2
votes
1answer
38 views

Finding $f^{-1}$ in the YASHE keygen algorithm

In the YASHE (Yet Another Somewhat Homomorphic Encryption) algorithm, the beggining of the key generation step specifies: Sample $\ f',g ← χ_{key}$ and let $\ f = [tf' + 1]_q$. If $\ f$ is ...
12
votes
10answers
3k views

Are there any advantages in using proprietary encryption?

Proprietary software generally relies on the fact that in keeping the encryption algorithm private, it gets an extra layer of security implying "Security through Obscurity." Obviously this phrase has ...
3
votes
1answer
115 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
1
vote
1answer
35 views

ZK proof that two short solutions are equal

Let $A_1$ and $A_2$ two $m \times n$ matrices defining SIS problems. Does there exist a zero knowledge proof that two short solutions are the same, i.e. $$y_1 = A_1 x $$ $$y_2= A_2 x $$ $$ \Vert x \...
1
vote
2answers
181 views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...
-2
votes
0answers
73 views

How to calculate ϕ(n) from n?

I'm trying to fully understand all the steps of the RSA algorithm. I have clear so far that: $n$ comes from the product of two numbers: $p$ and $q$ The public key consists of the pair ($e$, $n$) ...
3
votes
1answer
99 views

Do equivalent RSA keys exist?

If $m^{ed} \bmod n = m$ for message $m$, public key $e$ and private key $d$, then adding any integer multiple of $n$ to $m^{ed}$ still equals $m$ modulo $n$. Supposing it exists, how do I find an ...
1
vote
1answer
662 views

Simplified Fiat-Shamir example generates wrong output

I am trying to implement the Fiat-Shamir identification protocol, however the end results always fail to match. I am using algorithm's description from here. Preparation: Select 2 prime integers ...
4
votes
1answer
159 views

Why do different applications of hash functions demand different properties of the hash function?

A strong cryptographic hash function in general must guarantee several properties, including: Preimage resistance, second preimage resistance and collision resistance. It turns out, however, that ...
0
votes
1answer
59 views

How to do statistical analysis on encrypted / anonimized data

Let's imagine Alice wants to send Bob a table with 2 columns: ...
10
votes
1answer
120 views

K Friedman - two texts explanation

I read the $K$-Friedman test to determine the period of a Vigenère ciphertext, and I understand something like this: $K$-Friedman test tries to find out what period of the cipher by calculating some ...
6
votes
2answers
212 views

Can I use a differential that can be traced through the whole cipher with 100% probability?

I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
1
vote
1answer
69 views

Is brainpoolP512r1 safe?

I'm using brainpoolP512r1 elliptic curve for DSA and DH in my application. Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Unfortunately my curve wasn't ...
3
votes
0answers
22 views

Construct new SIS solutions from given ones

Assume we have a lattice SIS problem $A x = 0$, with $\Vert x \Vert < \beta$ and we are given $k$ solutions $x_1, \dots, x_k$ by, say an oracle. Is it then hard or easy to construct from there a ...
4
votes
1answer
394 views

Do all ciphers have equivalent decryption keys?

Do all ciphers suffer from the problem of multiple equivalent decryption keys? Is the existence of equivalent keys an essential property for the security of a cipher? If you could prove that a cipher ...
6
votes
1answer
145 views

Under what conditions did a Bletchley bombe stop?

I am trying to understand the conditions necessary for one of the Bletchley Park bombes to stop. Let me give an example. I have been experimenting with Enigma machine and bombe simulators to try to ...
0
votes
1answer
78 views
9
votes
2answers
482 views

How to deal with a cipher with addition and XORs combined together?

I am trying to cryptanalyze a cipher where bitwise XOR and addition mod $2^n$ are combined together. I've been working on it for a long time but with no result - the main difficulty, which I am unable ...
0
votes
0answers
15 views

How to set M parameter for frequency test within a block

I am using statistical tests to determine whether a sequence of bit is random, one of them is frequency test within a block. In a nutshell: Within a block of M a number of 1 is counted. A joined ...
1
vote
0answers
28 views

Freely available softwares for simulating/implementing MPC protocols [closed]

I have been designing multiparty computation (MPC) protocols for functions that interest me. Although theoretically I am able to deduce the asymptotic complexity of the protocol, I wish to know as to ...
2
votes
3answers
202 views

What is the point of differential cryptanalysis when the amount of necessary plaintext is unrealistic?

As someone with a non-crypto background, I learned that differential cryptanalysis is mostly weak against ciphers like DES because, being a chosen plaintext attack, for a state of art complexity of $2^...
5
votes
1answer
46 views

How simple can the PRP used in the Even-Mansour scheme be?

For example, in the question “Is there any reason not to use Single-Key EM with AES and a constant key?” it is proposed to use AES with a fixed key as the permutation in a xor-permute-xor construction....
2
votes
2answers
337 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
0
votes
0answers
19 views

How to prove a key generation protocol based on blind RSA signature?

It seems like that a user may use blind RSA signature to obviously generate a key. My design is as follows. Please correct me if I get anything wrong. (Please refer to WiKi https://en.wikipedia.org/...
0
votes
0answers
14 views

how do i incorporate AES encryption into a text encryption hta in the form of a batch file? [migrated]

i made an hta app and a few batch file encrypters and decrypters used in the hta for encrypting text. how can i incorporate AES encryption into my hta? i would like to have an AES encryption function ...
3
votes
1answer
107 views

Reversing a hash of known hashing algorithm

I am sure this is a very easy thing to do but I am not sure how to go about solving a problem like this, So there is this hash function which operates on a message which is in the form of a byte array ...
1
vote
1answer
140 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
8
votes
2answers
67 views

Cardinality of the group of units in a cyclotomic ring?

In the NTRU key generation, one samples a polynomial from $K = (\mathbb Z/q\mathbb Z)[X]/(X^n+1)$ and tests if it is invertible. What are the chances of this to happen? In other words: Let $q$ be a ...
1
vote
0answers
28 views

Getting a key size of DSA/Elgamal certificate

I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key ...
1
vote
1answer
76 views

Comparison on Ciphertext with Helib

Is it possible to do a greater than homomorphic comparison in the form ($c_1 < c_2$) on two ciphertexts using Helib? The equal comparison ($c_1 == c_2$) can be done in modulus 2 by adding both ...
3
votes
1answer
173 views

Finding sum of two encrypted numbers

Let's consider such process: Two emitents emit two (integer) secret numbers independently They encrypt (encode) these number in such a way that no-one (except emitent) can decode these numbers. ...
0
votes
0answers
10 views

Invert authentication and secrecy passages in public-key cryptography [duplicate]

I know that for assuring authentication and secrecy in a communication between A and B using Public-Key Cryptography I have to send something like this: $E(PU_b,E(PR_a,m))$ Where: $E$ is the ...
0
votes
3answers
384 views

CTR HMAC SHA256 implementation

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR with HMAC SHA256. From what I understand, I can use the IV as a counter, and the IV ...
3
votes
1answer
1k views

Differences between using HMAC-SHA1 vs HMAC-SHA256 for data storage?

Reading the question “HMAC-SHA1 vs HMAC-SHA256”, I figured out that the known attacks on SHA1 don't apply to its HMAC version. So, HMAC-SHA1 is quite strong right now. In a protocol like SSL, if it ...
1
vote
1answer
69 views

Can I compute “SHA256(secret||data)” when having “SHA256(secret)” and “data”?

I need to find the SHA256 hash of s string like this: part1-part2. I know the SHA256(part1), length of part1 and I know ...
0
votes
1answer
45 views

Create composite group for pairing in JPBC

We use bilinear map $S = (G, G_T , e(\cdot, \cdot))$ of composite order $n = s \times n'$ with two subgroups $G_s$ and $G_n'$ of $G$. Random generators $w \in G$, $g \in G_s$, and $φ \in G_n'$ are ...
1
vote
1answer
27 views

AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?

The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form: First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
7
votes
1answer
5k views

How long does it take a quantum computer to brute force AES?

I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ...
0
votes
1answer
242 views

Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
3
votes
1answer
69 views

Under which conditions would it be OK to use “H(pass||data)”?

I understand that the main motivation for HMAC is extension attacks. If data always has content-length either implicit in the app or even explicitly put into the hash, I get the impression that HMAC ...
3
votes
0answers
81 views

Commutative Hash Function for Password Challenge?

I had an idea. Could anyone tell me if this is a thing, if they see any problems with it, and if they know of a commutative hash function that would make it work? Suppose you had a pair of ...
5
votes
1answer
208 views

How should I read these three-dimensional (pseudo)random-generated numbers representations?

Visiting this site: http://lcamtuf.coredump.cx/oldtcp/tcpseq.html#phase I found graphical representations of random-generated sequence numbers, but I can't figure out how to interprete the plots. ...
2
votes
0answers
54 views

Is there any symmetric key cipher (block or stream cipher) providing partial decryption?

symmetric key cipher (block or stream cipher) providing partial decryption of data at some points. Although the entire data has not been decrypted, the data decrypted to that specific point should be ...
2
votes
1answer
285 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = 𝑔^{𝛽𝑠_{1}...
3
votes
0answers
36 views

Computing cost for a trillionaire to compute GNFS in RFC 3766

RFC 3766, Section 4.1 discusses picking $n$ to achieve some target cost for employing the GNFS, i.e., $T$ is known and $N$ is unknown in the below equation: $$T = \kappa \cdot \exp{\left(c \cdot (\ln{...
2
votes
1answer
76 views

Gaussian distribution in lattices

In many lattice based cryptosystems, Gaussian distribution is used. Can you explain why only Gaussian distribution is preferred?
11
votes
2answers
200 views

Is there a way to optimize a linear scan while preserving anonymity?

I've been wrestling with a problem, and I was hoping if someone else had a bright idea. Here's the problem: I have two sides, Alice and Bob. Alice has a single high entropy string $A$, and Bob has a ...
0
votes
4answers
45 views

Is XORing a random stream of bytes a secure way to obscure a file?

Long ago I created a very simple program that used the C library's rand method to generate bytes to XOR with the bytes of a file. This was a reversible (just run it through again) method to make a ...
4
votes
2answers
71 views

Order-Preserving Encryption (OPE) and leakage

I recently came across OPE and Order-Revealing Encryption (ORE), but I didn't exactly got the idea why they are important. What's exactly important about them? Are they actually used in practice? My ...
3
votes
0answers
25 views

Incorrect answers to queries in Waters' IBE proof by Bellare and Ristenpart

In "Simulation without the artificial abort: Simplified proof and improved concrete security for Waters' IBE scheme", Bellare and Ristenpart present a new proof for Waters' IBE scheme that does not ...

15 30 50 per page