1
vote
1answer
65 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
1
vote
1answer
109 views

Privacy-Preserving relational databases: checking the existence of a record (or multiple records)

I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion: User $U$ wants to know whether a record is stored in the database. The primary ...
1
vote
1answer
70 views

Comparing Difference Distribution Tables

I have been studying the Diff. Cryptanalysis and finding it hard to do a problem. The problem is I have calculated the tables programmatically and found that the second table has a max value of 6 ...
1
vote
1answer
97 views

EAX: OMAC and CMAC

OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2? If it is OMAC1, does that mean it ...
1
vote
1answer
143 views

Recover plaintext from truncated ciphertext using AES for FPE

I am trying to implement an FPE for a 19-digit long number. I am trying to follow the lecture of Prof. Dan Boneh and here is how I understand it: Get the nearest power of two greater than $10^{19} ...
1
vote
1answer
113 views

Rainbow tables, where have I got it wrong?

There seems to be some error in my understanding of the concept of rainbow tables, despite going through quite a bit of articles on it. Let me show what I don't seem to agree with. My plain text is ...
1
vote
1answer
174 views

Decrypting an Affine Cipher with known characters

I am trying to cryptanalyse multiple cipher–texts that I know are encrypted by different Affine ciphers. I have already analysed the frequency that each character occurs, and compared it to a ...
1
vote
1answer
70 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
1
vote
1answer
93 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that ( length($p$) == length($q$) )$\implies$ gcd$(pq,(p-1(q-1)))$=1 where length($k$) = # bits in ...
1
vote
1answer
260 views

CBC-MAC length extension attack with IV simulation

I'm doing Matasano's challenges and struggling with second part of 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV manipulation. There is a hint that I can ...
1
vote
1answer
85 views

Does OpenTSA support PKCS11 to talk to HSMs?

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA wanted to know: Does OpenTSA support PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
1
vote
1answer
132 views

How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
1
vote
1answer
110 views

Large text file encryption per line

Some background: I receive data in text files of over 16 million records (lines). I need to be able to encrypt the first column in that file so that it cannot be deciphered. This process will be ...
1
vote
1answer
77 views

Pohlig-Hellman Algorithm: Adding up the solution via CRT

I have a question about the Pohlig-Hellman Algorithm for the discrete log problem. I understand the concept, but doing the exact calculations I get confused at one point; to illustrate, let's look at ...
1
vote
1answer
146 views

Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA-256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the number of bits in $W(i)$ keep ...
1
vote
1answer
100 views

Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
1
vote
1answer
51 views

Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be ...
1
vote
1answer
74 views

Non-commutitive and nonassociative algebraic structures in cryptography

Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ...
1
vote
2answers
87 views

Sender and receiver having different moduli conflicts with encryption and signing in RSA

I should implement a security protocol as a part of which I need to: Encrypt the message with receiver public key. Sign it with my private key. Send it to receiver. Suppose that the system uses a ...
1
vote
1answer
60 views

Must the ciphertext be longer than the key for symmetric encryption?

I am planning to encrypt the different fields of a database independently, using a symmetric encryption scheme (probably 3DES). Since some of the fields are as small as an integer, may that be ...
1
vote
1answer
185 views

How (in)secure is a signature based on DSA with DSS1 (SHA1) in reality?

As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question). I’d prefer DSA over RSA in my ...
1
vote
1answer
47 views

server aid secure equality test

The scenario is like this: $P_1$ has $m_1$, $P_2$ has $m_2$, they want to compare whether $m_1=m_2$ via the server $S$. After the protocol, only $S$ knows the result, and there is no interaction ...
1
vote
1answer
43 views

Question about block erasure codes

I have a question about linear block erasure codes that are described in this paper. I briefly describe the idea behind the linear erasure codes and then I ask my question. Given a set $d=\langle x_i ...
1
vote
1answer
193 views

PBKDF2-SHA512 - Does a Big Salt Decrease Security?

I use PBKDF2-SHA512 with an iteration count of 128,000 to hash my passwords. I use a CSPRNG to generate a salt per password. However, I am unsure about the ideal size of the salt. I have read a lot of ...
1
vote
1answer
76 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
1
vote
1answer
62 views

Problem with anonymously merging information from distributed sources

Some Background: There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
1
vote
2answers
165 views

weaknesses in ElGamal with public key of small order

Suppose $p=29$, $\alpha = 2 \in F_p^*$ is a generator of $F_p^*$. Bob picks $d \in \{2,...,27\}$ such that $\beta = \alpha ^d=28 \pmod{29}$. He then sends his $(p,\alpha ,\beta)$ to Alice who herself ...
1
vote
1answer
396 views

Complement property of DES

I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$). My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial ...
1
vote
1answer
106 views

Common password derivation function for different encryption methods

I'm writing a simple encryption/decryption library which has the following requirements: For key derivation functions, support: $SHA256 \rightarrow bcrypt$ (since $bcrypt$ limits input passphrase ...
1
vote
1answer
80 views

Prefix property for variable length pseudo-random generators

I'm currently working through Katz & Lindell's Introduction to Modern Cryptography. In section 3.4.2, they introduce the definition of a variable output-length pseudorandom generator $G$. The ...
1
vote
1answer
50 views

Knapsack Public to Private (Superincreasing knapsack)

I need to convert a hard knapsack to a superincreasing knapsack. I have these superincreasing values (3,6,11,22,43,87). I also have w = 7 and n = 173. I converted the superincreasing values to hard ...
1
vote
1answer
106 views

Ed25519 with R replaced by H(RAM)?

Ed25519 signatures consist of $(R, s)$, where $s = r + H(RAM)a$ $mod$ $l$, and $R = rB$. This differs from the Schnorr signature where instead of $R$, the signature contains the hash $h=H(RAM)$. ...
1
vote
1answer
186 views

Building a stream-cipher out of a hash function?

I've already read this: Is it feasible to build a stream cipher from a cryptographic hash function? However, my proposed construction differs… Suppose the hash generates N bits. These bits are split ...
1
vote
1answer
53 views

Send a symmetric key generated by one user to other users (more than two) using a server

I am developing a software in which I am using AES for encrypting messages shared in a group. The key is generated by one user, the admin of the group and needs to be shared with other members. How ...
1
vote
1answer
336 views

Value of “counter” when decrypting AES in CTR mode?

If – when using AES in CTR mode – you decide to use the setup where you combine the IV and the block count value into a single value, as suggested here, the first 12 bytes are your IV and the last 4 ...
1
vote
1answer
95 views

Low level explanation of how a message is sent via RSA

I understand that RSA encryption uses this formula: C = M^e (mod N) public key is e and N N is pq - p and q are private key. mod N makes above function one-way ...
1
vote
1answer
79 views

Key exchange if forward secrecy is not an issue

Let's say that we have a cryptosystem where Forward Secrecy and Man-In-The-Middle attacks are not an issue, purely hypothetically. Would it be correct for a key exchange with any given public-key ...
1
vote
1answer
100 views

Encrypt HDD with keyfile and password and allow backing up the keyfile with secret sharing

I want to: Encrypt my whole HDD with a keyfile and a password (meaning that both are required to decrypt it), Be able to back up pieces of the keyfile in several distant locations using Secret ...
1
vote
1answer
104 views

DH key exchange with only one end authenticated

We know there is a man in the middle vulnerability with unauthenticated DH key establishment. And the way to negate that is to use authenticate the keys used. But what if I only verify the signature ...
1
vote
1answer
66 views

Symmetry between a public and a private key

I know that the private and public key in assymetric cryptography are different and the public is used for encryption while the private for decryption. My question is if they are symmetrical to each ...
1
vote
1answer
59 views

Can N, q be shared for multiple users when using SRP-6A

Is it considered bad practice to use the same N and q parameters for all users in an SRP-6A based authentication system? I know that q MUST be a Sophie Germain prime and N a safe prime, but can they ...
1
vote
1answer
74 views

Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some ...
1
vote
1answer
35 views

Why Distance-128 relation in Plain texts is reflected in Cipher texts

The two text having relation as "\x10\x11" → "\x90\x91" (80+10) will have relation after encryption/decryption also in RC4. Following code clearly describes the problem I am mentioning. ...
1
vote
1answer
92 views

Question about dual system encryption

Recently, I have been reading some dual system encryption papers. In these systems, is the adversary able to generate “semi-functional ciphertexts”?
1
vote
1answer
122 views

Does AES 256 really make sense in hybrid crypto systems when the PKI is the bottleneck?

AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to keylength.com a 2048 bit public key corresponds to 112 bits of security. Does it make sense to use AES 256 in this ...
1
vote
1answer
108 views

AES and One Time Passwords

I have used AES to secure my short term wireless network(1 day lifetime). The same symmetric key is used for securing entire network traffic. is it possible to improve security with onetime password ...
1
vote
1answer
92 views

Do I need two keys for AES CBC and HMAC or can I use the same key for both operations?

I am setting up a Python program to encipher messages on the following basis: -from my password, generate 32-byte key from SHA256(password) -generate a 16-byte IV from a PRNG -measure the length of ...
1
vote
1answer
90 views

Can we parallelize the Feistel Networks?

Classic Feistel Networks and various types of FN's are sequential in nature. [1]has a good overview of different types. But is there a way we can do Feistel Networks in parallel and achieve good ...
1
vote
1answer
135 views

Which homomorphic encryption scheme has the same size of plaintext space and ciphertext space?

I want to pre-compute the result for all possible ciphertext of a homomorphic encryption. Is it acheivable? Is there a fully homomorphic encryption scheme that has the same size of plaintext space ...
1
vote
1answer
78 views

Is it possible to deduce the IV from CBC ciphered data, without knowing the key?

The question came up here, which left me thinking: Is it possible to deduce the IV from CBC ciphered data, without knowing the key? And if not, why is it considered a bad idea to create an IV by, for ...

15 30 50 per page