0
votes
0answers
34 views

Outsourced Multiparty computation proof in Ideal world

I need to know in an outsourced two party computation where honst $A$ and $B$ outsource their private and secure data to a malicious server, why we need to design a simulator that interacts with an ...
1
vote
1answer
81 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
3
votes
1answer
98 views

what is the public information in Elliptic curve cryptosystems [closed]

Currently my knowledge about Elliptic curve is quite limited to the textbook and I don't know how a practical Elliptic curve cryptosystem works. I read an example about key exchange using Elliptic ...
0
votes
2answers
199 views

DH with AES - is that an acceptable security scheme over UPnP?

I'm trying to devise a good security scheme to protect comms over Wi-Fi. Right now, I have 2 devices that already communicate via UPnP but I need to secure this communication. I've come up with this: ...
0
votes
1answer
272 views

where should private and public keys be stored? [closed]

I am kind of confused whether should a newly generated key pair be stored in a keystore or in just a normal plain text file? From what I read from online source, there are serveral explainations ...
2
votes
0answers
118 views

SHA3 Keccak, absorbing data to the state

I'm working on implementation of keccak algorithm and have one problem. Tell me please, takeing an example "test": will state (before block permutations, but after padding - pad10*1) look like this: ...
3
votes
1answer
95 views

Second generator for secp256k1 curve

I want to get a group element $h$ on the elliptic curve secp256k1. The important thing is that no one should know the discrete logarithm of $h$ with respect to $g$. That is, $h$ should be created from ...
1
vote
2answers
189 views

Game with symmetric key

Alice and Bob are playing Rock-paper-scissors. Alice chooses $a \leftarrow\{stone, paper, scissors\}$ and a nonce $R_A$ used as symmetric key for encryption $$A → B : A, R_A(a)$$ Bob chooses $b ...
0
votes
0answers
49 views

Role of trusted party in the Ideal model in Malicious case

Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private ...
6
votes
1answer
762 views

Keccak padding implementation, and bit ordering

I am trying to implement Keccak in Java for my school work. And I am getting stuck in two places: On the summary page the padding is shown as P = M || 0x01 || 0x00 || … || 0x00 P = P xor ...
0
votes
1answer
306 views

Timelock puzzle improvment

I came across this question with this answer about a cryptographic timelock-puzzle that needs approximately 30 years to be solved. There is also an explanation with source code for that puzzle ...
0
votes
0answers
65 views

Security of a custom non linear hill cipher

Initially let me state that this is an atypical type of cryptographic encoding. First I break up my key into three parts $k = {W,\overrightarrow{b},\alpha}$. the $W$ is simply a $n \times n$ matrix, ...
2
votes
2answers
826 views

Computing p and q from private key

We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to ...
3
votes
0answers
102 views

Avoiding known plaintext attacks with an additional XOR-Layer

Can a cipher that is vulnerable to an known plaintext attack be made secure by adding an additional XOR-encryption? That is: suppose I have an (w.l.o.g. symmetric) encryption algorithm E were the ...
1
vote
0answers
32 views

AES_GMAC implementation [closed]

I need to implement AES_GMAC encryption and decryption in c/c++ programming language. For the implementation, I have referred following document: ...
2
votes
1answer
70 views

Feldman's VSSS: Showing the Correctness of shares that are Consistent

This is something with which I am struggling to get my head around. In Feldman's VSSS, I am aware that the Dealer broadcasts exponentials $a_{1},...,a_{t-1}$ of the secret $K$ and the coefficients ...
0
votes
1answer
131 views

how does an initialization vector work? [duplicate]

Can somebody please explain how an initialization vector works. My current understanding is that it is used to prevent 2 of the same messages looking identical after encryption, but isn't this the ...
5
votes
4answers
989 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
0
votes
1answer
76 views

Segmenting encryption to get the same results with the same key

The given examples below are dummy and in English. They are mainly for place holding as this is a concept question rather specific example based Given AES has a block size of 128 bit (16 letters of ...
4
votes
2answers
393 views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
2
votes
1answer
160 views

Key Check Value standard pratice for asymetric cryptography?

I'm looking for a standard, or sound industry practice, for the equivalent of a Key Check Value, applied to the private key of a public key algorithm, like ECDSA. For DES or 3DES keys, practice (as ...
2
votes
2answers
114 views

Reciprocal block ciphers

I'm interested in the property of involution in block ciphers and how one would go about constructing one. Creating a cipher where $E_K(E_K(M))=M$ for any $M$ and $K$ isn't an obvious task and the use ...
3
votes
3answers
3k views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
0
votes
1answer
119 views

RSA: How to calculate the private exponent?

I have this problem: In RSA algorithm considering $n=33$ (modulus) and public exponent $e=3$, calculate the corresponding private exponent $d$. I know that $d = e^{-1} \pmod{\varphi(n)}$ and ...
3
votes
1answer
71 views

Optimal bandwidth cost for Oblivious RAM

Goldreich and Ostrovsky show that any ORAM algorithm must have bandwidth cost $\Omega(logN)$, where $N$ is the total number of blocks outsourced. This is in Theorem C of this paper. But they didn't ...
-3
votes
1answer
125 views

XOR = Best encryption? [duplicate]

If you have a TRULY random key (in binary) and you have a text (in binary) that you want to encrypt. Can you simple XOR the key and the text? Is that secure? How secure?
2
votes
4answers
91 views

Definition of the term “key”

I've looked in many places (NIST, text books, online resources) and I cannot find an answer to the definition of the term "key" from a semantic point of view. Is it the "key" to cipher-texts (i.e. ...
1
vote
1answer
116 views

Turning data into seemingly random noise

I am currently working on a python script that does image steganography, altering the least significant bit on each channel of the image. Now imagine encrypting a file with a bunch of null bytes, or ...
1
vote
1answer
303 views

How to create a PEM file for storing an RSA key?

I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$. I want to create a PEM file containing this ...
1
vote
1answer
126 views

Understanding Diffie-Hellman Key Exchange [closed]

Help me understand the Diffie-Hellman Key Exchange From what I understand: Agreed upon numbers: Both parties agree on the value of a large prime number $p$ and a generator $g$. The users each ...
9
votes
3answers
532 views

At what point can you you implement crypto algorithms?

First off, this feels like it should be a common question, so I'm sorry if I've missed an older thread. Note that in my question, I'm talking about "implementing AES" rather than "designing AES2" or ...
0
votes
1answer
81 views

If someone had a list of all primes, would it be possible for them to factor any integer in polynomial time? [duplicate]

For example, if they somehow got a function that would churn out any arbitrary amount of primes in a row. Could they break the RSA problem then?
1
vote
3answers
58 views

“Strict” software for playing and learning with private and public key

my question is just for teaching/learning practice and I think it's not meaningful for the real world. I've played with openssl a lot but from my understanding it's somehow not strict in the format ...
4
votes
0answers
76 views

Missing public exponent

Using LUC RSA, I have a list of 8 public keys $(R_1,n_1)$ through $(R_8,n_8)$, and a list of $8$ messages $M_1\dots M_8$. The messages have all been double encrypted. However, one of the public key ...
4
votes
2answers
337 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
3
votes
2answers
152 views

Does the Paillier system remain secure if it is used to encrypt only binary values, i.e. {0, 1}?

Is there any security compromises if the Paillier system was used to encrypt only binary message in {0, 1}? i.e., plaintexts are either 0 or 1.
2
votes
2answers
93 views

Is it hard to recover $p$ from $k \phi(p)$?

Given $k\phi(p)$, is it hard to recover $p$? Here, $p$ is a large prime, $\phi(\cdot)$ is Euler's totient function and $k$ is an unknown integer. Or what's the complexity to recover $p$ from $k ...
4
votes
2answers
113 views

Discrete logarithm over prime modulo: small input, large exponent, larger prime

I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario. 1) Input ($m$): the input messages are small (16-bit) 2) Exponent ($e$): the ...
5
votes
2answers
244 views

How is HMAC(message,key) more secure than Hash(key1+message+key2)

I understand how for hash functions which are vulnerable to length extension attacks (such as SHA1 and SHA2) it is safer to use a HMAC construction. What I don't understand is, how or why is ...
1
vote
1answer
95 views

Bilinear pairing arithmetic

Is this $e(g^x,g^yH^z) = e(g^x,g^y)e(g^x,H^z)$ expression is true? where $ g$ is the generator and $ H \in G $
1
vote
1answer
47 views

The non-interactive proof of verifiable computation: Pinocchio

I am reading the Pinocchio paper. The paper says, in paragraph "polynomial asymptotics" of section 4.2.1, a worker, in order to include $h(s)$ into the proof, has to interpolate $p(x)$, and then ...
1
vote
1answer
85 views

Renewing session key

I have a system which (should) never shut down, there are keep alive messages every 30 seconds and normal traffic is very variable, might be a few KB/sec might be nothing more than the keep alive ...
1
vote
1answer
42 views

Question about discrete log - why can one attacker not solve for g but two colluders can?

I'm reading about the broadcast encryption described in Fiat and Naor's paper, I screen grabbed the relevant part below. My question is essentially: If there's a secret: $g^{abc}$ $mod$ $A$ (where ...
1
vote
1answer
79 views

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process trasform a message in a curve point? To sign a transaction (message) in Bitcoin system, you need to encode ...
4
votes
2answers
183 views

Non-interactive proof that an element is in a subgroup

I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| ...
2
votes
3answers
258 views

Sage Vs C++(with NTL) for implementing cryptosystems

Is Sage a better alternative to C++(with NTL), for programming that involves math objects like polynomial rings in cryptosystems? I hear that Sage is an open source alternative to Magma. I have used ...
2
votes
1answer
178 views

Algorithm for n-of-m keys with partial results

Is there any known and proven algorithm which allows n-of-m keys en/decryption, but doesn't require the keys to be in one location? That is, it allows the plaintext (or ciphertext) to be encrypted (or ...
0
votes
2answers
208 views

Why does Diffie-Hellman need be a cyclic group?

Why is Diffie-Hellman defined on a cyclic group? Doesn't it work for any commutative operation which the inverse is hard to find? Say Alice and Bob agree in a public prime $c$ and both choose a ...
1
vote
1answer
346 views

Is encryption time greater than decryption time?

Is encryption time always greater than decryption time for all encryption techniques (AES / DES / RSA / DNA), or is there a mistake somewhere in my implementation?
9
votes
2answers
125 views

Information-theoretic bound on leakage by timing measurement

I'm looking for an information-theoretic bound on leakage by timing measurement. I'm assuming that an attacker wants to leak out of a black box a secret key of $k$ bits that is secretly injected ...

15 30 50 per page