3
votes
1answer
357 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know $...
3
votes
1answer
190 views

Derive a public EC key from two public EC keys

Alice has two EC key pairs: $a_1$, $a_2$ are private keys (integers), $A_1$, $A_2$ are the corresponding public keys (points). Alice and Bob want to create a new public key $C$. Alice must prove that ...
3
votes
1answer
140 views

What security differences are there between E(p',“well-known-plaintext”) vs. hash(p') where p'=KDF(p)

I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived ...
3
votes
1answer
132 views

md5sum collision question

I've been reading the wikipedia page, trying to get a better understanding of how to produce a collision. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities The wikipedia page above states: "...
3
votes
1answer
397 views

Should new applications still use RSA? Is it worth going down the ECDH route for protocols?

I am currently designing an application for communication between two and more users. At the moment I am trying to figure out what methods to use for the asymmetric cryptology. With the recent "...
3
votes
1answer
268 views

Key exchange and man in the middle issue. Secure solution

I am trying to design MiTM protected key exchange algorithm. For instance I am using RSA asymmetric keys. Alice and Bob respectively have each their own pair of keys. And they should be able to ...
3
votes
1answer
339 views

iOS Data Protection: What is the Input of the LFSR?

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine, which uses the key to encrypt the file ...
3
votes
1answer
478 views

Explain the 'Breaking 104 bit WEP in less than 60 seconds' paper

Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details. Could you an answer questions, like: how is '1.24/256' a significant ...
3
votes
2answers
182 views

Why do fully homo-morphic constructions use 'ring' or 'lattice' structures?

Is there a significantly advantage to these data structures, or is it simply the status-quo and the easiest to use for describing constructions?
3
votes
1answer
76 views

Modes for encrypting small binary blobs?

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a ...
3
votes
1answer
72 views

Applications of 3-collisions

I recently read Improved Generic Algorithms for 3-Collisions by Joux and Lucks (Asiacrypt 2009), available as http://eprint.iacr.org/2009/305.pdf. I was wondering about applications of this technique (...
3
votes
1answer
4k views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
3
votes
1answer
420 views

Elliptic curve parameter generation

I am curious of the details of how one would go about generating elliptic curve parameters. (I know standardized parameters exist, but I'm trying to understand both how they were generated and the ...
3
votes
1answer
482 views

Clipper chip (SKIPJACK) key exchange protocol

According to the Wikipedia page for NSA (emphasis mine): However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ...
3
votes
1answer
46 views

Distributing blocks with validation and non-dependant list generation

Problem Suppose I have a system of nodes that can communicate with a parent node, but not among each other. Suppose then a file on the parent node is split up into blocks and divided among the ...
3
votes
2answers
897 views

one-time pad key related attack [duplicate]

In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
3
votes
1answer
274 views

Any historical accounts of cryptanalysis of Jefferson's wheel cipher?

David Kahn in his book "The Codebreakers" wrote about Jefferson's wheel cipher, saying that To this day the Navy uses it… (the book was first published in 1967) Are there any historical accounts ...
3
votes
1answer
290 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
1answer
316 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
3
votes
2answers
131 views

Distinguish messages

Since i cannot comment on questions, I give my own: If a secret key encrypt algorithm can encrypt messages of arbitrary length and the encrypt algorithm is probabilistic then: suppose the adversary ...
3
votes
1answer
96 views

Data-validating protocol

I have to implement protocol of secure data transfer that can be described as Alice selects data to send from finite set $m\in M$ (e.g. $M$ could be a column of values in database table) Alice ...
3
votes
1answer
384 views

Chaum undeniable signature - justification for probability of misleading the verifier?

Can anyone explain me in details why does the following statement hold true in Chaum and van Antwerpen scheme for undeniable signature? The probability that a dishonest signer is able to ...
3
votes
1answer
237 views

Attack vectors introduced by compilers

I have a question about attacks on the implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would anyone be able to point me to other ...
3
votes
1answer
273 views

Elgamal test vectors

I know that Elgamal algorithms have fallen out of fashion, and they are not included in any widespread cryptographic standard nowadays. However, they are still present in several popular crypto ...
3
votes
1answer
407 views

Security analysis of a matrix multiplication protocol

Suppose Alice would like to obtain the product of two mXm matrices i.e. A and B. Alice has A, whereas Bob has B. Since Alice does not want to reveal A to Bob, she chooses a mXm random invertable ...
3
votes
1answer
174 views

uniquely identify a symmetric key

Is there a safe way to uniquely identify a symmetric key? I know with asymmetric keys you typically use a hash of the public key, but I assume that using a hash of a symmetric key would reveal too ...
3
votes
1answer
327 views

ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse Show how one could exploit an implementation ElGamal signature scheme in which ...
3
votes
1answer
396 views

Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
3
votes
0answers
39 views

Does changing the order of the steps within a round affect the security of AES?

I was trying to understand the internal structure of AES (Advanced Encryption Standard) Standard order of steps within a round: Substitute Bytes Shift Rows Mix Columns Add Round Key Substitute ...
3
votes
0answers
40 views

Attacking Scrypt Under Access Pattern Leakage

Could cache-timing channels (such as exist for certain block ciphers) somehow be made use of in order to extract memory-access pattern information if both the attacker and user are NOT in a shared ...
3
votes
0answers
39 views

Efficiency of oblivious algorithms vs non-oblivious algorithms

Recently, plenty of researchers are looking at designing efficient data-oblivious algorithms. Roughly speaking, an algorithm is said to be data-oblivious if its data access patterns are independednt ...
3
votes
0answers
23 views

How to decrypt the below encrypted messages? [closed]

My friend was experimenting with the encryption methods (self-made) to encrypt text using ASCII map. He wanted to try this idea whether this encryption can be broken and so shared an encrypted text ...
3
votes
0answers
143 views

Inverting a candidate one way function

Let $w = a_0 \cdot a_1 \cdots a_{n-1} $ be a word from $ \{0,1\}^n $, $|w| = n$ Let $m = \sum_{i=0}^{n-1}{ a_i \cdot 2 ^ {n-1-i} } $ be the corresponding binary number constructed from the word. Let ...
3
votes
0answers
40 views

A few questions about CRC basics [migrated]

I am an electronic engineer and have not found it important to consider CRC from a purely mathematical perspective. However, I have the following questions: Why do we add n zeros to the message when ...
3
votes
1answer
67 views

How can I create pre-determined encrypted results?

I want my encryption results to be the lyrics to Star Spangled Banner. The original text I'm encrypting would be, for instance, the menu to a local pizza place. I know what I want my passphrase to be. ...
3
votes
0answers
39 views

How subscriptions are managed in PayTV securely?

Since there are millions of subscriber for each operator in PayTV and each subscriber can subscribe to any of the package or individual channels, how operators transmit Entitlement management messages ...
3
votes
0answers
1k views

Cryptography behind the Turing Imitation Key (TIK)

When browsing the internet I found out about this amazing phone. Well, it would be amazing if it was actually obtainable. It's called the Turing Phone, and it is supposed to come with as good as ...
3
votes
0answers
57 views

Simultaneous 2 way exchange without trusted third party

Stakeholders: Alice - has a message, M containing a secret, SA that Bob wants, where H(SA) is a hash which may be used by Bob to redeem some Bitcoin time-locked transaction sent previously by Alice. ...
3
votes
0answers
62 views

How to select corresponding ciphertext in anonymous Identity-based broadcast encryption

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part. User ...
3
votes
0answers
26 views

What are the practical impacts of Wassenar Arrangement to crypto development?

Wassenar Arrangement limits transport of high-grade crypto hardware/software since decades, if I don't err. What are its practical impacts in that direction? In particular, does it hinder in any sense ...
3
votes
0answers
33 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
0answers
30 views

How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
3
votes
0answers
47 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
3
votes
0answers
54 views

How does the Number Field Sieve find the target number for Diffie-Hellman?

I have read some papers relating to the Number Field Sieve, but I could not figure out how this algorithm helps in Logjam, or even what is meant by the number field. What is this? What is meant by ...
3
votes
0answers
82 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
3
votes
0answers
105 views

XTS and 256-bit data blocks

I am developer of an application that uses XTS with ciphers which use 128-bit blocks (AES, Serpent and Twofish). I now want to use XTS with a cipher which uses 256-bit blocks (Shacal-2). AFAIK, I ...
3
votes
0answers
45 views

Election communication protocol

I'm not a cryptography expert, but this seems like it falls into this area. Imagine I want to design an election system (senate race for example) where I send the exact same ballot of 100 candidates ...
3
votes
0answers
164 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
3
votes
1answer
48 views

How are the IVs of SHA512/256 and SHA512/224 calculated?

This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA512 and SHA384 are the first 64 bits of the fractional parts of the square roots of prime ...
3
votes
0answers
84 views

Elgamal with secret key equal to zero possible?

From various sources (e.g. this paper, page 3), the key generation algorithm of Elgamal samples the secret key $x$ from $\mathbb{Z}_q$, which is identifiable to $\{0, 1, 2, \dots, q-1\}$. My ...

15 30 50 per page