6
votes
1answer
1k views

Diffie-Hellman Parameter Check (when g = 2, must p mod 24 == 11?)

I'm adding some Diffie-Hellman groups to a program as specified in RFC 3526, More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE). When I test some of the group ...
1
vote
1answer
137 views

Diffie Hellman Exponentiation Implementation Problem

im trying to work on key agreement schemas on embeded systems. for diffie hellman, ive written a 256 bit multiplication, on AVR core it takes about 2 seconds on 1Mhz frequency, lets say my algorithm ...
1
vote
1answer
52 views

Degenerate discrete logarithm in binary field

Given a field $\mathbb{F}_{2^n}$, are there any choices of primitive element $g$ that make the discrete logarithm easier for that generator? That is, are there any degenerate cases? For example, if I ...
8
votes
6answers
367 views

Mutual verification of shared secret

Is it possible to develop a scheme where two parties, unsure if they have the same secret, can verify that the other does or does not share the same secret, without one party being able to cheat and ...
-1
votes
1answer
44 views

different feistel words in key size

I have confusion on Feistel word in key size. Means, "what is the meaning of key size with different feistel word ?" What does m=2,3,4 represent? Where m represent different size of feistel word or ...
0
votes
1answer
17 views

PK systems using groups in practice

The four Public-key cryptosystems: RSA, ElGamel, DH, and Rabin (all with others) all require some group operations in an integer field or multiplication group of some residue classes. When it comes ...
1
vote
1answer
149 views

SPI security of FE1 scheme

I have a question about security of FE1(Page 16-18) in paper "format preserving encryption". Can anyone explain me, why we are allowed to replace PRF with random function in security proof? And also, ...
1
vote
0answers
64 views

RSA algorithm assignment [duplicate]

Alice wants to share a symmetric key with Bob. She encrypts the small (64-bit) secret key $K$ with Bob’s public RSA key $(n,e)$ by padding it with zeroes to 2048 bits (the length of n) and computing $$...
1
vote
0answers
109 views

seemingly common error with OpenSSL and creating a PKS no certificate matches private key [closed]

I have a JKS store and export a signed cert (from the CSR generated in the store and signed) and the private key - I convert to PEM and attempt to generate a PKS from these two files. openssl.exe ...
1
vote
2answers
2k views

What is more secure, a ciphertext encrypted with AES-256 or encrypted with 3 different AES-128 keys?

Or better yet, is encrypting a block with 2 AES-128 keys just as secure as encrypting a block with 1 AES-256 key? By the way, I've only recently been learning cryptography stuff; I've made working ...
2
votes
1answer
96 views

Are all homomorphic encryption schemes not CCA secure? [duplicate]

Homomorphic encryption is hyped by computer sciences because it offers great potentials. For example you can perform cloud based calculation while nobody gets to know you data. I am wondering if ...
5
votes
1answer
544 views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
1
vote
1answer
110 views

Is one-time-pad still secure if the number of 1's in the key is revealed to the attacker?

For example, if $m = 10011$, $k = 11001$, $n=3$ (which is the number of 1's in k), $c = m \oplus k = 01010$. If $c$ and $n$ are revealed to the attacker, is this scheme still secure?
1
vote
1answer
282 views

Calculating Multiplicative Inverse for Rijndael S-box using EEA

I am currently learning, and I'm stuck on something that I thought is very simple. On many academic sources they suggest using Extended Euclidean Algorithm to calculate the multiplicative inverse for ...
2
votes
1answer
88 views

J-PAKE : About Schnorr NIZK proof for ephemeral private keys

Reading J-PAKE Authenticated Key Exchange Without PKI document : J-PAKE Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g : To prove the knowledge of the exponent for X = g^x1 ...
1
vote
1answer
437 views

Using C_Sign to create a PKCS7 signature

I am using the PKCS#11 function C_Sign to sign some data. The output I get is just a signature. How do I get it in PKCS#7 format - i.e. ASN1 with signature and certificate (for detached) or ASN1 with ...
1
vote
0answers
82 views

AES-Paillier Homomorphic encryption [closed]

How can I implement following problem in java code for addition? (here I use Paillier homomrphic encryption): Input would be to generate a new AES key, encrypt the private data with that key, encrypt ...
2
votes
2answers
1k views

AES + CBC encryption for a stream of UDP packets

I am developing an application that is based on UDP, and I need to send a stream of packets. As you can imagine, packets can get lost or corrupted. I need to make sure that the content of those ...
9
votes
1answer
214 views

How many bits of entropy does an elliptic curve key of length n provide?

A FAQ for an open source project makes the claim: Indeed, an elliptic curve key of length n provides $n/2$ bits of security. I have two questions: What is the practical difference between "...
2
votes
2answers
132 views

Inner product with homomorphic encryption

I want to do a very simple thing: Given two vectors, I want to encrypt them and do some calculation, then decrypt the result and get the inner product between both vectors. I want to do this as fast ...
2
votes
1answer
256 views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors should not be used twice when using AES/GCM. I am using a counter as initialization vector. Every time I send out a new packet (I am developing an UDP based ...
1
vote
0answers
104 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
3
votes
1answer
75 views

RSA: Range of public modulus

I know the public modulus is the product of two primes. For key with length L, the public modulus N should be such ...
6
votes
3answers
551 views

1 Billion Bit Encryption?

So, browsing through YouTube, I stumbled on this video interview of John Draper (Captain Crunch), one of the first "hackers". He talks for about 3 minutes (until 27:48) about his home rolled ...
8
votes
1answer
879 views

If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

IND-CPA is used to protect against frequency analysis AFAICT. But if RSA is only used to encrypt symmetric keys (AFAICT) then what's wrong with using only textbook RSA because random keys are very ...
3
votes
1answer
251 views

Can there be a need for 1024-bit (symmetric) encryption?

I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption. I'll now assume that the results ...
1
vote
1answer
85 views

Modes of Operations Exercise

I am currently stuck at an exercise for my Cryptography Class in University which is: Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). ...
2
votes
1answer
128 views

How does the certificate authority generate a signature F?

E=encrypt(K,M) - is message M encrypted with key K gives encrypted text E M=decrypt(K,E) - is encrypted text E decrypted with key K gives message M KCA−pub,KCA−priv - is the private-public key pair ...
1
vote
1answer
157 views

Reversing Rotation + XOR

I have this cypher which is as follows : Take 2 numbers : A=1011 and B=1010 if the ith bit of A is 1 then shift B i times to the left. So in the end you will get ...
2
votes
0answers
26 views

Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
4
votes
1answer
229 views

Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain ...
1
vote
1answer
76 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
2
votes
2answers
283 views

How can I map arbitrary group elements to unique integers without using Hash functions?

Let's say, I have a group $G$ of large prime order $p$. A set $S$ consists of $n$ random elements chosen from $G$. Without using a collision resistant hash function $H$, how can I map elements of $G$ ...
2
votes
1answer
68 views

Weakening of Pallier cryptosystem due to ciphertext equivalence and order in CryptDB

Pallier Cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or different ...
11
votes
3answers
3k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
7
votes
1answer
1k views

Coefficients in Shamir's Secret Sharing Scheme

Sorry if this is a stupid question, but: in Shamir's scheme, we construct a polynomial and make our secret $S$ the zero-th coefficient $a_0$. What, if anything, necessitates this - in other words, can ...
2
votes
0answers
99 views

Does SHA-1 meet the strict avalanche criterion?

Does SHA-1 meet the strict avalanche criterion? I've been looking for a paper to cite on this, but haven't found one. It's something that seems to be easy to check (in "On the Design of S-Boxes", ...
3
votes
1answer
143 views

RSA with $\lambda(n)$ or $\varphi(n)$

The PKCS #1 v2.0 specifications suggest using $\lambda(n) = \mathrm{lcm}(p-1,q-1)$. What is the benefit of choosing $\lambda(n)$ over $\varphi(n) = (p-1)(q-1)$ in RSA key generation?
1
vote
1answer
136 views

What is the difference between a PRF and a PRF+?

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences. The IKE RFC defines a PRF as: ...
0
votes
1answer
148 views

computational complexity class of decryption of AES [closed]

I haven't really seen what computational complexity class of decryption of AES is. Can anyone provide reference papers or answers here?
1
vote
2answers
123 views

How much pre-hashing a password increase security against brute force attack?

I am wondering how much hashing a password used as key for a symmetric key algorithm helps preventing brute force attack on crypted text. Let's assume I want to crypt text A using key B using AES-...
0
votes
1answer
122 views

Which is the most secure steganography technique? [closed]

Just like we have AES in crypotography, which is the most secure technique in Steganography? I am looking for a technique in which the standard image characteristic modifications it does go undetected(...
0
votes
2answers
542 views

What are the advantages of using OFB (Output Feedback Mode)? [closed]

I have a problem with OFB mode, because I have heard that it is stronger than CFB.
2
votes
1answer
57 views

Could a crypto system that uses non-FIPS crypto but then upgrades complete to FIPS be FIPS certified?

I know most people around here (including myself) are anti-FIPS, but I have a FIPS related question. Could a crypto system that is not FIPS, e.g. one based on primitives like Curve25519, achieve FIPS ...
2
votes
2answers
142 views

Secure symmetric encryption algorithm for any-size base62 data

I am searching for a secure algorithm to encrypt base62 (or any other base) data for ids in urls. It should feature: No blocksize etc, limiting the length of the message to a factor of n If you ...
1
vote
1answer
244 views

What is the complexity for attacking 3DES in linear or differential cryptanalysis?

I know that 3DES is NOT vulnerable to DC , LC . But is it because the attacks requires too many input\output pairs ? Or because it's impossible ? (i.e requires more than 2^64 pair )
3
votes
1answer
94 views

Can I reduce the MAC size in TLS?

The MAC size is reduced to 80 bits in truncated_hmac extension , which says "forging of MAC values cannot be done off-line: in TLS, a single failed MAC guess will cause the immediate termination of ...
3
votes
1answer
54 views

Software interface for KDF and PBKDF?

I'm working on an implementation of Krawczyk and Eronen HKDF from RFC 5869. From Krawczyk's original paper, he identifies four inputs to a KDF in Cryptographic Extraction and Key Derivation: The HKDF ...
2
votes
1answer
80 views

Differential Privacy and appropriate noise distribution

In differential privacy solutions and more specifically for queries that they do entail counting the proposed solutions define the Laplace distribution that is best calibrated for low error. Other ...
1
vote
1answer
316 views

How to prove Security of Onion Layers of encryption?

CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels ...

15 30 50 per page