# All Questions

206 views

### Is there an efficient way to hide the encrypted plaintext length with a block cipher?

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
464 views

### Generate an insecure public / private key pair

I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods. As far as I know PGP ...
329 views

### Questions about proof of correct encryption in the Paillier cryptosystem

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ...
190 views

### Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, ...
117 views

### How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
838 views

### How to break AES CBC with PKCS#5 padding?

If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?
334 views

### ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
153 views

### Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
192 views

### Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
205 views

### Comparing plaintext to contents of ciphertext

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer? Encrypt the plaintext and compare ...
538 views

### What's a good P to use in ElGamal key generation?

I need to generate a 1024 bit ElGamal key on Android, and key generation takes forever (~10 minutes on a Galaxy Nexus), I suspect because it take so long to generate a safe prime. Is it dangerous for ...
117 views

### Is it safe to hold key file's hash in application

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)? Thanks
335 views

### Is it considered insecure in an HOTP implementation to publicly provide the next counter?

I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
1k views

### Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
488 views

### Several questions about Paillier cryptosystem

I have several questions concerning the original Paillier cryptosystem as described in Paillier, Pascal (1999). "Public-Key Cryptosystems Based on Composite Degree Residuosity Classes". EUROCRYPT. ...
172 views

### In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
269 views

### Finding a solution to a (sort of) discrete logarithm by asking questions

Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded by $log$ $n$. Let $g$ be a generator of the unique ...
403 views

### DGK Cryptosystem Encryption Speedup

Following @poncho's nice clarification of the RSA speedup here, let's see if I'm able to do the same in the case of the DGK cryptosystem: We have pk = (n, g, h, u), sk = (p, q, $v_p$, $v_q$) which ...
10k views

### OTP from Sony BIOS password recover [closed]

From Dogbert's blog: Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the ...
109 views

### Educational videos for security topics [closed]

Is there anything like the famous "sorting out sorting" video in cryptography/security. I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
79 views

### Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
200 views

### RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
783 views

### HASH Algorithm for 8 bits MCU

I need to implement the HASH algorithm (MD5 & SHA-1) on an 8 bit MCU. I hear it can only be implemented on 32bit and sometimes 16bits MCU. Is that possible? I will appreciate link where possible. ...
287 views

### How does the energy consumption of the SHA-3 finalists compare?

I am curious, is there any paper where SHA-3 competitors are compared in terms of energy efficiency?
536 views

### Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
705 views

### Hash or encryption function for challenge-response protocol?

Say I have an authentication protocol where the shared secret is never transmitted. The server passes a challenge to the client and the client calculates a response using an algorithm where the ...
893 views

### Verilog simulation of Data Encryption Standard

I interested in developing DES(in verilog) for my college project.Can i get help in understanding the simulation results of DES encryption and decryption ? thanks in advance .
339 views

### Are there reference implementations of ECQV implicit certificates?

I am interested in exploring ECC implicit certificates, specifically using the ECQV protocol. While the actual implementation would not difficult to perform using building blocks provided by most ECC ...
37 views

### Why are the first 4-6 characters from ssh-keygen (RSA) the same everytime? [duplicate]

New to StackExchange, so please bear with the newbie. At my current job we are often creating many ssh keys with ssh-keygen (RSA). One thing I have noticed is that the first few characters (say the ...
26 views

### How about a homomorphic integer sorting in a MPC context?

I want to implement the ATV-FHE scheme as described by Adriana López-Alt, Eran Tromer, Vinod Vaikuntanathan: On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption ...
27 views

### David Chaum's anonymous credential

I am a newbie in cryptography (I know the basic RSA, AES stuffs) and am interested in anonymous authentication systems. Looks like David Chaum is the godly figure in the field. I see lots of people ...
8 views

### What's the perfect chain length : number of chains ratio for rainbow tables?

I'm building a SHA-1 rainbow table to crack basic passwords (i.e. up to 10 character, 0-9,a-z). But I can't seem to calculate that golden ratio that would give me the most coverage. Also is there ...
39 views

### Multiple levels of encryption

Is it feasible to have data encrypted at different levels? I'd like to encrypt an xml database (such as used in www.keepass.info) whereby two keys can exist: Key #1 decrypts the entire database ...
16 views

### Reference AES-NI assembler code for AES-128-GCM? [on hold]

I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use ...
28 views

### Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
43 views

### How to compare the efficiency of public key cryptosystems, i.e., RSA vs El Gamal?

As part of my Mathematics degree I'm taking a Discrete Mathematics module which partially covers Public Key Cryptography but does not at all enter it in depth. I'm currently working on a project that ...
13 views

### Are there any real-world E-voting systems in use with the Paillier cryptosystem?

There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?
32 views

I've read the following paper and have one question on it. M. Luby and J. Staddon, "Combinatorial Bounds for Broadcast Encryption", EUROCRYPT'98. On page 523 (12th page of the paper) the authors say ...
61 views

### Private and Public Keys

I have a very basic understanding of encryption and the encapsulation process, but for the life of me I can't grasp how public keys and private keys work, how they're made, and how they're exchanged. ...
27 views

### PathORAM with read path eviction

I am currently trying to implement the pathORAM algorithm as describe in this paper: https://eprint.iacr.org/2013/280.pdf The paper states that with high probability, the stash size will be bounded ...
61 views

### Best practises to generate IV for AES-CTR in this scenario

I'm building a cloud storage application that will store files on my servers. I want these files to be encrypted with AES in CTR mode and the key will be always the same. I'm wondering what would be ...
48 views

### Usefulness of ability to calculate $m^{p+q}$ with RSA

I noticed that with only an RSA public key, it is possible/tractable to calculate $m^{p+q} \pmod n$ for any $m$ without knowing $p$ or $q$. Namely, $m^{p+q} \equiv m^{n+1} \pmod n$. (This follows ...
22 views

### how to decrypt hidden text under numbers? [closed]

got a question as follows - how to decrypt below in to letters knowing that crypting language is 469 and it base ofcourse on mathematic. 46781! 9063376290 3222011 677 80322429 67538 14805394, 6880326 ...
32 views

### Can I expand the modular of an encryption scheme?

Take the lifted ElGamal as an example: suppose the original ciphertext is $<g^y ~mod~q,~g^m~mod~q>$. After some calculations, $m$ could be large enough to do modular. But I don't want $m$ to be ...
33 views

### Signing integers and UUIDs and restoring them from a third party server without tampering

I'm educating myself about cryptography. I know this is a long one, but please, bear with me. :) Now I have a scenario in my mind and I'd like to ask if what I've thought is sound (enough), what more ...
34 views

### Discrete logarithms: large prime modulus vs. large semi prime modulus

I have a cryptography homework question, in the question it says a cryptographic hash function in the form of $f(x) = g^x \bmod n$ , where $n$ is a very large prime (1024bits and more), $g$ is a ...
33 views

### TPM vs. Trusted Execution Environment

I have read some content on trusted execution environment, and I like to ask exactly how it improves hashing. What I read at Wikipedia’s “Trusted_Execution_Technology” article states: ...PCRs) ...
59 views

### (Lightweight) Multicast one-way Authentication

Problem: I'm thinking about a lightweight solution to provide source authentication (only one source) to multiple receivers (multicast message). Context: Taking the problem to ground, we can think ...
A lot of definitions for semantic security make use an experiment $\text{Exp}$ which is performed between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ that begins as follows: ...