

secret sharing of product of 2 numbers

Does evaluating the products of shares $a_jb_j$ give a secret sharing of $ab$? I think it's a no, but I am not sure on how to prove it.
2
votes
1answer
151 views

Good Encryption Exponent

I have placed a bet that I can create a public key such that my adversary will not be able to crack (decrypt) it for at least one week. For my primes $p$ and $q$, I chose very large numbers that are ...
2
votes
1answer
157 views

How to design a cryptographically secure file hosting service

How one would go about design something like Google Drive/Dropbox providing the following features: files are encrypted and decrypted on the client files can be synced between devices the service ...
2
votes
1answer
121 views

Verifying encrypted addition

Alice has two secret numbers, a and b. She publishes c1=E(a), c2=E(b) and c3=E(a+b). Is there an encryption system E such that anyone would be able to prove that the c3 as published by Alice is ...
2
votes
1answer
206 views

How vulnerable is RSA when using it to encode ~1000s of datasets with 500bytes each? How easy can the private key passphrase be hacked?

I know that this is not the best use case for RSA, but for a customer of mine I have to encode user data on the server in a way so that it can be decoded/downloaded by the customer through a "secure" ...
2
votes
1answer
214 views

ID-based key exchange protocol with PFS

The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the ...
2
votes
1answer
98 views

Verifying a Signature

Alice publishes $(n,e)$ where $n$ is exponential modulus and $e$ is the public key. We have $n=80$ digit number and $e=3$. Bob, in correspondence with Alice, asked Alice to prove she is really Alice, ...
2
votes
1answer
364 views

Prime number theorem - RSA

I am having trouble understanding the prime number theorem. As part of some revision for an exam, I am trying to answer the following questions (but seeing as I don't understand the concept of the ...
2
votes
1answer
331 views

Since it gives negative power, how is rcon(0) calculated in AES?

I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation ...
2
votes
1answer
113 views

Is this EAX extension weakening the (provable) security of EAX?

I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
2
votes
2answers
164 views

Where does the meaning of reduction to a hard problem lie?

Given you a protocol, if we can reduce breaking the protocol to a hard problem, such as DLP or CDH, then we can say that this protocol is secure. Theoretically speaking, reduction is a good method ...
2
votes
3answers
262 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
2
votes
1answer
191 views

What are the possible cryptographic implications of Zhang's proof of the Twin Prime Conjecture?

Earlier this year, Yitang Zhang published a proof of a weakened form of the Twin Prime Conjecture. I'm wondering if any of the new mathematical machinery he developed has uses in cryptography or could ...
2
votes
1answer
214 views

Bandwidth and block size for Paillier cryptosystem

Can someone clarify what is meant by the terms cryptosystem bandwidth and block size for public key cryptosystems; The context is the Paillier cryptosystem and its Damgard-Jurik generalisation. My ...
2
votes
1answer
248 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
2
votes
1answer
288 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
2
votes
1answer
124 views

Is it possible to find a preimage for a reduced size hash?

Given a message $M$ and a 256 bit key $K$, perform HMAC($K$, $M$) with a 256 bit hash function resulting in: $a$ = ...
2
votes
1answer
211 views

Shamir's secret sharing with passwords

I'm trying to design an extension to Shamir's Secret Sharing that would allow the participant to specify a password instead of remembering/storing a large integer or binary data. So far, I have two ...
2
votes
1answer
1k views

Inverting the encryption equation of a symmetric cipher

I've just started a cryptography course. I am beginning to understand the concepts (I'm only in week 2) but I just can't get my head around the theories and principles when written as equations. I've ...
2
votes
2answers
347 views

Storing Credentials for a Third Party

(Originally posted to SOF, but I got no answers) I am designing a small application for use inside my company. My application needs to connect to a third party website on behalf of my application ...
2
votes
1answer
392 views

Do companies like CipherCloud really have the option to use homomorphic encryption?

I was reading How is CipherCloud doing homomorphic encryption? and was wondering: Is there a technically feasible way for companies like CipherCloud to use homomorphic encryption (HE) while ...
2
votes
1answer
5k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
2
votes
1answer
126 views

Can an encrypted nonce be used for authentication?

Would a scheme like the following work to allow authentication of a sender: A nonce is appended to data, and the result is encrypted. The encrypted pack is sent to the other party. The sender then ...
2
votes
1answer
151 views

a possibly stronger type of attack on identity-based encryption

What is known about the security of identity-based encryption schemes against attacks that involve seeing multiple ciphertexts and then receiving the private keys corresponding to some of those ...
2
votes
1answer
522 views

Digital Signature size requirement

What is an approximate length for a digital signature (SHA) given the following? Using RFID tags, size ranging from 100 to 2000 bytes (8000 bits), our project is setting aside a portion for a digital ...
2
votes
1answer
270 views

Primality testing (deterministic vs. non-deterministic)

I noticed that non-deterministic primality testing algorithms are more commonly used in practice while there is a deterministic algorithm e.g., AKS which runs in polynomial time? I am right? if so, ...
2
votes
1answer
149 views

The probability of finding a limited set of collisions for HMACSHA256

I need some input on the use of HMAC-SHA256 in an open source project, any help appreciated. The problem I'm solving is session fixation. We have a username, for that username we'd like to generate a ...
2
votes
2answers
257 views

plaintext and its encrypted version known [duplicate]

I have a (long) text in two versions, encrypted and plaintext. I think it was encrypted using a substitution cipher method (I'm pretty sure, indeed). I'm not good in this matter, I know little about ...
2
votes
2answers
369 views

Is OpenPGP vulnerable to the “crypto doom principle”?

From reading RFC 2015 (MIME security with PGP), and from looking at the raw format of (GnuPG) encrypted and digitally signed email messages, it seems that first a signature is calculated from the ...
2
votes
1answer
387 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
2
votes
1answer
401 views

Block cipher with key longer than block size

When a block cipher key length is greater than the block length, is it the case that for some keys $k_0, k_1$ (with $k_0 \not= k_1$) and plaintext message $m$ that $E_{k_0}(m) = E_{k_1}(m)$?
2
votes
1answer
114 views

Is Triple-DES a group?

I know for a fact that DES is not a group, but are any of the Triple-Des versions a group? Why, or why not?
2
votes
1answer
226 views

How does Poly1305 in the NaCl library calculate a MAC?

I've been reading about Poly1305 as implemented in the NaCl library, more specifically I've been referring to this Java implementation of NaCl. My understanding of XSalsa20Poly1305 (in this ...
2
votes
1answer
458 views

length extension attack on an MD5 hash of a text file of about 10K Bytes?

How much computing time on a typical desktop computer would it take to find a new length and new data to extend a text file of about 10K Bytes with a given MD5 hash?
2
votes
1answer
106 views

Encrypt user email but be able to find user by email

Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently. I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be ...
2
votes
1answer
219 views

Does SRP reduce to DH key echange when shared password is not secret?

I can find JavaScript implementations of SRP (Secure Remote Password protocol), but nothing that inspires confidence for Diffie-Hellmen key exchange. I also have a separate need for SRP later. I ...
2
votes
1answer
237 views

Attacking AES/CCM with random IV

A cryptosystem is using AES-128 in CCM mode with random IV. Suppose an attacker capable of: asking the cryptosystem to encrypt a single plaintext as many times as he wants; and asking the ...
2
votes
1answer
168 views

How can a key pair be derived from an arbitrary hash?

If I correctly understand the concept of a "brain wallet" in BitCoin, you start with a passphrase, generate the hash of the passphrase, then somehow derive a public / private key from that to use as ...

15 30 50 per page