All Questions

217 views

How often does RSA-OAEP have a leading zero?

We are working with a third party vendor who is very tight lipped about their security protocols, and one of our customers who used this vendor's products is claiming that approximately one in every ...
135 views

Simulation aborted because the adversary doesn't use the random oracle

I'm trying to construct a proof for an encryption scheme in the Random Oracle model. This encryption scheme is like a PKE scheme but with an additional function that kind of "alters" ciphertexts ...
353 views

AES and Homomorphic Encryption

Is it possible to do the following? Input would be to generate a new AES key, encrypt the private data with that key, encrypt the AES key with the FHE key, and send the FHE-encrypted AES key along ...
126 views

Doubling a point on an elliptic curve

I'm working with the elliptic curve $\mathcal{E} : y^2 = x^3 + 11x^2 + 17x + 25$ over $(\mathbb{Z}_{31},+,\cdot)$ and am trying to double $P=[2,7]$. Following the instructions here, I'm doing the ...
187 views

How to calculate if probability is negligible or not

If i have probability $Q = 2C(A\times B)$ where $A$ and $B$ are unknown probabilities and $C$ is a non-negligible probability, what can i speculate about probability $Q$ and how can i calculate bounds ...
225 views

Are well designed crypographic codes unbreakable? (NOT ciphers)

Codes are not to be confused with ciphers. It is known that all known ciphers are theoretically breakable except the one-time pad and this isn't what the question is about. Some cryptographic codes ...
453 views

If a system hashes passwords with a 256-bit long hash, are passwords (which are not necessarily alphanumeric, can be any value per byte (0-255)) longer than 32 bytes useless under the context in which ...
226 views

Elliptic curve cryptography G*G

I understand how ECC works for the point multiplications and stuff. All we normally do is to multiply a scalar number (lets say d as a private key) with the base point generator ...
149 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
141 views

Coding of unsigned int to prevent guessing next ID

Suppose we are assigning records an unsigned integer ID from a N-bit space (say 32-bit) in a sequential manner. Is there a way we can code this ID before showing it to the public such that someone ...
102 views

Is this JS library using openssl genrsa -rand improperly?

pem, a JS wrapper around openssl, has the following code in it: var params = ['genrsa', '-rand', '/var/log/mail:/var/log/messages', keyBitsize ]; Am ...
371 views

Do all stream ciphers (and AES-128-CTR in particular) produce equal output size as the input size?

I'm particulary interested on knowing if the output of the AES-128-CTR ciphertext is always going to have the same size as the input plaintext, or it could be padded somehow. It seems so from my tests ...
226 views

Why can't you just clone encrypted data and use it?

Let's take a contactless card for example (one for public transport lets say (i.e. MiCard)), the data is encrypted on the card and encrypted on the reader as far as I know. So how come somebody who ...
89 views

Is changing $H(R\mathbin{\Vert}A\mathbin{\Vert}M)$ to $H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$ in EdDSA secure?

EdDSA calculates $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}M)$, with $H$ being the hash function (SHA2/512); $B$ being the generator; $A$ being the public ...
558 views

Encryption for a short packet size

I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...
398 views

How to roll my own hardware RNG?

I am considering building a hardware RNG myself using cheap parts. Is this a good idea and safe enough? Random sources: amplified Zener noise from one randomly chosen ...
492 views

Solving Quadratic equations in Galois Field (2^163)

Hello I am working on implementing a message to elliptic curve point mapping hardware circuit I have done some research and found out the koblitz mapping method: I will be using a field of binary ...
2k views

Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?
199 views

How to use ElGamal to encrypt zero?

ElGamal encryption algorithm is as follows: To encrypt a value $m$, it chooses a random value $r$, and calculates $c_1=g^r$ $mod$ $q$ $c_2=m*h^r$ $mod$ $q$ where $g$ is the group generator, $x$ is ...
352 views

Decrypt all RSA ciphertexts if you can break 1% of them

I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ...
118 views

Is xgcd faster than Fermat for calculating $d$ in RSA?

I want to calculate $d$ from $e$ when generating RSA keys. What is faster? Calculating $\operatorname{xgcd}(e,p)$ and $\operatorname{xgcd}(e,q)$ and CRT. Or calculating $e^{p-2}\bmod p$ and ...
198 views

Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
443 views

Collision in Merkle–Damgård without a collision in compression function

Is it possible to find a collision in Merkle–Damgård just by omitting the extra one bit that is appended to each input without having a collision in compression function?
117 views

How many of primitive point on the elliptic curve?

In elliptic curves for cryptography, I know $nG=O$, where $G$ is a base point represented by $G=(x_g,y_g)\ on\ E(F_P)$, where $n$ is Order of point $G$. For example, $P(0,6)$ is a primitive point on ...
641 views

AES with weak keys

Suppose that the key generation is insecure; each key bit is independently generated, but the value of each key bit is '$1$' with probability $0.90$. These keys are used in AES. What is an efficient ...
131 views

What does “learnable with oracle queries” mean?

I came across the following quotes in reading papers on obfuscation (1, ibid, and 2): The next result follows from the fact that point functions are not exactly learnable (since a uniformly chosen ...
326 views

Do I need an IV to use AES-CTR as a CSPRNG?

I'm using AES128-CTR for generating pseudo-random values, which is considered secure for up to 1MB (at least from what I've read). I simply encrypt a 128-bit little-endian counter, starting from 0. ...
480 views

Which block cipher mode(s) is most appropriate in these applications?

I have a few questions I'm stuck on for a cryptography course I'm doing, any help would be much appreciated. The first application is for decryption on a multicore processor. I assume any of ECB, ...
136 views

Is this a plausible PBKDF?

Background: Hello, I'm working on a hobby project in which I might want to implement a key derivation function within a somewhat resource limited embedded system. For standard crypto functions, I ...
2k views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
582 views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
124 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
171 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
243 views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
216 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
148 views

Can I decrypt the message having it encrypted with different keys?

I have some encrypted binary data I want to decrypt. I know nothing about it, but I can get it encrypted with as many different (random, unknown) symmetric keys as I want. The keys are long enough to ...
220 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
201 views

Performance for Subbytes in AES

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set. For the Subbyte function i use movzx, having loaded ...
2k views

Pseudocode for constant time modular exponentiation

I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with ...
450 views

Should HMAC or NMAC or plain Keccak be used for a secure MAC?

After some digging around in the HMAC spec I found this (paraphrased): Step 1: If the length of Key equals the block size of the hash function (512 bits/64 Bytes for SHA-256), set the key equal ...
201 views

Encrypting a short phrase into two keys. both with length of 32letters

It doesn't need to be crazy secure. I wanted to figure out if there's a popular practice when encrypting a short phrase (less than 32 letter long) into two keys (two strings 32 length). Doesn't need ...
230 views

Using Stream Cipher as CSPRNG

Are there any guidelines or justification for converting a stream cipher algorithm for use as a CSPRNG? For instance, lets say I wanted to convert one of the eStream portfolio Profile 1 (software) ...
221 views

derangements and permutations in cryptography

Given a partial key for a mono-alphabetic substitution cipher (missing 11 letters), calculate the number $N$ of possible keys, given that no plaintext letter can be mapped to itself. ...
3k views

How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
341 views

RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For ...
599 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
2k views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
121 views

Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt… Suppose I have 2 different keys: secretkey1 secretkey2 And a plain text: myReallySecretPlainText If I use AES128 ...
I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...