2
votes
0answers
58 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
2
votes
1answer
75 views

Permuting Small Sized Set in Practice

Imagine we have a set $S$ of $m$ elements and we wants to permutes the set elements. Thus the original position of each element should be unknown after permuting. If we define a permutation function ...
0
votes
1answer
48 views

Reduction to cdp,dl or cdh?

Assuming a randomize encoding scheme that takes as input a secret key $\mathsf{sk} \in \mathbb{Z}_p$ for a large prime number $p$. Then the algorithm outputs $g^{\mathsf{sk}x}, x \in \mathbb{Z}_p^*$. ...
1
vote
1answer
181 views

Factorize RSA knowing several N and E

I did a CRT challenge yesterday and there`s one problem I was unable to solve, probably due to my lack of understanding advanced crypto math. It`s about RSA. There are ten given pairs of N and E (...
1
vote
1answer
2k views

PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
1
vote
1answer
80 views

Ephemeral key is held constant in ElGamal

Is there a known algorithm to recover the sender's messages in ElGamal $\mathbb{F}_p^*$ if the ephemeral key is held constant in two or more transmissions, assuming the messages are always distinct? ...
4
votes
1answer
234 views

Do Gap-CDH groups exist?

A Gap-CDH group is such that, given group elements $g, a = g^x, b = g^y$, it is hard to compute $g^{xy}$, but, given a group element $c$, easy to verify if $c = g^{xy}$. While such groups have been ...
9
votes
0answers
363 views

Is it possible to break enigma code with a todays laptop [closed]

I have a 500 characters enigma encoded text. Random rotors were used (not the ones from wikipedia). I know of this flaw. I can guess some words that sould be in the text, but this probably doesn't ...
20
votes
1answer
10k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
1
vote
0answers
116 views

CPA-security of a pseudorandom permutation encryption scheme

Let $F$ be a pseudorandom permutation, and define a fixed-length encryption scheme $(Gen, Enc, Dec)$ as follows: on input $m \in$ $\{0,1\}^{n/2}$ and key $k \in \{0,1\}^n$, algorithm Enc chooses a ...
4
votes
2answers
303 views

Can a 1 byte difference in AES 128 bit keys make huge difference in output?

If we take some randomly generated key of AES-128 and we change any random 1 byte of that 16 byte key, will this make huge difference in the AES cipher text generated over same input string? Does ...
1
vote
0answers
97 views

Groth-Sahai proofs and hardness assumptions

I am learning Groth-Sahai NIZK proof system for Bilinear groups. While going through the literature, I am getting confused on how the proof system is related to Subspace Decision, SXDH or DLIN ...
5
votes
2answers
438 views

Why should one prefer Salsa20 over ChaCha?

We are all aware of Google's approach to introduce ChaCha/Poly1305 as TLS cipher suite. The rationale seems clear: ChaCha is newer and seems to provide better security (and maybe speed?) gained from ...
3
votes
0answers
140 views

When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
2
votes
1answer
107 views

Can CFB mode of block cipher be used as a commutative encryption?

Can CFB mode of block cipher be used as a commutative encryption? Is it possible to use CFB mode of AES block cipher to create commutative encryption? With CTR it is possible but not secure.
0
votes
1answer
97 views

Show How to Efficiently Solve the Computational Diffie-Hellman Assumption given an Algorithm that Solves the Square-DH Problem

Let $q$ prime number, $G$ a cyclic group with order $q$ and let $g \in G$ be a generator of $G$. Suppose that you have an algorithm $A$ who takes input the element $g^a$ of $G$ and gives as output the ...
2
votes
1answer
126 views

Is the ring of octonions “commonly” used in Cryptography?

I've recently read "Fully Homomorphic Encryption on Octonion Ring" by Yagisawa, which is based on octonion rings over finite fields. Personally I've never encountered octonion rings in cryptography ...
1
vote
1answer
299 views

Simulation Based Proof: What Can / Can not Simulator Do?

I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance: ...
2
votes
1answer
92 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
5
votes
1answer
138 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
9
votes
3answers
5k views

A timestamping authority (digital notary)

Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message ...
2
votes
2answers
70 views

Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...
0
votes
1answer
46 views

Algorithm for factoring a number $n$ of a specific form given $n$ and $\varphi(n)$

Given the natural number $n$, which is in the form $p^2 \cdot q^2$ with $p$,$q$ prime numbers. Also $\varphi(n)$ is given. Describe a fast algorithm (polynomial time) that calculates $p$ and $q$. ...
2
votes
0answers
78 views

How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
2
votes
1answer
129 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
3
votes
0answers
56 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
3
votes
1answer
150 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
10
votes
3answers
319 views

Collision or second preimage for the ChaCha core?

Daniel J. Bernstein's ChaCha core is an evolution of the Salsa20 core. Both are functions over the set of 512-bit bitstrings, partitioned as sixteen 32-bit words. Can we exhibit collisions, or second-...
5
votes
1answer
211 views

How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
3
votes
1answer
50 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
2
votes
1answer
291 views

Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper ("RSA ...
3
votes
0answers
31 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
13
votes
1answer
7k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
1
vote
1answer
233 views

How does knowing the factorization of N help to obtain the secret?

Assuming $x=a^2 \pmod n$ and knowing $x$, $p$, $q$ how is it possible to obtain $a$?
3
votes
1answer
128 views

How can I generate a good password from a SHA512 hash?

I have to change local administrator passwords on machines. I don't want to store password in a database. I have to generate a password that I can find later to connect to the machine again. So I ...
3
votes
2answers
175 views

Why is Rabin encryption equivalent to factoring?

I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia). Here's my objection: let's say you have a Rabin decryption oracle that takes ...
6
votes
1answer
259 views

What is “witness encryption”?

I recently skimmed over tho papers on time-lock encryption: “Time-release Protocol from Bitcoin and Witness Encryption for SAT” by Liu, Garcia, and Ryan “How to Build Time-Lock Encryption” by Jager ...
1
vote
1answer
139 views

What is k in RSA?

I am currently learning about RSA since I didn't understand the public-key-system but now I am… kind of. So I am writing the numbers as follows: $p = prime\ number\\ q = prime\ number\\ N = Public\...
0
votes
0answers
45 views

Implementation of digit serial rotators for SIMON cipher?

I am working on architecture of SIMON cipher where I have to use either bit serial, parallel or digit serial to implement the algorithm for each round function and also for sub-key generation. So I ...
3
votes
2answers
346 views

What are the implications of a birthday attack on a HMAC?

After collecting approximately $2^{n/2}$ message-tag pairs a collision can be observed. So two different messages (m1 and m2) will have the same tag. This paper states: Then, for any string x, (...
3
votes
1answer
100 views

What does “simulator” and “interactive” mean in a cryptographic credential system's definition of security?

Definition 1 on Page 7 of “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation” by Camenisch and Lysyanskaya, uses the term “simulator” in defining the ...
2
votes
1answer
71 views

Using AES for smaller blocks in a Feistel network

I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext ...
1
vote
1answer
75 views

Execution speed of AES_128 GMAC operation

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
7
votes
1answer
468 views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
-1
votes
1answer
60 views

i cant understand the meaning and the difference between linearity equation and affine and non linearity? [closed]

i cant understand the meaning and the difference between linearity and affine and non linearity equations and what is the meaning of the free term in affine form and how it make the equation non ...
3
votes
1answer
135 views

Is secure communication without public-key crytography feasible?

We all know about public-key cryptosystems, and we know some of these are computationally secure (for the time being, of course). Are there any algorithms out there which allow safe communication ...
1
vote
1answer
559 views

TLS encryption with a self-signed PKI and Python’s asyncio module

I want to enable TLS encryption with a custom / self-signed PKI for a self-contained distributed system built with Python 3’s asyncio. I’ve read Python’s ssl docs as well as several tutorials: ...
2
votes
2answers
714 views

TRNG vs PRNG - Entropy?

How much more entropy gives a Hardware Random Number Generator or True Random Number Generator compared to a Pseudo Random Number Generator? I know it depends on which TRNG is used, but I'm thinking ...
1
vote
1answer
63 views

Certificate for the public key

I am new to Network Security and learning about various security features like Diffie-Helmann and others. I understand that the Public key send by the server to the client needs to certified that it ...
3
votes
0answers
113 views

How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...

15 30 50 per page