3
votes
1answer
43 views

How to correctly encrypt data with proper authentication using AES-256-CBC in php?

I have been using the openssl function for encrypting data with AES-256-CBC in php. I have been able to encrypt it using an unique IV (by generating with openssl_random_pseudo_bytes)for each new ...
3
votes
0answers
61 views

Why reveal MAC-keys after using them?

As far as my understanding goes MACs are used to determine whether the received message comes from a source that has access to a MAC-key which is known by both parties. Some crypto protocols reveal ...
3
votes
1answer
89 views

Why gcd(r,(p-1)/r) needs to be 1 in benaloh cryptosystem

I recently discovered the benaloh cryptosystem. I am working with the system as it is discribed in the following link: https://en.wikipedia.org/wiki/Benaloh_cryptosystem However I need some help in ...
3
votes
0answers
51 views

TPM's monotonic counters

I am reading the TPM Design Principles v1.2 §17 and do not feel I fully understand the example they give on how the counters would work. Apparently monotonic counters are used to prevent replay ...
3
votes
0answers
22 views

Is EFS vulnerable to Chosen plaintext attack?

I have some backed up files encrypted with EFS and I lost the EFS certificate thus unable to decrypt the files. I understand that EFS uses the user certificate public key to encrypt the symmetric key ...
3
votes
0answers
36 views

High-level overview of system architecture of LUKS/cryptsetup (how it works vs. how to setup) [closed]

I've been searching (unsuccessfully) online for a high-level overview of how LUKS/cryptsetup disk encryption works. I am reading through the cryptsetup source code to try to understand what is going ...
3
votes
0answers
48 views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
3
votes
0answers
38 views

Why SIVP Is Worst Case Problem?

I just started to study lattice cryptography. I'm now studying worst-case to average-case reduction for SIS. In previous question, "worst means any and average means random". And I wonder why ...
3
votes
0answers
29 views

Seeking an implementation of the Satoh algorithm for elliptical curve point counting

I would be very grateful if someone has an implementation of the Satoh algorithm (Fast Elliptic Curve Point Counting). Can someone point me to practical algorithm implementations or provide some ...
3
votes
0answers
39 views

Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
3
votes
1answer
32 views

Does Coppersmith's method always finds non-trivial factor of integers of the form $n=a(2^k b+1)$ assuming $1 < a<2^k b +1$ and $b < n^{1/4-0.05}$?

Crossposted from mathoverflow. Got an argument and numeric evidence that pari's implementation of Coppersmith's method finds non trivial factor of integers of certain form under some assumptions very ...
3
votes
1answer
100 views

Public key exponent coprime with totient proof

I read this question a while back (In RSA, why is it important choosing e so that it is coprime to φ(n)?). I was wondering whether there is a proof that shows that a public key exponent e that is ...
3
votes
0answers
38 views

How does darkmail (DIME) work to hide email metadata?

While Email encryption can protect the content of an email, the metadata are still readable and can be used to gather important information about the sender and the receiver. There were several news ...
3
votes
0answers
58 views

Implementation specific differences between RDRAND and RDSEED

I've read Intel's The Difference Between RDRAND and RDSEED and Intel Digital Random Number Generator (DRNG) Software Implementation Guide, but I have some open questions that are specific to usage in ...
3
votes
0answers
65 views

Lattice attacks against Multilinear Maps [CLT13]

I am currently studying an article on a construction of Multilinear maps. There are some attacks on the scheme presented by the authors and I got stuck at the one in section 5.1. I will try to ...
3
votes
0answers
51 views

How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
3
votes
0answers
83 views

Brute force attack multiple stream cipher

Assume that a scheme used to secure a specific system $Π=(Gen,Enc,Dec)$ which is thought have indistinguishable multiple encryption in the presence of an eavesdropper. For any adversary $A$ that can ...
3
votes
0answers
51 views

What followed findings of A. Lenstra et al. concerning shared factors of practical RSA moduli?

A. Lenstra et al. had a paper in 2012 "Ron was wrong, Whit is right", in which one reads: "What surprised us most is that many thousands of 1024-bit RSA moduli, including thousands that are contained ...
3
votes
0answers
42 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
3
votes
0answers
57 views

Which precautions to protect against side-channel attacks on ARX ciphers?

In recent crypto there has been a trend to design ciphers using only the ARX set of instructions - i.e. additions (modulo $2^{32}$ or $2^{64}$), rotations (by a fixed constant) and XORs, examples ...
3
votes
2answers
111 views

Is this a correct way of use symmetric encryption?

If I want to encrypt some block of text in AES, but at the time of decryption I don't have a way to check if the symmetric key is the correct one. So I: Generate a randomKey, and use that to encrypt ...
3
votes
0answers
25 views

Is there a standard notation for a message concatenated with its signature?

I'm wondering what's the standard (or canonical) notation for "a message along with its signature", i.e. $$ \mathit{Message}~\Vert~\sigma_k(\mathit{Message}) \text. $$ Here the duplicated ...
3
votes
0answers
462 views

Which is/are the strongest known Fully Homomorphic Encryption scheme(s)?

As it is discussed here that the highest security any homomorphic encryption scheme is at most IND-CCA1, Is there any known fully homomorphic encryption scheme that achieves this security level? Out ...
3
votes
0answers
36 views

How to test a FHE implementation?

I want to implement a FHE scheme based on NTRU, namely the scheme described here https://eprint.iacr.org/2014/039.pdf . How to test the security of my implementation ? Do I have to implement the ...
3
votes
0answers
56 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
3
votes
2answers
63 views

Discrete Logarithm problem with inverse

Let $\mathbb G$ be a cyclic group of order $q$. The Discrete Logarithm Problem (DLP) is, given $g, g^x \in \mathbb G$, to compute $x \in \mathbb Z_q $. I'm interested to know if there is a known ...
3
votes
3answers
109 views

Fast forwarding hash functions

We know that a good hash function is a one way/trapdoor function. Easy to calculate one way, harder to work out a previous state. I was wondering if anyone knew a good hashing system that allowed ...
3
votes
0answers
111 views

Are there MD5 collisions for inputs of different length?

There are many examples of MD5 collisions (some of them can be found here Are there two known strings which have the same MD5 hash value?). But as far as I know two inputs should have the same length ...
3
votes
2answers
73 views

Probabalistic Polynomial-time Algorithms & One-way functions

I've been reading up on probabilistic polynomial-time algorithms and one-way functions, and I was hoping to get some guidance on the topic. A textbook I'm reading states the following for one of the ...
3
votes
0answers
49 views

Combining md5 collisions to create more collisions

Given X1 and X2 such that md5(X1) = md5(X2) and Y1 and Y2 such that md5(Y1) = md5(Y2), and knowing the following property of md5: if md5(a) = md5(b), md5(a|s) = md5(b|s) is there a way to find ...
3
votes
0answers
66 views

ElGamal Signatures

I know various applications of RSA signatures. I wonder, is there any real-world applications of ElGamal signatures and encryption?
3
votes
0answers
75 views

How does the ring settings of enigma change wiring tables?

EDIT: The model I'm trying to make is "Enigma 1". I learned initially about it from a book called "Code Book" and then looked at it in detail from its wikipedia page. The site wont allow me too add ...
3
votes
0answers
24 views

How to use “proof of knowledge” to verify the result of modular exponentiation

I am thinking about regarding proof of knowledge as the inverse of result verification in server aided computing. For example, a user asks the server to compute $R=x^y \bmod z$. Normally, the user ...
3
votes
0answers
25 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
3
votes
1answer
128 views

What is the impact of a server not fully verifying the data in the Client Finished packet of a TLS connection?

F5 BIG-IP devices suffer from a vulnerability in which not all bytes of the Finished packet in a TLS connection are validated. The sort-of technical description can be found here. F5 don't consider it ...
3
votes
0answers
132 views

Small subgroup attack on Diffie-Hellman

I am trying to understand the small subgroup attack on Diffie-Hellman. I will present the attack and try to explain why it works. Let be a group $\mathbb{Z}_p^*$ where $p$ is a large prime, so the ...
3
votes
0answers
66 views

Are there simpler FHE methods than Craig Gentry's original paper?

Craig Gentry's 2010 paper on FHE is very cool, and I'm planning on implementing a basic proof of concept FHE. I was wondering though, are there any simpler methods that have been discovered since ...
3
votes
0answers
41 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
3
votes
0answers
79 views

Worst case to average case in Ring LWE

I am currently trying to understand this Ring LWE article and I have a question. I don't understand how to apply Lemma 5.11 in order to get the worst case to average case reduction in Lemma 5.12, as ...
3
votes
1answer
97 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
3
votes
0answers
96 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
3
votes
0answers
63 views

Is modular Barrett reduction usable for Ed25519?

I currently try to implement Ed25519 following this draft. I have implemented every field operation except the reduction by the group order $q$ (in chapter 5). I looked for a reduction algorithm and ...
3
votes
0answers
64 views

Words having weight near to minimum distance

I am studying the NP-Problem of the codes Syndrome Decoding. The formulation is show below. Input: a binary matrix $H$ of dimension $r \times n$ and a bit string $S$ of length $r$. Property: there ...
3
votes
0answers
89 views

Example: pre-image resistance to second pre-image resistance

It is possible to convert a pre-image resistant function $f:\{0,1\}^{n}\rightarrow \{0,1\}^{n}$ to a second-preimage resistant function? I am thinking to use a pseudo-random generator and construct ...
3
votes
0answers
35 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
3
votes
0answers
30 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
3
votes
0answers
85 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
3
votes
3answers
197 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
3
votes
0answers
35 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the ...
3
votes
0answers
73 views

Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...

15 30 50 per page