2
votes
1answer
397 views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
1
vote
1answer
185 views

Determining message given cipher-text and public key [duplicate]

Consider the following scenario: Suppose A and B have set up their RSA public keys, namely $(e_a, n)$ and $(e_b, n)$, where the n-value is the same. Also, it happens that the $\gcd (e_a, e_b) ...
0
votes
1answer
128 views

RSA: Fermat-Euler Theorem - coprimality of message and modulus [duplicate]

I understand the implication of the Fermat-Euler theorem and how it applies to RSA and the detailed explanation by user Ninefingers at What is the relation between RSA & Fermat's little ...
0
votes
1answer
73 views

Signature scheme doesn't seem to hold

I can't seem to verify the signature scheme described below. Key Generation Public Key: $$y_1=g^{a_1}y^{a_2} \pmod p$$ $$y_2=g^{b_1}y^{b_2} \pmod p$$ $g$ denotes a generator of $Z_p^*$ and $y$ ...
-1
votes
1answer
92 views

What does $\mathbb Z_p^*$ contain?

I have a prime $p = 7$ and was tasked to select a random value in $\mathbb Z_p^*$ in my signature scheme. What does the full range of $\mathbb Z_p^*$ contain in this case? Is it $\{0...7\}$ or ...
2
votes
0answers
157 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
-1
votes
1answer
103 views

Why is g is less than p in Diffie-Hellman?

In non-authenticated DH, p and g are made as public record. p needs to be a large prime number and g should be smaller than p. Why does g need to be smaller than p?
0
votes
4answers
236 views

Why do we need to compute message digest of a message first while signing it?

Why it is more efficient to compute a message digest of message and digitally sign it then, rather than sign the message directly?
1
vote
1answer
109 views

What is the value of Q such that Q|P-1 where P is a prime number?

For my crypto assignment, I'm asked to enter a prime P and generate Q such that Q|P-1 Can anyone guide me what is Q|P-1?
7
votes
2answers
2k views

Which attacks are possible against raw/textbook RSA?

The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5). ...
2
votes
1answer
109 views

Random Permutation polynomial

I need to know, please: (1) Is there anyway to pick uniformly at random permutation polynomial in a field of prime order? (2) Are there many permutation polynomials in a field? (3) In a finite ...
0
votes
1answer
57 views

Available programs that can verify the working of a simple substitution cipher

Is there any tool available that can test whether a simple substitution cipher is working. I will put my scenario in detail. Lets say I built a simple substitution cipher that maps 8 bit data to 16 ...
4
votes
1answer
499 views

Are there some problems to use pseudo-random number generator in Smart Card?

A Smart Card is a kind of secure device, with limited storage capacity and computational resource. If we use a Pseudo-Random Number Generator to generate random numbers in a Smart Card, then is there ...
0
votes
1answer
235 views

Repeated XOR decryption [closed]

I have this message in Hex: ...
0
votes
1answer
171 views

Davies-Meyer Hash Function

So the Davies-Meyer Hash Function is: Hi = Hi−1 ⊕ exi (Hi−1) Say I pick H0 = 1110 0011 And the message x1 = "5" or "0000 0101" Is this the correct way to compute H1? H1 = 1110 0011 ⊕ (0000 0101 ⊕ ...
3
votes
3answers
209 views

Zero Knowledge Example using discrete log

I've been exploring Zero Knowledge Proofs and while the classic cave example by Jean-Jacques Quisquater makes sense, I find the discrete log example problematic. Since the Verifier is given p, g and ...
0
votes
2answers
224 views

Is it possible to decrypt the entire message with one half of the key in this example?

In this scheme, a 256 bit key is split into two 128 bit sub-keys. Message blocks are 256 bits and are also split into two sub-blocks. Before encryption, each sub-block is xor'd with it's partner and ...
0
votes
0answers
161 views

Is it possible to add OpenSSL engine for a block algorithm with different input and output block size?

I need to add a new symmetric cryptography algorithm to OpenSSL, and I thought that the best way to do it is via its engine API. This algorithm will later be used by an application via the OpenSSL ...
6
votes
2answers
965 views

What does “circuits” mean in Cryptography?

I am not a hardcore cryptographer so this might be a really stupid question. I am looking through some papers in homomorphic encryption and discovered they describe computation as "circuits", why do ...
1
vote
1answer
543 views

Cracking secret key of a MD5 hash?

I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). ...
2
votes
0answers
84 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
3
votes
2answers
451 views

Proving that a function is not invert-able (one way function)

I am having problems with proving if the one-way function (http://crypto.stackexchange.com/tags/one-way-function/info) is hard to invert or not. $2^\sqrt {m} $ one-way function $ f: \{0, 1\}^{2m} ...
0
votes
1answer
349 views

Encrypting with Davies-Meyer hash function scheme

So I need to to illustrate Davies-Meyer hash function for a message “123” with 1-byte blocks. I can use the extended ASCII representation where each character is represented as a byte. And I can pick ...
7
votes
3answers
578 views

What is the most computationally efficient way of generating pseudo-random permutations?

I have an application in which I need to create up to J randomly shuffled-copies of an array of length N. Then I will have millions or even billions of iterations such that, in each iteration, I will ...
0
votes
1answer
118 views

In RSA, why does Alice's $N$ need to be relatively prime to Bob's $N$?

I was asked this by my professor and I didn't understand the reasoning behind it. If Alice has a the key pair $(p_a, n_a)$ and Bob has the key pair $(p_b, n_b)$, why do $n_a$ and $n_b$ have to be ...
0
votes
1answer
75 views

Understanding Cryptography practically [closed]

I have just undergone a one semester course in cryptography. I was introduced to multiple theoretical aspects, the way several algorithms work, the methods and their stability and so on. Due to time ...
1
vote
2answers
1k views

What is more secure, a ciphertext encrypted with AES-256 or encrypted with 3 different AES-128 keys?

Or better yet, is encrypting a block with 2 AES-128 keys just as secure as encrypting a block with 1 AES-256 key? By the way, I've only recently been learning cryptography stuff; I've made working ...
9
votes
3answers
3k views

Is a die implemented in a physics engine truly random?

So, a fair die throw is really random, not pseudo. So, would a RNG implemented as the result of a die throw in a physics engine (say, Newton, Havok, Nvidia's PhysX) be regarded as both ...
3
votes
1answer
98 views

NIST implementation of the Lucas primality test

The NIST standard FIPS 186-4 describes an implementation of the Lucas primality test in section C.3.3. I can follow the algorithm but I am puzzled by step 6.2: ...
2
votes
1answer
326 views

Square roots, prime factorization

I´m stuck in my homework and since its homework, I would rather get some hints than full solution. The problem goes: factorize n = 88416763 in case that you know that the square roots of 51733469 ...
2
votes
0answers
115 views

Timing Attack on OpenSSL by Brumley

I am referring to this paper by David Brumley and Dan Boneh: Remote Timing Attacks are Practical (In proceedings of the 12th Usenix Security Symposium, 2003). In this paper on page 4, Brumley ...
1
vote
1answer
80 views

The use of the term “sound” in cryptography [closed]

We often see the term "sound" in cryptography. What is the sense of this word ? Thank you.
1
vote
1answer
120 views

Is SEAL 3.0 broken?

I'll like to know if SEAL 3.0 (cf http://web.cs.ucdavis.edu/~rogaway/papers/seal.pdf) is broken. I stumbled on Bernstein's website that claimed that SEAL 3.0 has been broken. (cf ...
0
votes
2answers
198 views

Cryptosystems used to generate public key certificate

Where can we find the cryptosystems used to generate public key certificate? Are the cryptosystems under the signature algorithm and signature hash algorithm? Do I need to analyze the packets ...
0
votes
1answer
307 views

RC4 encryption/ decryption with hashing

I am working on RC4 encryption/ decryption algorithm based on the following: A wants to send M to B, for that A did: H = Hash (K||M) C = Ek (M||H) A sent ...
2
votes
0answers
145 views

Multi-round Transposition/Playfair as a secure hand cipher in the computer age

Given that computers can be easily compromised, there is a need for a hand cipher that can withstand computer attack. Clearly the traditional hand ciphers fail. One time pads work. They also have ...
1
vote
1answer
97 views

Is $(f(X), G(X))$ pseudorandom?

If $f:\{0,1\}^n \to \{0, 1\}^n$ is a one-way function, $G:\{0, 1\}^n \to \{0, 1\}^m$ is a pseudorandom generator, and $U_m$ is the uniform distribution over $m$-bit strings. Is the joint distribution ...
2
votes
0answers
113 views

Using same key for encryption and ECBC-MAC k2

ECBC-MAC: $E_{k_2}(CBC-MAC_{k_1}(m))$ If we use same key for encryption (CTR or CFB) and k2 (end tag encryption) in ECBC-MAC in encrypt-than-MAC sheme, is it secure?
2
votes
0answers
65 views

How good is middle cube method with jumbled digits?

I had to make my own prng for a stream cipher for an inter school science project (I am mentioning that a lot). So I thought of cubing the seed instead of squaring it (like in the middle square ...
2
votes
1answer
107 views

Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
1
vote
0answers
240 views

Brute Force AES Calculations

I have an encryption service in which the user decides the length and the type of key, so I would like to build a tool that educates the user on the brute force times for the key they created if using ...
1
vote
2answers
413 views

Is splitting AES ecrypted data safe?

Say I have a key, an iv and an AES/GCM/NoPadding encoded string and I want to split this information between three people such that only jointly can they reveal the ...
2
votes
1answer
185 views

AES mix column stage

In a PDF related to AES algorithm for mix column stage is written: The multiplication mentioned above is performed over a Galois Field. The mathematics behind this is beyond the scope of this ...
1
vote
2answers
252 views

Can DH_anon really be exploited by an attacker?

General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run ...
0
votes
1answer
93 views

Showing that $2^{N-1}\equiv1\pmod N$ when $N=2^p-1$ for prime $p$

I got this question on a previous exam and I got it wrong. I've gone back through it several times since then, but I can't seem to get it. I would really like to know how to do it, so if someone could ...
1
vote
1answer
404 views

File format of an $2048$ bits RSA public key

From here, there are $14$ bytes specifying the file format of the key. I am still quite confused about the format bytes. For example, the following public key 30 82 01 0a 02 82 01 01 00 8e a3 d1 c7 ...
1
vote
1answer
76 views

Is Paillier cryptosystem commutative?

Is Paillier cryptosystem commutative? If not, how can we construct an oblivious decryption protocol based on Paillier?
0
votes
0answers
86 views

NRPAD and FPAD padding schemes (Korean Seed?)

I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding ...
0
votes
1answer
80 views

Complexity of preimage resistance

Why is the complexity of pre-image resistance $2$ raised to the power of $n$? I have been looking in everything lecture about pre-image resistance, but I still didn't know the answer.
1
vote
1answer
244 views

How do I safely anonymize/hash a unique identifier to protect privacy?

I am building a system to collect a unique identifier (MAC addresses from 802.11 probe requests). The system will have several collection points over a large area, submitting to a central database. I ...

15 30 50 per page