3
votes
1answer
510 views

ElGamal message signatures retrieving the secret value x

If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined. Why is this true? How would one retrieve x?
3
votes
2answers
220 views

Background for modular arithmetic function

I'm investigating this function: $a := ((b\cdot c) \bmod k) - (b \cdot c)/k$ where $/$ indicates integer division. Two things I've noticed: It's equivalent to multiplying a·b, and then ...
3
votes
1answer
1k views

Digital Signature Algorithm signature creation

I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for ...
3
votes
2answers
2k views

ANSI X9.9 Cryptography Standards

I'm trying to create a ISO8583 Rev93 message. What is the standard way of generating MAC key in ANSI X9.9 DES-CBC encryption algorithm is used to encrypt the ...
3
votes
1answer
63 views

How to create reduction functions in rainbow tables?

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
3
votes
1answer
36 views

How to distribute system parameters in identity-based encryption

Identity-based encryption papers describe that system parameters are declared as public. However,in real scenario, how to distribute system parameters to users?
3
votes
1answer
46 views

Is using a rolling code as a constantly-changing shared secret effective for signing?

I am your average developer looking for some crypto-related guidance. I am trying to have assurance that a received message is from a particular sender, but have no need for the message content to be ...
3
votes
2answers
146 views

MAC unforgeability and secret key guessing

The standard notion security for MACs is usually expressed by means of experiments like the following one (given an attacker A): $k \leftarrow \mathsf{KG}(1^\lambda)$ Invoke $A^{\mathsf{TAG}_k(\...
3
votes
3answers
68 views

Keyless Signature Infrastructures as a secure Post-Quantum Scheme

I came across a company that relies on hashing, similar to block chain technology. They explicitly stated in their white paper that hash based cryptographic schemes are inherently post-quantum ...
3
votes
1answer
67 views

Parameterizing adversaries with security parameters

In many cryptographic games, the adversary doesn't seem to be parameterized by the security parameter.‡ Are such games equivalent to variants in which the adversary is parameterized by the security ...
3
votes
1answer
95 views

Salting Hash stored on RFID tag?

In my application, I am trying to prevent counterfeit widgets from being used on our gadgets; think HP ink-cartridges. I will be doing such with UHF RFID tags embedded in the widgets. Unfortunately, ...
3
votes
1answer
78 views

tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/...
3
votes
1answer
38 views

Is there a way to turn a PGP key into its semi-prime counterpart?

From my understanding of PGP keys they use the RSA algorithms to encrypt/decrypt messages. So, I know that the RSA algorithms use a semi-prime number to encrypt/decrypt messages. So, what I was ...
3
votes
1answer
36 views

How does this solution guarantee authentication of B and privacy?

The exercise is: What could be changed on the second message " Kya(Kxb(Ra,Ks)) " to guarantee B's authenthicity and also privacy? My teacher's solution was "add a destination" , so it would be ...
3
votes
1answer
91 views

Yao's Garbled circuit: Does Bob ever see the circuit?

I asked a question about whether the circuit structure for Yao's garbled circuit needs to be rearranged. I understand from Yehuda Lindell's response that the circuit structure itself does not need to ...
3
votes
1answer
73 views

ECFP harder than ECDLP ?

Given two points $P$ and $Q = \sum_{i=1}^{n} x_i.P$ over $E_p(a, b)$ for $x_1,x_2,...,x_n \in \mathbb F_p$. The Elliptic Curve Factorization Problem (ECFP) is to find the points $x_1.P,x_2.P,...,x_n.P$...
3
votes
1answer
67 views

Is the use of a 4-round Blake2b permutation in OPP justified?

The MEM-AEAD construction uses a 4-round Blake2b permutation in masked Even-Mansour mode as a (tweakable) block cipher. 4 rounds of the Blake2b permutation are already broken to my knowledge. Why ...
3
votes
1answer
151 views

Trying to understand textbook exercise question regrading RSA

I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. Any hint would be great. Question (Exercise 9.14 of textbook): ...
3
votes
1answer
51 views

The role of the dealer in visual cryptography

In visual cryptography schemes (VCS), there is special person called dealer. The dealer sets up the system, and the only one who knows about secret image. After encryption, the dealer distributes the ...
3
votes
3answers
74 views

Are there any hash functions that use integers of arbitrary bit size (e.g., int63)?

More precisely, I am looking for hash functions where the internal state can be decomposed as a vector of integers of size 63. That is, machine integers where one of the bits is fixed and unusable.
3
votes
1answer
87 views

Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
3
votes
1answer
65 views

Practical lattice based signatures and key exchange with strong security reduction

I am looking for practical lattice-based signatures and key exchange with strong security reductions. Specifically: Provable security under the relevant standard assumptions. Fast in software while ...
3
votes
1answer
163 views

Why doesn't this operation reveal the voter's message?

I am working my way through this paper. I am trying to figure out the OR zero knowledge proof in figure 2. The prover is verifying that she has correctly voted, and that her input satisfies $$\log_gx=\...
3
votes
1answer
140 views

Is this SHA256 hash implementation secure from rainbow table, brute forcing attacks?

So I have an implementation where by we have an $8$-byte random input (entirely random, not user defined) which we hash with $\text{SHA256}$. The hash is shared with many parties to the point that we ...
3
votes
1answer
38 views

Is this session start protocol secure?

I am working on a password manager application that saves the user's passwords in a remote server. I need to use AES in CTR mode to encrypt the passwords before sending them to the server. The client ...
3
votes
2answers
40 views

Which compound algorithms would weaken cipher, not strengthen it?

OK, in school, some of the lecturers always say "if you compound the crypto, it may make the cipher weaker". So, which combinations of algorithms would do this? Why? Can anyone show the mathematical ...
3
votes
1answer
84 views

Exploiting XOR one-time-pads with alphabet size that isn't a power of 2

I realized that if the key is chosen randomly from a range that isn't a power of $2$, the one-time-pad leaks information about the plaintext. For example, if the alphabet was the first 20 naturals, ...
3
votes
1answer
104 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ —...
3
votes
1answer
96 views

Why inversion and multiplication operations are costly in elliptic curves?

There are several algorithms for efficient scalar multiplication of an arbitrary point P(x,y) by some positive integer k in elliptic curves defined over $F_{p}$ or $F_{2^{m}}$. The scalar ...
3
votes
1answer
43 views

how is the rsa $publickey(n ,e)$ transformed into a textfile allowing its public distribtution?

wikipedia says about the keys itself: The public key consists of the modulus n and the public (or encryption) exponent e. The private key consists of the modulus n and the private (or ...
3
votes
1answer
54 views

Is rubberhose cryptanalysis a sidechannel - formally?

I recently was engaged in a discussion in Sec.SE where somebody used the term "sidechannel" to actually mean "circumvent the encryption". By what he said it was clear, that he wanted to not bother ...
3
votes
1answer
117 views

How to encrypt a symmetric key with a shared secret?

I am reading this article (pdf) on the Diffie–Hellman key exchange. It states the following: At this point, the Diffie-Hellman operation could be considered complete. The shared secret is, after ...
3
votes
2answers
128 views

How can we define division operation by using Fully homomorphic encryption

Last fews months, I'm working with homomorphic encryption. Now I am dealing with some computational problems with integers or real-numbers (like arithmetic mean, standard deviation) where division is ...
3
votes
1answer
47 views

How do substution-permutation networks work?

I understand what's going on in higher level. But i don't understand what's really going on in page 3 and 4 of this slide. Specifically, How S0 and S1 is used? What goes in what goes out? How ...
3
votes
2answers
81 views

Are there any practical methods of steganography?

There isn't a whole lot of information on steganography in the modern age, from what I can tell. A google search for steganography usually brings up a list of very impractical methods (e.g. tattooing ...
3
votes
2answers
61 views

Determining Involutary Keys in Substitution Ciphers

How would I be able to show that a key $K=(a,b)$ is involutary for an Affine Cipher over the integers modulo n? Similarly, is there a way to generalize the conditions for a key to be involutary for a ...
3
votes
1answer
58 views

Generating passwords from a master password using rules

I realize it's generally considered bad idea to use the same password everywhere. I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to ...
3
votes
1answer
56 views

Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305?

I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ...
3
votes
1answer
163 views

Can a book cipher be cracked without key?

Book cipher works this way : Choose a reference book. For each word find its position in the book. replace each word by its coordinates (ie: 2,3,4 = page 2, 3rd line, 4th word). How would ...
3
votes
2answers
58 views

Problem with this authentication protocol

Consider such authentication protocol: Alice and Bob share a key. Bob sends alice a nonce. Alice encrypts it with shared key and sends to bob. Now assume Alice was successfully authenticated. ...
3
votes
1answer
75 views

Data Encryption Standard (DES) S-Boxes

I read that the S-boxes introduce the much needed nonlinear behavior to DES. Can someone give me a lay mans explanation of why the effect of the S-boxes is said to be non-linear?
3
votes
2answers
140 views

Security analysis of this one time password based scheme for copy protection

Imagine such protocol. Client and server initially share secret K[0]. When client wants to contact server she sends server K[0] and her ID. Server accepts request, and generated new random K[1] and ...
3
votes
1answer
60 views

Randomness and increment of nonce in GCM

2 questions about nonce usage in GCM: Is it safe to use non-random nonce in GCM? Say I use 0x1 for m1, 0x2 for m2, so on. How much should a nonce increased for a file? Say I use 0x1000 as a nonce to ...
3
votes
1answer
163 views

Limit the length of AES encoded output to certain value

First let me be clear upfront that am not Crypto expert. I'm having a problem where I will have to use NFC card. Now given the limitation of NFC cards memory sizes, I will need to constraint my system ...
3
votes
1answer
275 views

RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
3
votes
1answer
44 views

May I use Random Oracle for Inversed Look-up?

Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, ...
3
votes
1answer
139 views

More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
3
votes
1answer
211 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
71 views

Multi-Party Encryption for a Shared Document

Is there an encryption algorithm/protocol where any of a pre-defined set of keys/passwords will succeed in decrypting a document? The number of keys can be fixed, say, 10 or 20 possible passwords. ...
3
votes
1answer
70 views

Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...

15 30 50 per page