1
vote
0answers
68 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
1
vote
0answers
127 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
1
vote
0answers
249 views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
1
vote
0answers
65 views

Understanding a faulty Needam-Schroeder protocol

Give this mutual-authentication protocol (along with the attack) in which Alice wants to communicate with Bob, I can't understand how the attack works. A chooses $N$ (nonce) and sends to C (trusted ...
1
vote
0answers
146 views

What are the problems of IKEv1 aggressive mode (compared to IKEv1 main mode or IKEv2)?

I would like to seek confirmation/clarification of the following statements about IKE: IKEv1 aggressive mode is supposed to be “insecure” if used with PSK. But as far as I can see, correct (or more ...
1
vote
0answers
43 views

FFX Encryption over alphabet of arbitrary radix

I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ...
1
vote
0answers
36 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
1
vote
0answers
47 views

What consequences do the plaintext space size has on the performances in the BGV scheme?

In the BGV paper [1], the authors say in §5.4 that you can have $\mathbb{Z}_p$ as plaintext size with a large $p$. What is the impact of the size of $p$ on the ciphertext size and computational work ...
1
vote
0answers
69 views

ElGamal signatures systems

Let $p$ prime number $q/p-1$ prime and $g\in (Z/pZ)^*$ element of order $q$.Also $a\in \{1,...,q-1\}$ the private key and $y\equiv g^a\pmod p$ the correspoding public key.For each of the following ...
1
vote
0answers
46 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
1
vote
0answers
66 views

Why does encryption in STS protocol protect against identity attacks?

The basic STS protocol contains encryption of the signature as shown in Wikipedia. https://en.wikipedia.org/wiki/Station-to-Station_protocol If we would like to defend against MITM attack, this ...
1
vote
0answers
44 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
1
vote
0answers
38 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key encryption material / data encryption material) which is used for example by the (famous) ECIES, where the key is the hash of some ...
1
vote
0answers
39 views

Clarify EC point addition and multiplication

Please clarify the below doubt regarding EC point addition and multiplication: $P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows: $X = (a*P) + (b*P)$ $Y = ...
1
vote
0answers
85 views

Where can I find names for cryptographic notation I don't recognize?

I'm new to this space and find myself stumbling over come cryptographic/mathematical notation. Search engines are not very helpful when copying and pasting Greek letters. Is there any reference that ...
1
vote
0answers
97 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
1
vote
0answers
63 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one ...
1
vote
0answers
31 views

Voting protocol - How many dishonest tallying centres can the protocol cope with?

We have the voting protocol that is described here. I am looking at the following exercise: Determine how many dishonest tallying centres the protocol can cope with before the following properties ...
1
vote
0answers
42 views

Digital signature in a group chat scenario?

I understand that RSA is great for 1-to-1 digital signature. In the group chat of N people, other than storing and maintaining N public keys, is there a simpler way of authenticating each and everyone ...
1
vote
0answers
56 views

Convolution and catastrophic codes

i'm reading the article of Massey and Sain (here) and i cannot unserstand - what is "foreforward inversion"? I mean There is a description of circles in convolutional codes and a little bit ...
1
vote
0answers
79 views

Unicity Distance - AES

I am quite confused calculating the unicity distance and I was hoping that someone can clarify some things for me. My main issue comes from somewhat a difference of the calculation given by our ...
1
vote
0answers
46 views

Correlation attack on Lagged Fibonacci Generator

Say that one uses a known LFG (2 known lags $a$ & $b$, known inner state length $N$, known modulo $m$) to hide some text with a basic à la Vigenère cipher: $C_i=(P_i + {PRNG}_i) \bmod 26$. Say ...
1
vote
0answers
54 views

Elliptic curve point addition

I have this curve in E(F131) : $$Y^2 = X^3 + X + 2 $$ I want calculate the sum P + Q considering that $$P= (5,1)$$ and $$ Q = (60, 49)$$ For calculate the result i use these formulas: $$ xr = ...
1
vote
0answers
127 views

My attempt of combining socialist millionaire and Diffie-Hellman. Is it any good?

I've come up with an algorithm to solve the socialist millionaire problem, but I'm not sure if the algorithm is secure. I wasn't able to find any flaw in it, but it seems too simple to be secure, so ...
1
vote
0answers
41 views

Why does OMAC2 exist?

The specification for OMAC has the following to say about OMAC2: For OMAC2, we adopted u−1 instead of u2 as Cst2. It requires one right shift to compute L· u−1 instead of one left shift to compute ...
1
vote
0answers
61 views

Non-interactive zero-knowledge proof for discrete logarithm without random oracle

Is there any non-interactive zero-knowledge proof for discrete logarithm without random oracle over the group $\mathbb Z_p$?
1
vote
0answers
79 views

Does the encryption algorithm DES perform random permutations? If so how is information not lost?

Before round 1 begins, all 64 bits of an incoming message and all 56 bits of the secret key are separately permuted (shuffled) My question is this : Is the shuffling of the bits performed ...
1
vote
0answers
54 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
0answers
70 views

How do I verify a reset token if the token is hashed in DB?

I've been searching around the web for best practice how-to on secure password reset system (email with reset url), and the idea to hash the token in the database, which I did not implement at first, ...
1
vote
0answers
43 views

Commitment scheme to share money

I have such problem: party $X$ has an amount of money $M$, which it needs to share with $n$ other parties. Every week the amount of money is different. Let say not, that I am a party A, which is one ...
1
vote
0answers
78 views

How to map a handful of numbers in a large range to a much smaller range deterministically without collissions

I want to map a set of long integers (say around 100 different values) that can span the entire 64 bit integer range to a much smaller range such as from 0 to 25000 deterministically with almost zero ...
1
vote
0answers
72 views

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the ...
1
vote
0answers
63 views

Matsui's Linear attack on DES P box

I'm trying to understand Matsui's linear attack on DES and I have something I don't understand in his paper. In his paper he say that: $NS_{5}(16,15)=12$ (which is OK) and from that he say that: ...
1
vote
0answers
55 views

How to securely map an element from an smaller domain to the other element in a large domain

Problem: I have a small sized domain, say s-bit. It's clear that the probability for an adversary to guess an element is $ \frac{1}{2^s}$. I need to make the probability negligible. However, I need to ...
1
vote
0answers
377 views

Montgomery Reduction

I'm taking a hardware cryptography class and working on a problem that focuses on Montgomery Reduction. So by definition: Computing a x b (mod N) Pick R, s.t. R > N, gcd (R,N) = 1 Compute N^-1 ...
1
vote
0answers
50 views

Cache Attacks on Cloud Infrastructures

I read something about cache attacks like this: Enter KSM (Kernel SamePage Merging). KSM enables the kernel to examine two or more already running programs and compare their memory. If any memory ...
1
vote
0answers
47 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
1
vote
0answers
87 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
1
vote
0answers
40 views

Using a Secure RNG in Probabilistic Fair Exchange

I am attempting to implement probabilistic fair exchange described in Probabilistic Non-Repudiation without Trusted Third Party. A secures a message using AES with 512 bit keys (in my ...
1
vote
0answers
179 views

BER or DER X9.62 ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
1
vote
0answers
79 views

Is there any pattern in points on EC?

I read some where in crypto.stackexchange answer (related to EC-SRP protocol) that there is pattern in points on elliptic curves, i.e. if given some points containing mix of correct and wrong points ...
1
vote
0answers
51 views

Zero knowledge of two factor

Here I overconfident in myself state that I can show, that n has two factors. This is not completely true, can possibly show $n$ is composite - prover generates RSA key with modulo $n$, and gives $e$ ...
1
vote
0answers
43 views

Security of simple Skein PBKDF mentioned in the paper

From the Skein 1.3 paper section 4.8, Skein as a Password-Based Key Derivation Function (PBKDF), it mentions the following as a simple PBKDF (S = seed and P = password): An even simpler PBKDF is ...
1
vote
0answers
122 views

Construct rainbow table to break DES

I'm facing a project where I need to build a rainbow table to break DES. I've already collected information about Hellman, DP, rainbow table method. Finally, I chose the rainbow table approach. I've ...
1
vote
0answers
50 views

Encryption with a known plaintext

I'm building an application where users can be a part of groups, and can obtain and distribute URLs from the group page that allow anyone who clicks on them to join said group. Groups should not ...
1
vote
0answers
224 views

FileVault AES-XTS decryption with cipher text that's missing a part

My mac was recently upgraded to OS X Yosemite and FileVault2 full disk encryption was turned on. Encryption finished, but things went horribly wrong and key parts of the disk are filled with all 0s ...
1
vote
0answers
39 views

What is the difference between any secret sharing scheme and arithmetic secret sharing scheme

It looks like that only difference between two of them the variables. But it does not make sense for me and I could not find exact definition of arithmetic secret sharing scheme. I mean what exactly ...
1
vote
0answers
101 views

Security implications of public nonce

I'm planning to use the crypto_box() functions of Nacl (or, alternatively, the crypto_box_easy() functions of libsodium) to ...
1
vote
0answers
29 views

Looking for an adjustable compute bound decryption function

I'm looking for a way to decrypt data, but make it require varying amounts of CPU power to do so. Maybe this could be illustrated as e(m) = m' and ...
1
vote
0answers
68 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...

15 30 50 per page