3
votes
2answers
133 views

Is RSA key size the size of private key exponent in public key encryption?

I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the ...
1
vote
0answers
54 views

Want to use ECC but am clueless [closed]

First off, I'm not an experienced cryptography or computer person, please bear with me. I have some basic experiences with PGP software though (not much of a redemption huh?). I have some data that ...
-2
votes
1answer
48 views

How to write the encrypted message after using RSA

I have created a RSA encryption/decryption program but how do i write out the results after doing a encryption? Right now I have it so that it will just print out the decimal value of one character ...
1
vote
1answer
70 views

Quantum key distribution simulation

I'm looking for a simulation of the Quantum Key Distribution protocol. Does anyone here have one that they could recommend?
-1
votes
1answer
41 views

Error propogation in CBC mode

Going through the wiki for modes of operation I see that the section error propogation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
2
votes
1answer
75 views

Chosen Ciphertext Attack with a theoretical decryption machine

Say we have an encryption algorithm that encrypts data blocks of 128 bits size, and makes them cipher blocks $C = E(P)$ without chaining. Also assume there is a linearity rule for XOR: For every pair ...
2
votes
1answer
104 views

Illustrate NTRU using lattices

I studied some papers related to NTRU. All these papers describe NTRU as a lattice based cryptosystem but I could not find any paper which illustrates NTRU algorithm from lattice point of view. It ...
2
votes
1answer
50 views

Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite ...
3
votes
1answer
84 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
2
votes
1answer
61 views

Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?

In a recent question I asked here on crypto.se, an answer was given that surprised me a bit. As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from ...
4
votes
2answers
289 views

Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?
-1
votes
2answers
97 views

Journals to read in order to keep up to date with interesting research [closed]

I'd love suggestions from crypto.stack as to academic journals to read. They can range from introductory to advanced, as long as it's free (requires no access fees). Feel free to edit this question ...
5
votes
2answers
217 views

Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
2
votes
1answer
89 views

Efficiency of chaining AES “groups” of blocks

From ISO/IEC 23001-7:2012/Amd 1:2012 10.2.2 Creation of Initialization Vector (Informative) Decryption efficiency may be improved if subsequent initialization vectors use the value of the last ...
1
vote
1answer
68 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
2
votes
1answer
84 views

How does CBC work with read-write volumes?

I have read an article about an attack on LUKS in CBC mode and had a look at the WP article about CBC and now I am confused. If I have understood that correctly then changing the plaintext of a block ...
4
votes
1answer
131 views

What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
-1
votes
1answer
71 views

Reverse engineering a single checksum byte [closed]

I am working to understand a system which saves a few bytes of data together with what appears to be a single checksum byte that provides a very naive guarantee that the data has not been tampered ...
1
vote
2answers
91 views

How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption?

I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$ ...
1
vote
2answers
102 views

What are the major flaws and limitations of this hash-based stream cipher design?

K is a 224-bit key. C is a 32-bit counter; it is publicly known. the same value is never used twice. ...
0
votes
1answer
148 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
1
vote
1answer
91 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
1
vote
1answer
54 views

Problem with anonymously merging information from distributed sources

Some Background: There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
1
vote
1answer
67 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
2answers
111 views

weaknesses in ElGamal with public key of small order

Suppose $p=29$, $\alpha = 2 \in F_p^*$ is a generator of $F_p^*$. Bob picks $d \in \{2,...,27\}$ such that $\beta = \alpha ^d=28 \pmod{29}$. He then sends his $(p,\alpha ,\beta)$ to Alice who herself ...
1
vote
2answers
101 views

Understanding math behind RSA key derivation [duplicate]

I was reading through the key derivation for RSA. Here are the steps per wiki - Select strong primes $p$ and $q$ such that $pq = n$ $\phi(n)$ = $(p-1)(q-1)$ select $e$ such that $e$ and $\phi(n)$ ...
2
votes
1answer
103 views

How do P2P clients like uTorrent maintain authenticity of files?

I am very new to concepts of cryptography so bear with me and feel free to fill in any information that may seem obvious but something you think someone may not know. At first I was under impression ...
0
votes
0answers
69 views

Can you determine an unknown value when it is combined with a known value and you are given the resulting hash?

Say I have a string that I want to keep hidden. You can then enter a known string which is added to the end of the hidden string and you are given the sha256 hash of the combined string. If you were ...
3
votes
1answer
80 views

Cryptographic pseudo-random generation of address subsets

Suppose I have devices which broadcast, on an insecure channel, 32-bit addresses. I want to make these devices untraceable - one way to do so is to allocate for each device a distinct subset of ...
1
vote
1answer
65 views

Complement property of DES

I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$). My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial ...
-2
votes
0answers
93 views

Symmetric-Key Based authentication [closed]

So i've managed to answer all the other cryptography questions, but I have not come across this exam style question before, and need help.
1
vote
1answer
107 views

Simple way to extend AES to 256-bit block size

What is the best way to use standard AES with a 128-bit block size to act as a 256-bit block cipher? I am aware of CMC and EME which seem to serve this purpose, but they seem to be more complicated ...
2
votes
1answer
88 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
-1
votes
2answers
266 views

Shamir Secret sharing - Can share generator keep x values secret?

I'm wondering, in Shamir secret sharing, can generator of the shares, keep the x values which are used in evaluating the polynomial to obtain y values (i.e., the shares) secret, and whenever the ...
0
votes
1answer
80 views

One-time pad, zero key and Shannon

I'm supposed to prove that OTP without the zero key $k=0^n$ is not perfectly secret anymore. I understand that it's not because an attacker learns something by looking at the plaintext and ciphertext. ...
3
votes
1answer
101 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
2
votes
1answer
126 views

Is AES-256 over AES-128 weakening the original encryption?

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately ...
1
vote
1answer
68 views

Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$ [closed]

Imagine a tagging system whose security requirements imply to learn nothing from the tag about the encoded value. We consider a plaintext space $X \in \mathbb{Z}_p$ and a group $\mathbb{G}$ where ...
3
votes
4answers
509 views

Which tamper-protection algorithm provides the shortest output?

Background When making web applications you sometimes need to pass data along with the form which isn't visible to the user. Database IDs are the most common, but texts and IDs are sometimes ...
1
vote
1answer
82 views

Common password derivation function for different encryption methods

I'm writing a simple encryption/decryption library which has the following requirements: For key derivation functions, support: $SHA256 \rightarrow bcrypt$ (since $bcrypt$ limits input passphrase ...
1
vote
1answer
65 views

Prefix property for variable length pseudo-random generators

I'm currently working through Katz & Lindell's Introduction to Modern Cryptography. In section 3.4.2, they introduce the definition of a variable output-length pseudorandom generator $G$. The ...
1
vote
0answers
45 views

Berlekamp-Massey algorithm, correct stepping

I'm trying to use the Berlekamp-Massey algorithm on the following bit sequence: 0 1 0 0 1 0 0 1 0 1 I have the correct answer and most of the approach to get there, but I'm unable to fill in what I ...
4
votes
2answers
141 views

How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?

Imagine Alice wants to encrypt for Bob and post this encryption publicly, so that only Bob can decrypt but no one can other than Alice or Bob tell that the message was encrypted for Bob. The naive ...
4
votes
1answer
193 views

how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus ...
5
votes
1answer
130 views

Perfect Forward Secrecy with NaCl

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application. From what I understand, all Bob needs to to decrypt a ...
2
votes
2answers
113 views

Advantages to knowing $p$ and $q$ in Blum Blum Shub?

Do you gain any advantage by knowing the factorization of $M$ (over just knowing $M$ itself) in the Blum Blum Shub generator? The only advantage I see is being able to calculate the $i$-th number ...
0
votes
1answer
142 views

Is C25519/Ed25519 “twist secure”?

This recent new curve mentions something that's new to me: twist security. http://safecurves.cr.yp.to/bada55.html Are the existing C25519/Ed25519 curves secure against this form of attack?
0
votes
1answer
63 views

ElGamal digital signature. why mod p-1 in delta?

Im trying to figure out why $\delta$ in the signature part of ElGamal has mod $p-1$ when $\gamma$ has mod $p$? $\gamma = \alpha^k \mod p$ $\delta = (x-a\gamma)k^{-1} \mod p-1$
1
vote
1answer
52 views

How exactly are PRNG's used to encrypt material, and what makes one any more secure than the other?

I hope my question isn't as lazy as the title indicates. What I want to ask is how people literally integrate a PRNG with encrypting material. I wrote a silly little script in Python a while back ...
1
vote
1answer
39 views

Knapsack Public to Private (Superincreasing knapsack)

I need to convert a hard knapsack to a superincreasing knapsack. I have these superincreasing values (3,6,11,22,43,87). I also have w = 7 and n = 173. I converted the superincreasing values to hard ...

15 30 50 per page