5
votes
2answers
258 views

Extending pseudorandom generator by one bit using exclusive-or of previous bits

Is it possible to have a pseudorandom generator that extends its output by 1 bit by simply appending the exclusive-or of all the previous bits? I know the output of a pseudorandom generator is ...
2
votes
2answers
148 views

How do we find the subkey out of a differential cryptanalysis?

I understand the differential cryptanalysis up to the "finding the last subkey" part. If XORing with the key doesn't change the differentials, how can testing different key affect the equations we ...
0
votes
1answer
76 views

“Kernel attack” on MinRank — why do we guess $\left\lceil \frac k n \right\rceil$ vectors?

The kernel attack on MinRank is described here (page 5). My question refers to this line: Note that if $m = \left\lceil \frac k n \right\rceil$, the system essentially has only one solution ...
9
votes
3answers
3k views

What is the difference between uniformly and at random in crypto definitions?

Very often in the description and analysis of a cryptographic protocol there is a need for a an element $k$ that is sampled uniformly AND at random. Is there a redundancy in the definition with ...
1
vote
0answers
100 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
2
votes
1answer
228 views

How to customize a standard encryption algorithm?

I want to modify and customize AES encryption algorithm and develop a variant of it. What factors should I consider so that it does not become weaker? What skill sets would be required to undertake ...
1
vote
1answer
149 views

Malleability of homomorphic encryption

El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable? Thanks!
0
votes
2answers
253 views

What would be the best plain text Cryptography method without the use of a computer? [closed]

What would be the best Cryptography method without the use of a computer? This could be a list of the current options available, that could be used without the use of a computer ...
2
votes
1answer
196 views

Polynomial division hardware implementation

I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ...
1
vote
1answer
109 views

RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
1
vote
1answer
158 views

N way collision of hashes

For a collision $H(A_1) = H(A_2)$, the number of queries is $T^{1/2}$ where $\log_2(T)$ is length of hash output. Then, what would be the number of queries requried to find an $n$-collision ($H(A_1) = ...
0
votes
1answer
207 views

Base64 with shuffled alphabet

I have a base64 'cipher' text, I know that in clear text is a hidden xml document (I do not know nothing about its structure), but the base64 aplhabet was somehow shuffled. Is there any smart way, how ...
1
vote
1answer
96 views

Looking for a secure PRNG that I can implement in hardware

I'm trying to implement a (sort of) simple PRNG in hardware for fun. My idea would be to allow a user to enter a key using a keypad (or some dip switch settings that can be set and hidden) and to ...
2
votes
1answer
397 views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
1
vote
1answer
222 views

Why do we have fixed output length in the algorithm SHA1

Why do we have fixed output length in the algorithm SHA1 . is there any explanation about that
1
vote
1answer
163 views

RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
2
votes
0answers
212 views

How does Schnorr signature actually work?

I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob ...
1
vote
0answers
53 views

Recovering a constant salt for MD5 [duplicate]

I have STRING and MD5(STRING+SALT) for any infinitely many STRING's. Is their any way that I can recover the SALT itself? (SALT is constant) I actually know SALT, but this is an intellectual exercise. ...
1
vote
0answers
70 views

Crack RSA with imaginary algorithm [duplicate]

I was given a cryptography question during an interview the other day and I couldn't come up with a valid answer. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is ...
3
votes
1answer
352 views

Decrypt all RSA ciphertexts if you can break 1% of them

I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ...
2
votes
1answer
110 views

Reduced message expansion in NTRU

In the original NTRU proposal from 1998, it says on page 16: It may be worth mentioning, though, that there is a simple. masking technique that can be used to significantly reduce message ...
0
votes
1answer
107 views

What are the potential (major) flaws in this security scheme?

It’s been a few years since I read anything involving crypto. I’ve come across this scheme and I wonder how secure it is: Alice generates an RSA keypair (we assume Alice is using proper random ...
3
votes
1answer
118 views

Is xgcd faster than Fermat for calculating $d$ in RSA?

I want to calculate $d$ from $e$ when generating RSA keys. What is faster? Calculating $\operatorname{xgcd}(e,p)$ and $\operatorname{xgcd}(e,q)$ and CRT. Or calculating $e^{p-2}\bmod p$ and ...
2
votes
2answers
120 views

Group description in pairing based cryptography

Suppose we have a public key encryption scheme, in which public parameter contains $(p, G, G_t, e, g)$, where $p$ is prime number, $G$ is a (cyclic) group of prime order, $e:G \times G \mapsto G_t$. ...
-4
votes
1answer
40 views

cipher inside and image [closed]

I have a short cipher of (33) characters , which is only ascii characters. From this information. Is it possible to guess what kind of encryption was that?
5
votes
1answer
198 views

At what point does passphrase strength match the strength of the cipher?

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing: -AES -RIPEMD-160 Hash Algorithm Now let's say that for an arbitrary machine, the ...
1
vote
0answers
69 views

PRG variant as a commitment scheme

I would like to use a PRG in order to achieve the commitment properties (i.e. Hiding and Binding), however, if we look at a general PRG we cannot state that it has the Binding property. First I show ...
1
vote
0answers
226 views

RSA or Paillier is good? [closed]

I want to implement file storage in cloud using homomorphic encryption. I want to use paillier encryption. Can you suggest the drawback of RSA to store and retrieving the files. Then only i can use ...
2
votes
1answer
275 views

2048-bit RSA Decryption

If a message is encoded with 2048 bit RSA. The ciphertext is $M^e mod N$. In some cases, the message is short, $ M \approx 10^{20} $. With a high probability, $M$ can be written as $M = ab$ with $a, b ...
0
votes
1answer
118 views

rotational cryptanalysis on modulo multiplication?

I saw the paper 'Rotational Cryptanalysis of ARX', it is effective against design primitives using XOR, addition, and rotation. http://www.iacr.org/archive/fse2010/61470339/61470339.pdf However ...
0
votes
0answers
97 views

Probability of factoring keys as a function of bit length [duplicate]

kinda new here, I had a question pertaining to someone being able to factor one's RSA keys through the GCD. Anyways the question goes that there are two people: A and B. A makes his/her private key as ...
2
votes
3answers
2k views

Difference between Symmetric and Asymmetric. Is this answer correct, based on a written test?

I asked the following question on a final exam: Symmetric Ciphers (e.g. AES, DES, Blowfish) use up to 256 bit on the best case, which are considered strong against brute-force attacks. On ...
2
votes
2answers
791 views

Proving the semantic security of the One Time pad

Currently hearing a lecture on cryptography, and the professor gave us the definition of semantic security, which is roughly the following (formally not quite complete, but you get the idea): ...
3
votes
3answers
378 views

Statistical properties of hash functions when calculating modulo

When using SHA-1 to hash an input, the result is a pseudo-random number in the numeric ID space $\{0\dots2^{160}-1\}$. Do I loose any statistical property in the result if I use modulo to restrict the ...
0
votes
1answer
83 views

Polynomial Modulus

So I am studying for finals and I came across this problem and I am completely stuck. I would really appreciate someone to clarify on the steps to take to solve these problems. Let $f(x) = x^4 + x^3 ...
1
vote
1answer
91 views

Cocks IBE Scheme: why is -a a quadratic residue mod n?

In the Cocks IBE scheme it is required for the hash function, that the Jacobi symbol of its output and the universally available moduls $n = p*q$ is $+1$, so: $\Big(\frac{H(ID)}{n}\Big) = ...
-1
votes
1answer
110 views

what is the benefit of lcm in cryptography? [closed]

what is the benefit of lcm in cryptography? and what is the effect of lcm on public key? note * lcm = Least common multiple thanks
0
votes
0answers
103 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
1
vote
0answers
164 views

CAST-256 (CAST6) versions or S-Boxes

Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use ...
0
votes
2answers
173 views

Voting system validation

I'm developing an application to run elections. A voting system. I would like to give the ability to the voters to check later if their vote were correct computed/casted. assumptions: each user has ...
2
votes
1answer
162 views

Explanation of the Fiat-Shamir heuristic

The Wikipedia page on the topic (http://en.wikipedia.org/wiki/Fiat%E2%80%93Shamir_heuristic) is completely useless as it only explains what it is and not how it works. I looked at the original paper ...
1
vote
1answer
88 views

Fermats Little Theorem, primitive root [closed]

So I am studying for finals and I am not able to solve the problem: Let $ p = 3 * 2^{11484018}- 1 $ be a prime with 3457035 digits. Find a positive integer $x$ so that $2^x\equiv 3\pmod p$ Any ...
1
vote
1answer
104 views

Does it necessary the public key is prime number in RSA algorithm?

I read some books talk about RSA cryptography but I did not understand something when choosing a public key $e$ Sometimes the condition is $1<e<$$\phi(n)$ Where $\phi(n) = p-1 * q-1$ also ...
3
votes
1answer
155 views

Is a strong block cipher usable as a strong sponge function?

From the literature, it looks like the security proofs of sponge functions depend on how well they approximate a random permutation, Since a block cipher also ideally behaves like a random permutation ...
1
vote
1answer
101 views

CBC-R when IV unknown

I've read the CBC-R description from Rizzo & Duong but am having trouble understanding the sequence of steps that would be taken when the IV is unknown and is not included with the ciphertext. ...
7
votes
1answer
267 views

Looking For Additively Homomorphic Encryption

I have a construction that requires as primitive an Additively Homomorphic Encryption scheme that does not rely on hidden group order, meaning I can't use Paillier. I now have two different ...
1
vote
1answer
58 views

Use of the master key in Delerablée's Identity-based Broadcast Encryption

I'm reading “Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys” by Cécile Delerablée. On page 207, the encryption process needs $\gamma$ which is part of the master ...
0
votes
0answers
123 views

Polynomial Inversion over Galois Field

Hello guys I am looking to calculate the Inverse of a given polynomial in Galois field I have found the little Fermat's algorithm and the Itoh-Tsujii I am getting a bit confused with both algorithm ...
0
votes
1answer
306 views

Timelock puzzle improvment

I came across this question with this answer about a cryptographic timelock-puzzle that needs approximately 30 years to be solved. There is also an explanation with source code for that puzzle ...
1
vote
1answer
78 views

MD-compliant hashes don't really accept arbitary length input, do they?

When people talk about hash functions, they usually say that they accept arbitrary-length input, but if you actually look at the padding (eg MD-strengthening padding), you see it's like ...

15 30 50 per page