3
votes
1answer
529 views

Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
2
votes
1answer
186 views

Why do we need to hash both the message and the $h$ value in ElGamal signature?

The professor left us a question on ElGamal signatures: Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
0
votes
0answers
29 views

Join Datasets While Protecting Anonymity

I've run into this issue a couple of times in my career. I'll see if I can explain with an example (please ignore the fact that this is implausible in the real-world). Suppose I sell computers, and I ...
0
votes
0answers
17 views

How to prove the hardness of Rabin's function?

I am unable to prove the following theorem: If for a $1/(\log(n))$ fraction of the quadratic residues $q\pmod n$ one could find a square root of $q$, then one could factor $n$ in random polynomial ...
0
votes
0answers
60 views

Can a combination of encryption algorithms weaken the overall encryption?

Are there any instances where a combination of industry standard encryption algorithms can weaken the overall encryption of the data? As a Naive example using non-standard encryption algorithms, ...
27
votes
3answers
4k views

How are primes generated for RSA?

As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
0
votes
2answers
52 views

How is an epsilon of 1/1000 non-negligible?

Lately I've been studying cryptography and in the current course I'm taking we're reviewing statistical tests and how they can be used to determine if a pseudo-random generator is secure or not. ...
0
votes
1answer
45 views

How are messages from server secured when using SSL certificate

In case of using SSL the certificate server has a primary key and a public key that is published to all clients - as far as I understood. So in this case when message is encrypted by public key (on ...
6
votes
2answers
3k views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
2
votes
1answer
113 views

Is this variant of SRP useful?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
3
votes
2answers
276 views

Public-key cryptosystems without poly-time quantum attacks

It's well-known that Shor's algorithm can solve integer factorization, discrete logarithm and discrete log over elliptic curves in cubic time. This implies that cryptosystems like RSA, ElGamal, and ...
0
votes
3answers
150 views

Does NTRU provide Perfect Forward Secrecy?

Does NTRU provide Perfect Forward Secrecy if the world would use it in an HTTPS connection?
1
vote
2answers
138 views

Are there any quantum-resistant symmetric encryption schemes?

It seems that quite a few currently available encryption schemes will possibly be broken by quantum computing. Are there any symmetric encryption schemes that will remain unbroken (either because of ...
0
votes
0answers
23 views

Creating a LCG with m = 32767 [migrated]

I hope this question is not too simple for you: I want to create a PRNG for an integer only (with a max of 32767) system and tried to use an LCG. So I've chosen as m = 32767 and c = 3 and I tried to ...
1
vote
1answer
39 views

sha256_hmac for session keys using a counter

I need to generate some session keys from a master key that was generated from an ECDH key exchange. The master key is 256 bits and I need 256 bit sessions keys. Is it safe to use SHA256_HMAC with ...
0
votes
1answer
202 views

Blowfish ECB mode: Tools for known-plaintext attack?

I'm currently dealing with multiple blowfish-encrypted files that share the same key. All are encrypted using ECB mode judging from their appearance. I don't know what the key is but I know 64 byte ...
1
vote
1answer
67 views

Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper on ...
2
votes
1answer
61 views

Is “Bit Independence” of SHA-2 hashes secure?

I know bit independence is good in SHA2 function output, but is it truly 100% secure? For example: Y = SHA512(secretKeyNonce256bit) A = first 32ytes / 256bits of Y, used as message encryption key B ...
-1
votes
0answers
26 views

How to calculate 16x16 SBox and InvSBox in AES Encryption?

As far as I know, $GF(2^8)$ and its multiplicative inverse are used to generate the 16×16 SBox and InvSBox in AES Encryption [or maybe I am wrong]. Can anyone please explain me how to generate this? ...
0
votes
1answer
90 views

How to compute accumulated values in bilinear map accumulators

How to compute $ g^{1/(e_1+s)}$, where $g$ is the generator of group $\mathbb G$, and $e_1$ and $s$ are keys? I know only $s$ and $g^{e_1}$, not $e_1$. $\mathbb G$ has prime order for some prime $p$ ...
3
votes
0answers
51 views

How to generate new LWE samples

Assume we are given a small fixed number of LWE samples with secret $s$ and error $e$, where the error distribution is taken so that the LWE problem is hard. My question: How can one further ...
3
votes
0answers
67 views

Rationale for use of right-shift (rather than rotate) in SHA-2?

The SHA-2 hashes in FIPS 180 define $\Sigma$ and $\sigma$ bijections of words, with $\Sigma$ used in the round function, and $\sigma$ used in preparing 48 words of message schedule from 16 words of a ...
2
votes
2answers
162 views

Is it possible to choose which point will have the public key of a given Elliptic Curve?

I am wondering if there is a feasible way that, given a specific elliptic curve (such as secp256r1), I could create a keypair where the public key has a given $x$-coordinate. If it is not possible, is ...
0
votes
1answer
26 views

What is the proper usage of GCM nonce in TLS1.2?

I have written a program with the help of the bouncy castle for C# library. I am monitoring the traffic which is send between the client and the server and found something (i find) strange. The ...
2
votes
0answers
22 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
1
vote
1answer
23 views

Why does P1363 require RW signature with $0 ≤ s < n/2$?

I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs. P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45: ...
2
votes
2answers
614 views

What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
1
vote
1answer
42 views

Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
1
vote
1answer
42 views

How hard is it to recover $p$ if I can get $h(p) \oplus h(p^*) \oplus r$ and $h(r)$?

Assume that $h:\{0,1\}^* \rightarrow \{0,1\}^\lambda$ is a cryptologic hash function, $r$ is taken randomly from $\{0,1\}^\lambda$, $p$ is a low-entropy password and $p^*$ is a guess. Now we get ...
0
votes
0answers
31 views

Understanding the PRINCE cipher linear layer

I am struggling to understand how to implement the PRINCE cipher linear layer. (https://eprint.iacr.org/2012/529.pdf) From my understanding I need to multiply the state with M, and with M' in between ...
0
votes
1answer
58 views

Is the inverse of a point on an elliptic curve over $\mathbb{Z}_p$ always in the group?

I'm working on a zero knowledge proof system that uses ECC over $\mathbb{Z}_p$ (currently using NIST P-256 since mbed TLS doesn't support group operations on Curve25519, but the problem should be ...
0
votes
1answer
45 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
0
votes
0answers
35 views

How to find an impossible differential?

Given an arbitrary SPN-based cipher with X rounds. How to find an impossible differential for this cipher? What are strategies to find one?
0
votes
0answers
45 views

zero knowledge framework for c programs - how to prove correct C program execution with private inputs

I am looking for a zk framework that could be used for proving correct execution of programs written in C (or any other high level language) such as: I know x s.t. SHA-256(x) = y (y is public, x is ...
0
votes
1answer
76 views

Diffie Hellman Exponentiation Implementation Problem

im trying to work on key agreement schemas on embeded systems. for diffie hellman, ive written a 256 bit multiplication, on AVR core it takes about 2 seconds on 1Mhz frequency, lets say my algorithm ...
10
votes
2answers
1k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
3
votes
1answer
105 views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
1
vote
1answer
98 views

Calculating XOR Key Sizes

I've been playing around with the Matasano crypto challenges (cryptopals.com). I had a couple false-starts on the challenge that has you creating a program to calculate the key size of a XOR encrypted ...
0
votes
1answer
35 views

Is randomsound for increasing entropy pool not doing what it is supposed to do?

I am using randomsound because I thought it would be a good idea to inject some additional entropy into the entropy pools of my linux machines (clearly those machines have a corresponding sound card). ...
0
votes
1answer
41 views

Key derivation design to avoid key leaks

I have the first function that generates keys from AES decryption (128-bit key). It takes seed as input: ...
6
votes
1answer
226 views

Looking For Additively Homomorphic Encryption

I have a construction that requires as primitive an Additively Homomorphic Encryption scheme that does not rely on hidden group order, meaning I can't use Paillier. I now have two different ...
2
votes
2answers
1k views

Estimating bits of entropy

Best ways to estimate average bits of entropy in a byte stream. I know there are different statistical tests out there (NIST, Dieharder, etc), which all do different ways of analyzing entropy. What ...
0
votes
2answers
43 views

Are there security issues with adding plaintext length to TLS packets?

I have quite a big problem, because of a software implementation of TLS I had to adapt I had to create something which is now biting me. It all comes down to this: I need to know the length of the ...
0
votes
0answers
54 views

Is there any real practical group signature scheme deployed?

Groups signatures are a crypto primitive introduced in order to guarantee anonymity on signatures constructed by a group of people. Since there introduction and there exhaustive security requirements ...
2
votes
2answers
194 views

Practical implementations of Multiparty computations [closed]

Are there any practical implementations and or software platforms to prototype applications based on MPC ?
-1
votes
3answers
67 views

Some doubts about GnuPG

I've reading on GPG since yesterday and I have a doubt: the whole system of double key encryption does make sense but it looks to me like either way you are compromising something in terms of ...
0
votes
2answers
65 views

Pailler encryption of small integers to 32-bit integers

I want to encrypt very small integers in the range 0-44 using the Paillier cryptosystem. Is there a way to select p, ...
0
votes
1answer
42 views

Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. [closed]

I'm in the process of converting a Python program I found for calculating ECDSA public keypairs from a given private key. In this particular case it's on the Bitcoin curve. ...
16
votes
4answers
4k views

How do we know a cryptographic primitive won't fail suddenly?

It took more than a decade from when MD5 looked like it was going to break to the point when it was actually broken. That's more than a decade of warning. How can we be sure that when our ...

15 30 50 per page