# All Questions

110 views

### Is ecryptfs safe after unmounting but before turning off the computer

I've read that one of the vulnerabilites of ecryptfs is leaks to swap memory, and that the solution is to encrypt swap. But even if swap is encrypted, it's still open until I reboot. I've also read in ...
264 views

### Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
103 views

### Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ...
145 views

### encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
214 views

### File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
136 views

### Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
189 views

### Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
203 views

### Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
77 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
84 views

### Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
265 views

### One-Time-Pad with key-reuse: Faster way of decrypting?

I know there are already of few questions about this and I'm working with the advices that were given but I still doubt my approach is the fastest, so I'd really appreciate if you helped me find a ...
79 views

### A confusion about linear span of modified de Bruijn sequence

Recently i'm reading "Cryptographically Strong de Bruijn Sequences with Large Periods" . In the section 2 2.1 Basic Denitions and Properties , property 1 says that ...
134 views

### When do I need to renew keys for Salsa20 or HMAC?

I currently have a system which uses two keys sourced from a single key subjected to HKDF. One key is used in the Salsa20 stream ...
159 views

### Rabin/RSA four possible messages?

Given this encryption method: $$f_{N,e} : Z^{*}_{N} \to QR(N)^{*};\quad f_{N,e}(x) = x ^{2e} \bmod N$$ I need to show that, for any $x_{0} \in Z^{*}_{N}$, there are four elements $x \in Z^{*}_{N}$ ...
60 views

### Can you clarify the proof that secure LR-two party protocols do not exist?

In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ...
166 views

### Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
106 views

### Are there public $p$ and $q$ numbers for use in DSA?

There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the $p$ and $q$ large primes used in the DSA signature scheme. This is proving to be a ...
161 views

71 views

### Any functioning system for interactive proof?

My problem is to outsource an array of data and ask the prover to sort the data. I am wonder if there is any working system out there that support interactive proof for the above computation? Or if ...
67 views

### Protocol/algorithms based on a variable-length input PRF

Are the proofs based on a PRF assumption still valid when using a variable-length input PRF ? The answer might be obvious, but I have a doubt.
155 views

### How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
575 views

### Question about modifying the MD5 plain text to cause a collision

I was trying to understand MD5 and got stuck with this question, its from Michael sipser's book on Information security Principles and Practice, 2nd edition The MD5 collision in Problem 25 is said ...
32 views

### Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
311 views

### How to perform benchmark of block/stream ciphers?

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
182 views

### Integer factorization based password authentication

After looking at this security issue at DjangoProject, I started to think in a password-based authentication that places the burden of PBKDF2 (or whatever is the hashing function) on the client. So I ...
92 views

### partial-domain permutation and strong assumption

Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
86 views

169 views

### Security of a 3-party key exchange protocol

I am trying to find attacks on a theoretical protocol or prove its security. An initiator wants to establish a shared key with a responder with help of a trusted server. We have the following roles: ...
115 views

### Jumblar: Using map locations as passwords

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) ...
97 views

### BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
139 views

### Ideal system for an encryption scheme

What is the ideal system for an encryption scheme? For a pseudorandom permutation the ideal one is a random permutation, for a pseudorandom function the ideal one is a random function. For an ...
131 views

### Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
164 views

### Complex Numbers on Elliptic Curves & Usage in Tate Pairing

I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of ...
127 views

### How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
180 views

### How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
94 views

### Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
82 views

### Predicate Encryption supporting disjunctions

I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
270 views

### One-time pad and perfect secrecy properties

I have a homework problem: Explain how to find $m_{0}$ and $c$ such that $P[c=c': k \leftarrow K, c' \leftarrow E(k, m_{0})] > 0$ where P is probability and k is chosen uniformly. I do not know ...
149 views

### How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
99 views

### Prevent/minimize replay attacks in public message board

Assume we have a public message board where anyone can send a message to. If plain messages are used, anyone can impersonate anyone. The goal is to disallow impersonations. We can use public key ...
255 views

### Creating colliding x509 certificates: Crafting RSA moduli step

I am trying to generate 2 x509 certificates with the same signature but different values in the common name field, based on md5 collisions, as it was specified in this paper (page 7). Now I have ...
218 views

### elgamal based decryption mixnet

Can anybody help me to understand elgamal based decryption mixnet? Pure elgamal can be used in mixnet (re-encryption mixnet) and its very easy, and I have implemented decryption mixnet using RSA also. ...
2k views

### Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
647 views

### Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
216 views

### Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
111 views

### Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
127 views

### Computer appliance protocol

I build the computer appliance system that consist of software server and multiple controllers. The system I want to build must be pluggable in the sense that when I connect a controller C to the ...