2
votes
2answers
186 views

Byte location of plaintext vs ciphertext when using a block cipher or stream cipher

I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in ...
2
votes
1answer
247 views

Regarding matsui's Paper on Linear Cryptanalysis of DES

I's going throught the the Paper by Matsui on Linear Cryptanalysis of DES . In that he says $NS_{5}(16,15)=12$ And then in the next paragraph he says considering the expansion and permutation phases ...
2
votes
3answers
3k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
1answer
156 views

Separate Read and Write Keys in TLS Key Material

Why does the TLS protocol use different symmetric keys for receiving and sending data? Isn't it enough to have a single key used for both reading and writing?
2
votes
1answer
205 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. ...
2
votes
1answer
625 views

Recovering the key in an ElGamal Signature Scheme variant

From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3: Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that ...
2
votes
1answer
252 views

Public Key Encryption with forward secrecy

Is there a known non-trivial system with plausibly secure public key encryption where: 1. $\;\;$ the $\:$ time $\:$ function is efficiently computable 2. $\;\;$ [pubkey,privkey] $\:$ pairs are ...
2
votes
1answer
77 views

Distributed knowledge problem

I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
2
votes
1answer
374 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
2
votes
2answers
727 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
1answer
796 views

RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
2
votes
1answer
110 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
2
votes
1answer
220 views

Shannon entropy calculation: is $H(A|R·A) = H(A)$?

Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$. Now I take a non-random $m×m$ ...
2
votes
1answer
215 views

synchronization of counters in HOTP

How is synchronization of counter values achieved in the HOTP protocol? As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
2answers
522 views

DES Crack simulation

I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For ...
2
votes
2answers
243 views

AESManaged Trade Compliance Issue in United States

I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the ...
2
votes
1answer
1k views

Cryptanalysis Affine Cipher: Brute-Force Search Vs. Meet-in-the-middle

Affine Cipher: $Enc(x) = (ax + b) \mod m$ $Dec(x) = a^{-1}(x-b) \mod m$ For a brute-force key search, we need to do $a \cdot b$ encryptions in the worst case. For a meet-in-the-middle attack, how ...
2
votes
2answers
551 views

Is there an effective way for public key generation in homomorphic encryption schemes?

Is there any way to effectively generate valid distributed public key in schemes like ElGamal or Benaloh for a number of participants? There's no need in private keys since there's no intent to ...
2
votes
2answers
51 views

Zero knowledge-proof for discrete log that is not honest-verifier

Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses ...
2
votes
1answer
100 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
2
votes
1answer
69 views

Is there an existing authorative definition of the cryptographic term 'pepper'

I can attempt to define the term 'pepper' as: In cryptography, a pepper is a something that is added to another value (for example a password) prior to a the value being hashed using a ...
2
votes
1answer
85 views

Stacked LFSR - why not used?

New to cryptographic, weak in math. I have designed a PRG which consist of 33 LFSR's, each 32 bits wide. I use one of the LFSR's as "selector", using the 5 LSB from this register to select one of ...
2
votes
1answer
32 views

Discrete log accumulator without pairings

Here $g$ is some fixed generator of a discrete log group. I don't want the group to be bilinear for efficiency and BDH-skepticism reasons. Is anyone aware of a discrete log accumulator? What I mean ...
2
votes
1answer
58 views

Is this an example of a zero knowlege proof?

My Math Structures professor mentioned the strange concept of a zero knowledge proof to me after class one day, and I decided to do some reading about it. After reading the relatively famous "How to ...
2
votes
1answer
48 views

Can IGE mode be parallelized?

As far as I know, in IGE mode (infinite garble extension) each block depends on the previous one. In that case, can the encryption be parallelized? Is there some way to do it?
2
votes
1answer
113 views

What is the advantage of using the socialist millionaire protocol to authenticate vs HMACing some random number?

Say Alice and Bob have a shared secret $s$. Alice and Bob establish an encrypted channel and verify that it hasn't been MitM'ed by exchanging $r_1$ and $r_2$, where $r_1$ and $r_2$ are randomly ...
2
votes
1answer
58 views

Is format preserving encryption suitable for use with words or names?

Is it possible to use FPE to encrypt names and language words like 'Bob' 'the' 'tree', in order to preserve both length and format (like keeping characters within a certain range like A-Z a-z) The ...
2
votes
1answer
43 views

Differences between Work Factor and Time Complexity

I am interested to know if work factor means the same thing as time complexity. Quoting Work Factor : Uncovering keys in cryptosystems The Work Factor of a cryptosystem is related to its ...
2
votes
2answers
82 views

Does key derivation with known parameters add any security?

First up: this is a question about a concept that I try to wrap my head around; it is not about the specific implementation. Anyway… I have the following scenario (simplified to show the problem I ...
2
votes
1answer
155 views

SHA1 Partial Collision

I'm working on a little python script that reads in two fairly similar English sentences (they're in text files - reading them in) and I'm trying to force a SHA1 partial collision (e.g. first 32 bits ...
2
votes
1answer
86 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...
2
votes
2answers
97 views

Is this a valid “fix” for deterministic encryption in encrypted databases?

It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
2
votes
2answers
85 views

How does BLAKE2 ensure that hash(A) != hash(B) when B = A||0 and both A & B have the same number of blocks?

Suppose I have two arrays : A = a single byte, being zero. B = two bytes, both being zero. B = A||0 (i.e. B starts with A, and differs only by appending a zero byte) BLAKE2(A) != BLAKE2(B) Yet, ...
2
votes
1answer
105 views

BEAST attack confusion

I understand that BEAST is a CPA using javascript injected onto the browser's webpage. Apparently the thing that BEAST exploits is the fact that the IVs are predictable. What I'm confused about is why ...
2
votes
1answer
66 views

Encrypting decryption key

What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).
2
votes
1answer
95 views

Is AES-GCM length extension attack possible using authenticated decryption?

I am looking to encrypt a piece of data using AES-GCM with a full 16-byte GCM Tag and send it over the network using UDP. Is it safe to assume using the AEAD nature of AES-GCM that performing ...
2
votes
1answer
85 views

How to implement homomorphic multiplication for Elgamal?

I want to add the homomorphic property to Elgamal in libgcrypt. This is the core code I added to the library. ...
2
votes
1answer
224 views

2048-bit RSA Decryption

If a message is encoded with 2048 bit RSA. The ciphertext is $M^e mod N$. In some cases, the message is short, $ M \approx 10^{20} $. With a high probability, $M$ can be written as $M = ab$ with $a, b ...
2
votes
1answer
114 views

Gap problem for Learning With Errors

Informally, a "Gap problem" arises when solving the computational (or search) version using an oracle for the decisional version. This definition of Gap Problem was introduced by Okamoto and ...
2
votes
1answer
87 views

Encryption in which ciphertext is bigger than plaintext?

Is there an encryption which would produce a ciphertext longer than the plaintext? (please ignore block-chaining IV stuff, which would result in a data being generated from the plaintext). The point ...
2
votes
1answer
223 views

Square roots, prime factorization

I´m stuck in my homework and since its homework, I would rather get some hints than full solution. The problem goes: factorize n = 88416763 in case that you know that the square roots of 51733469 ...
2
votes
1answer
101 views

AES mix column stage

In a PDF related to AES algorithm for mix column stage is written: The multiplication mentioned above is performed over a Galois Field. The mathematics behind this is beyond the scope of this ...
2
votes
1answer
167 views

How can a good pseudo-random number generator be made?

I am trying to make a pseudo-random number generator so that I can use it in a synchronous stream cipher for encrypting plain text. I want it to generate numbers which are as random as possible. What ...
2
votes
1answer
181 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
2
votes
1answer
80 views

Recover plaintext in passive attack of RSA of coprime public key

I have a situation in RSA like this. Charles sends same message $m$ to Alice and Bob encrypted with $e_A$ and $e_B$ respectively. It happens that he they are under same modulus $n$ and $gcd(e_A, ...
2
votes
1answer
78 views

Use of ElGamal encryption for signature generation

If RSA (textbook RSA that is) generates a digital signature by using the sender's private key, couldn't any cryptosystem (the only two that come to mind are RSA and ElGamal) capable of asymmetric ...
2
votes
1answer
111 views

Why don't we use bcrypt and scrypt together?

Everyone is comparing bcrypt to scrypt. Bcrypt is proven, lots of cryptoanalysis and no vulnerabilities so far, but uses very low memory. While scrypt uses a lot of memory, but it's too early in its ...
2
votes
1answer
204 views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
2
votes
1answer
200 views

Small Encryption Exponent

I am trying to crack an unpadded RSA set up for a homework. I have public key (R,e) and encrypted message E. ...

15 30 50 per page