2
votes
0answers
20 views

Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
2
votes
0answers
45 views

Does SHA-1 meet the strict avalanche criterion?

Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ...
2
votes
0answers
35 views

How to choose McEliece's parameters?

At the time of this writing, there are 3 sources for parameters for the McEliece public-key cryptosystem out there. The first paper is the original McEliece paper ("A Public-Key Cryptosystem based on ...
2
votes
1answer
37 views

Why should the input value on a DPA attack be non-constant?

I actually was wondering if anyone could help me out with the following problem: Let's assume we are attacking the first SubBytes() operation on AES with the help ...
2
votes
0answers
74 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
2
votes
3answers
104 views

Establishing encryption key using shared secret

I need to establish some security on a network of 8 bit microcontrollers. very limited RAM, CPU and packet sizes. I have zeroed in on a shared secret based scheme. Setting up shared secret is out of ...
2
votes
0answers
49 views

Worst case one way function

the worst-case one way function is defined as follows $$\forall A \exists x : pr(A(f(x))\in f^{-1}(f(x)))\neq 1$$ can you give any example of such function?
2
votes
0answers
24 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
2
votes
0answers
63 views

Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
2
votes
0answers
62 views

DPA Attack on HMAC SHA-256

I have read the paper Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model and I want to understand the DPA Attack. In section 3.2.1 Path 1 (page 4) there is written: The last ...
2
votes
0answers
51 views

Cryptographic enforcement schemes using Diffie-Hellman

If one wants to set up a decentralized cryptographic enforcement scheme in which the level of 'confidentiality' of information is marked by its position in a poset, why not use Diffie-Hellman to ...
2
votes
0answers
32 views

Proposed unidirectional authentication scheme

I've been looking around for a way to authenticate a client to the server and deliver a message, but in a unidirectional fashion - that is, the client sends messages to the server, but the server ...
2
votes
1answer
82 views

Recovering key length from transposition block cipher ciphertext

First of all I would like to say hello to all StackExchange users. So far I've been stalking the forum for some time, now it's time to leave the shadows. In my master thesis I'm writing about ...
2
votes
0answers
59 views

SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ...
2
votes
0answers
59 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
2
votes
0answers
114 views

Simplicity and precision in cryptography papers [closed]

I know a PhD student who recently had his paper on applied cryptography rejected because one the reviewers claimed that it was "the solution was too simple and the notation used was more than ...
2
votes
0answers
62 views

Energy necessary for brute-forcing or decryption

I am trying to understand how the physical limits of computation apply to crytography, and came up with the scenario below as a sort of gedanken. I would be grateful to see how others answer it. ...
2
votes
1answer
139 views

Is this variant of SRP useful?

I'm interested in using a modified form of SRP as a peer-to-peer authentication method. Since neither side is acting as a host, one of the primary design goals for SRP (that the client doesn't need ...
2
votes
0answers
90 views

Proving that a plaintext is the Paillier decryption of a certain ciphertext [duplicate]

Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ...
2
votes
0answers
171 views

Is chaotic encryption secure?

I know this sounds too broad. But I noticed that there was a chapter on chaotic crypto in the recent Handbook of Information and Communication Security Editors: Stavroulakis, Peter, Stamp, Mark (Eds.) ...
2
votes
0answers
71 views

Pseudorandom Function Proof

Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: ...
2
votes
0answers
39 views

During electronic voting, how does one hide the choice from Voting device?

Assume the following: I want to cast a vote during an election through an electronic voting system. For our system we make the assumption that the device one uses to cast the vote is potentially ...
2
votes
0answers
86 views

How to calculate the non-linearity of an s-box?

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
2
votes
0answers
64 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is this What I really need is basic explanation of the ...
2
votes
0answers
62 views

Implementing modular reductions (n*n) [closed]

I'm implementing a public key cryptosystem in a proprietary System On Chip that only allows modular reductions by $n$. However, that cryptosystem requires ($n^2$) modular reductions. Perhaps someone ...
2
votes
0answers
79 views

What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
2
votes
0answers
101 views

What are the well known protocols that offer perfect forward secrecy? [closed]

As far as I know these are the well known protocols that offer PFS TLS/SSL (with DHE-RSA, DHE-DSS, ECDHE-RSA or ECDHE-ECDSA) SSH (RFC4253) OTR (Protocol Version 3 Spec) IPsec (with IKEv1 and IKEv2) ...
2
votes
0answers
71 views

Exponentiation with fully homomorphic encryption [duplicate]

I have often heard that because a fully homomorphic encryption scheme allows for both additions and multiplications on encrypted data, most other operations can be simulated. I don't understand how ...
2
votes
1answer
44 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit? [duplicate]

In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ...
2
votes
0answers
62 views

Is it possible to perform one-way Diffie-Hellman MITM?

Here's something that is bugging me recently: suppose that me and my friend establish an OTR session and - as a result of that - DH key exchange is performed. My friend verifies my key, but I cannot ...
2
votes
0answers
80 views

Performing HMAC with random key before MAC comparison

In Laravel (a PHP framework) I can see that they calculate a HMAC with a random key over the final HMAC before comparison. This additional HMAC calculation is of course performed for both the ...
2
votes
0answers
98 views

Key Recovery Smart-Vercauteren SWHE

In the article (https://eprint.iacr.org/2009/571.pdf, pag 8) of Smart and Vercauteren, it is mentioned that the recovery of the private key is an instance of the small principal ideal problem. But I ...
2
votes
0answers
248 views

Difference between statistical PRNG and cryptographic PRNG? [duplicate]

What's the difference between a statistical pseudorandom number generator (PRNG) and a cryptographic-strength PRNG? I've seen a lot of PRNGs that are proposed for statistical uses -- e.g., ...
2
votes
0answers
63 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
2
votes
0answers
44 views

How exactly is the output of the XOR step in PBKDF2 used?

I'm attempting to diagram PBKDF2 for a school project and I'm not 100% sure how to represent the XOR step. Specifically, I'm confused as to whether the output of the XOR step is used in subsequent ...
2
votes
0answers
102 views

Recovering El Gamal secret key from signatures [duplicate]

Assume out of a set of ElGamal signatures, I've discovered that two have the same y i.e. $signature_{1}$ on $m_{1}$ = $(y,s_{1})$ and $signature_{2}$ on $m_{2}$ = $(y,s_{2})$. The public keys for ...
2
votes
0answers
81 views

Are all binary-additive stream ciphers reciprocal?

I'm writing a thesis focused on Maurer's provably-secure stream cipher. Long story short, this cipher works by expanding a short key into a long keystream and then XORring this keystream with the ...
2
votes
0answers
136 views

How can I start the following crypto project? [closed]

(Cryptography: encrypting files before storage in the cloud): The project consists of a software implementation of a method to pre-process a file before storing it on a cloud storage server so that ...
2
votes
0answers
186 views

Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
2
votes
1answer
354 views

what are the security benefits of LUKS?

Aremed with only basic crypto knowledge, I'm trying to understand the security benefits of LUKS over plain-mode dm-crypt. Hopefully this is a good place to ask. Given the LUKS header contains ...
2
votes
0answers
91 views

Does the SSH protocol preserve integrity if an endpoint is cloned?

I am trying to find out if the SSH protocol preserves integrity of the transferred data in the following scenario: The SSH client is running on a virtual machine, at some point in the middle of the ...
2
votes
0answers
146 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
2
votes
0answers
72 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
2
votes
0answers
94 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
2
votes
0answers
80 views

Multi-round Transposition/Playfair as a secure hand cipher in the computer age

Given that computers can be easily compromised, there is a need for a hand cipher that can withstand computer attack. Clearly the traditional hand ciphers fail. One time pads work. They also have ...
2
votes
0answers
76 views

Using same key for encryption and ECBC-MAC k2

ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$ If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?
2
votes
0answers
52 views

online Vickrey auction using remote coin flip

Is there any published work on implementing a online auction, which uses "remote coin flip" to prevent auctioneer cheating when choosing winner and bid value? Is there any possible way to use remote ...
2
votes
0answers
106 views

How to compute the decompositions used in fast FHE bootstrapping?

Leo Ducas and Daniele Micciancio's recent paper "FHE Bootstrapping in less than a second" gave an exciting result that one can compute the `atom operation' of Fully Homomorphic Encryption (i.e. ...
2
votes
3answers
219 views

Does this guarantee a unique 32 bit Hash?

I came across some source code that loosely does the below in order to achieve a 32 bit hash. The input string is passed through MD5 to get 16 bytes Hash (as usual). Then the 16 bytes are split into ...
2
votes
0answers
59 views

Bridging the gap between security proofs and “real-world” security

I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs ...

15 30 50 per page