1
vote
1answer
327 views

How can an encryption scheme be indistinguishable with multiple messages but vulnerable to an adaptive chosen-plaintext attack?

In order to be indistinguishable with respect to multiple messages, wouldn't the scheme need to be nondeterministic? How would this then possibly be vulnerable to an adaptive CPA?
4
votes
4answers
490 views

Why $n=pq$ with $p=2p'+1$ and $q=2q'+1$ instead of just $n=p'q'$ for RSA crypto?

For RSA cryptography, we know that the modulo $n$ is a product of two big prime numbers(say $p$ and $q$). However, in some documents I see an extension of $p=2p'+1$ and $q=2q'+1$ with $q'$ and $p'$ ...
5
votes
1answer
346 views

In elliptic curve cryptography, how is “A dot A” computed?

I was just reading Ars Technica's primer on ECC. Somewhere near the middle of the second page, the author introduces the "dot" operation that takes an elliptic curve and two other known points, giving ...
1
vote
1answer
182 views

Are there any protocols that are truly secure from active and passive MITM attacks?

Are there are any cryptographic protocols or algorithms that can prevent active MITM attacks or interference when initiating a new connection to a server or someone you have not exchange keys with ...
3
votes
1answer
128 views

Why is $-1$ an illegal message in the Goldwasser-Micali Encryption Scheme

I'm not sure why in the Goldwasser-Micali encryption scheme with a Blum integer $N$, the message $-1$ is always a illegal message. Can you give me some direction for starting? What is illegal ...
2
votes
1answer
75 views

How to pass an arbitrary signature to a certificate

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However ...
2
votes
1answer
327 views

Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
1
vote
1answer
213 views

How do I sign data that's been encrypted using public key? (RSA)

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation. I thought that I should only ...
6
votes
2answers
371 views

Is encrypting credit card numbers one by one with rsautl secure?

I wish to encrypt credit card numbers one by one using asymmetric encryption on the command line. My current approach is this… Encrypt: ...
2
votes
0answers
76 views

partial-domain permutation and strong assumption

Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
3
votes
0answers
792 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
-2
votes
1answer
226 views

Security of RSA-substitution-RSA

Following on from here, I am unconvinced that encrypting twice with RSA is a waste of time: doesn't it depend on what is placed in-between the two encryptions?. What would happen if a permutation was ...
0
votes
1answer
89 views

Sematically Secure McEliece

I am read the Lemma 2 (pp13) in the paper "Kazukuni Kobara and Hideki Imai: Semantically Secure McEliece Public-Key Cryptosystems –Conversions for McEliece PKC– (PKC 2001)". Related to the question ...
1
vote
1answer
723 views

Hash functions throughput performance [closed]

Without taking into account security, which hash function is the fastest one among the following: MD5, SHA-1, SHA-2 (for various internal size), Keccak, and other… ?
3
votes
1answer
170 views

Generator for Group $QR_{N}$

Let $N=PQ$, where $P=2p+1$ and $Q=2q+1$. $P,Q,p,q$ are prime numbers. $QR_{N}$ is the set of quadratic residues modulo $N$. Please help me to prove $QR_{N}$ is a cyclic group. Note: $QR_{P}$ and ...
15
votes
2answers
9k views

How long does it take to crack DES and AES?

Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second. How long would it take for to recover a DES key, ...
3
votes
1answer
255 views

Fully Homomorphic Encryption over the Integers - Runtime Question

I have a question regarding the paper "Fully Homomorphic Encryption over the Integers" (http://eprint.iacr.org/2009/616.pdf): On page 6 after they set their parameters, it says "This setting results ...
1
vote
0answers
151 views

About Elliptic Curve ElGamal, 3 simple problems I have trouble with

In Elliptic Curve ElGamal, why are a=b=1 always legal for primes whose lengths are no shorter than 11(2) bits long? Is there any reason why the Point at Infinity can always be encoded as (0,0)? ...
3
votes
0answers
175 views

What aspects of information theory are used in modern cryptography? [closed]

In studying modern (and classical) cryptography, many notions from information theory crop up. Unicity distance, min-entropy, compression, encoding, etc. What parts of information theory should be ...
1
vote
1answer
678 views

Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
5
votes
1answer
353 views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
1
vote
2answers
166 views

Would this program be useful in cryptography?

I know nothing of encrypting. I'm not even sure how to tag this. I wrote a program that can calculate this pretty quickly on my macbook pro 2.3GHz IntelCore i7. The two exponents are Mersenne primes, ...
3
votes
3answers
283 views

Is it true, that non-military cryptography appeared in 50's and 60's only thanks to leaks from the NSA? [closed]

I'm not talking about scytale, but encryption like RSA, DES, etc... How did exactly civil cryptography evolve after WWII?
5
votes
2answers
232 views

Is multiplicative secret sharing secure?

I suggested mulitiplicative secret sharing in an answer to another question, but noted that I wasn't sure if it was even secure and was hoping someone would comment on the security. Since no one did, ...
7
votes
2answers
2k views

What does it mean if second half of 8-char string encrypted in 3DES is always identical?

In the recent Adobe passwords leak, presumably encrypted in 3DES ECB, second half of all 8-character passwords is identical: ioxG6CatHBw== Source: http://pastebin.com/iDTFARwq (guesses based on ...
2
votes
1answer
208 views

Transparent cipher

I'm trying to implement this protocol: Alice has her permanent key $K_1$. She computes $E(K_1, P)$. She wants to share $P$ with Bob, Carol and Dave. For each of them she: 2.1. Generates $K_2$. ...
2
votes
1answer
220 views

Can we decrypt in this order when the message is encrypted twice?

If we encrypt a message twice with symmetric key $k_1$ first and then $k_2$ like $E_{k2}\{E_{k1}\{m\}\}$ , ideally we should decrypt with $k_2$ first and then $k_1$ but is it possible to decrypt with ...
1
vote
2answers
843 views

What are monotonic and non monotonic access structures in ABE ?

While reading Attribute Based Encryption Schemes, I did not quite understand what a monotonic access structure or non monotonic access structures are. Is there a popular explanation of those terms ? ...
2
votes
1answer
345 views

Appropriate AES key length for short term protection

Currently I'm doing some initial research for a fully connected distributed network communication model. The context here is a peer-to-peer multiplayer protocol, using a majority-voting system. More ...
4
votes
2answers
90 views

Threshold cryptosystem with a required share

I am trying to find an implementation or variant of a (k, n) threshold cryptosystem (as described here Shamir's Secret Sharing) where we can fix at least one of the k key parts, i.e., instead of ANY k ...
32
votes
1answer
25k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
1
vote
3answers
483 views

random access stream cipher

Some time ago I was working in a pet project for a type of database engine. And I thought about securing the data in disk with encryption.. and since the main code was already developed.. I had a few ...
15
votes
3answers
903 views

What is so special about elliptic curves?

There seems to be sources like this, this also, and some introductions that discuss elliptic curves in general and how they're used. But what I'd like to know is why these particular curves are so ...
1
vote
1answer
122 views

How to design a secure data container?

I want to design a secure data container that can be used to transfer encrypted data over a public network that can defeat common attacks. Data is already encrypted before entering this container so ...
1
vote
1answer
135 views

Encrypted query parameters via HMAC

I have an unsubscribe link, which needs to be passed a customer id, and a product id, producing a query string something like: ?cid=100&pid=2 I would like to ...
2
votes
1answer
770 views

How are IVs used in association with RSA Encryption?

How are IVs used in association with RSA Encryption? Can someone explain why we use them in this RSA context?
3
votes
2answers
555 views

Is this hand cipher any more secure than the Vigenère cipher?

I know that inventing one's one crypto always sucks, but the problem is that hand ciphers are usually very insecure very slow. This is an attempt to make a relatively secure, keyable, and ...
1
vote
0answers
180 views

Diffie-Hellman exchange

So for a Diffie-Hellman problem, I am given the prime $p$ for the Diffie-Hellman exchange. I am also given $g$, secret number for machine as $A$, secret number for station as $B$, a Diffie-Hellman ...
2
votes
1answer
196 views

Elliptic Curve Factorization: Why are elliptic curves suited for this kind of task?

Currently I'm working on a presentation of a paper that talks about the factorization of large numbers. In the paper elliptic curves are presented as a way to factorize large numbers. After hearing a ...
5
votes
1answer
158 views

Matrix key exchange

Given is a square matrix $M$ over a field $F$, we have a key exchange with the following conditions: Person $X$ sends a message to Person $Y$: $C_{1}=AM$, where $A$ is a randomly chosen square ...
1
vote
1answer
132 views

Do per connection random keys solve the stream cipher key repetition issue?

Edits: added then removed additional cases that on reflection seem like a bad idea. In fact, this whole line of thought seems like a complicated way to get a bigger nonce, which might be better ...
0
votes
1answer
2k views

Does ssl_rsa_with_rc4_128_md5 have known weaknesses?

My bank's website uses HTTPS with the cipher suite ssl_rsa_with_rc4_128_md5. What are the known weaknesses of this suite? Do they have a practical impact for ...
3
votes
1answer
308 views

How can I prove/disprove that a construction yields a secure PRG?

Let $G:\{0,1\}^{*} \mapsto \{0,1\}^{*}$ be a secure PRG. Prove or disprove that the following construction also yields a secure PRG. $$G'(k) = G(k||0),$$ where $||$ denotes the concatenation of two ...
2
votes
2answers
145 views

Can you give me an example of any PKC encrytion algorithm with coins?

I'm reading a Definition of Public Key Encryption and here say: ... Enc is a (possibly) probabilistic polynomial time encryption algorithm which takes as input a public key $pk$, a $m\in M$ and ...
1
vote
1answer
225 views

McEliece Public Key Encryption

The definition of Public Key Encryption(PKE) say that: A PKE scheme is a triple of probabilistic polynomial time algorithm (PPT) (Gen,Enc,Dec). The definition of PPT say: In complexity ...
2
votes
3answers
407 views

Can ECB mode really leak some characters?

In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That ...
1
vote
1answer
288 views

randomly generated key reused with XOR

If I have a long randomly generated key (k), XORed with a message (m), but since the message is longer than the key, there is a chance of reusing the keystream with the same message, but the key is ...
0
votes
2answers
307 views

In Elgamal, the generator g is always quadratic non-residue modulo p where p is a safe prime and inverse of g can be also generator?

In Elgamal, the generator $g$ is always quadratic non-residue modulo $p$, where $p$ is a safe prime and the inverse of $g$ can also be generator? Can I prove it? I can't come up with it at all.
1
vote
0answers
216 views

Factoring large numbers

I am trying to factor few integers that are each between 115 and 135 digits long. I have just, little over a month ago, began my study of Cryptography. I was wondering if anyone knew of any efficient ...
1
vote
3answers
2k views

How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera. Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying. In ...

15 30 50 per page