All Questions

655 views

How to accurately calculate Unicity Distance for English?

The Unicity Distance for the DES cipher is around $8.6$ characters, and can be calculated using the $U=H(k)/D$ formula, where $D = R - r$, and where $R = 8$ is the number of bits in a byte (ASCII is 7 ...
384 views

Explanation of each of the parameters used in ECC

I'm having a very difficult time finding a clear explanation of the parameters used elliptic curve cryptography. I know for certain that $p$ is the number or order or whatever of the given field that ...
265 views

Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
791 views

Proving the semantic security of the One Time pad

Currently hearing a lecture on cryptography, and the professor gave us the definition of semantic security, which is roughly the following (formally not quite complete, but you get the idea): ...
152 views

I don't care about replay attacks. What should I do with the nonce in nacl?

My system forwards encrypted and/or signed messages on a gossip network. Replay is part of the design. What should I do with the nonce? I'm tempted to just set it to the same number always. Is this a ...
135 views

what are multi-primes and how are they different from semiprimes?

I came to know of semiprimes recently. The simplest explanation of semiprimes is you take any two prime numbers and you multiply them, say 3*11 = 33 in which case 33 would be a semiprime. The numbers ...
144 views

Private Information Retrieval--Is it still theoretical?

Are there any real world products in which private information retrieval techniques are used?(a data hosting server oblivious of which data item was fetched from it?)If not what are the major barriers ...
179 views

What is the difference between order of base point and curve order in EC? [duplicate]

When I was read about the elliptic curve cryptography I found some definition about domain parameter of elliptic curve like the follow. But I did not understand something $p$: prime number. $a, b$: ...
210 views

What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
246 views

Why is this cryptosystem insecure?

Can someone help me see the flaw in this cryptosystem? Note: This is homework and it is due today at 1:30pm. An answer before that is not expected; I'd just like to understand what the flaw is. ...
107 views

Is XCBC where k2 and k3 might be the identical, secure?

XCBC paper says all three keys should be independent. It doesn't say they must always be different. However it seems this is necessary to differentiate padded message and message without padding. ...
707 views

how to calculate non linearity of AES S-box?

S-box has to satisfy different design criteria. How to calculate non-linearity , propagation criteria for an AES S-box?
468 views

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ... 2answers 134 views Is it safe to salt a MAC? Say that I define a scheme where the salt is public and is MAC-ed with the message:$k = KDF(password, salt)tag = MAC_k(salt || message)$Is it safe to salt the MAC this way? Assume that the salt ... 1answer 312 views Do Export Restrictions Still Apply To The Key Length of RC4? I've just read a paper from 2004 which stated that the RC4 encryption algorithm was restricted to a 40 bit key size when exported from the USA; however the reference for this information (Applied ... 3answers 311 views If a cipher has key length shorter than plaintext, then it is not perfectly secure I am trying to verify the statement above. So far I only know that a One-Time-Pad is the only “perfectly secure” cipher. It has a key length which is exactly the same as the plaintext. I think the ... 1answer 214 views RC4 key schedule and algorithm design I've looked up RC4 algorithm and it's seems easy enough but some parts of it seem random to me. In the key schedule part take for example the following part : ... 1answer 665 views Why is 224 bit ecdsa faster than 192 bit ecdsa? I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ... 3answers 187 views Feasibility of finding public key when private key is known We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ... 1answer 428 views Will I be able to (ab)use a FIDO U2F compliant hardware token to decrypt data? I have heard good things about the emerging "FIDO U2F" standard. I am especially interested in having a JavaScript API for cryptographic functions that I can access through a plug-in in a browser. ... 1answer 309 views Perfectly secure shift cipher Prove that if only one character is encrypted using a shift cipher, then the shift cipher is perfectly secure. I want to show that$P(P=p | C=c)=P(P=p)$. But I don't know how to relate. Can anyone ... 1answer 868 views Entropy of the key Suppose a$1000$-bit key used in the one-time pad is not randomly and uniformly generated. Suppose that the values of the first$5$bits are$0$, and the other$995$bits are randomly generated and ... 1answer 362 views Why are some key stretching methods better than others? I'm trying to understand why some key stretching methods are better than others. The wikipedia article presents 3 different key stretching methods: A collision prone simple key stretching ... 1answer 115 views How to only encrypt a subset of the plaintext I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext. I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a ... 3answers 502 views Can a EC private key be derived from a public key? I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ... 1answer 317 views How to calculate complexity of ElGamal cryptosystem? How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ... 2answers 251 views What is the entropy per Diceware word if a random symbol is inserted into a random position in the word? On the Diceware page is this little gem: For extra security without adding another word, insert one special character or digit chosen at random into your passphrase... Inserting a letter at ... 1answer 214 views Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve? Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ... 1answer 152 views Pick faster private exponent I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ... 2answers 100 views One Time Pad for large changing files i wondered what the security implications are if I do the following. If I had a large file encrypted with a OTP and want to change only a few bytes in the plaintext. what security vulnerabilities do I ... 2answers 239 views How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption? I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$... 1answer 581 views How is padding oracle attack mitigated by encrypt-then-MAC? Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ... 3answers 170 views Is it possible to find data which makes sense when decrypted with different keys? In theory, does a piece of data exist which, when encrypted (using any method) with a given key, makes some sense when decrypted with the wrong key? Here, a definition of "some sense" might be ... 1answer 127 views Computing youngest person among 3 while keeping ages private I already found a protocol to find out who is richer (older) between two parties, but Is there any protocol to find the youngest person among 3 parties, without revealing actual ages? 1answer 158 views Can I make a PRNG that is secure even when state can be modified by user? I am interested in making a PRNG which, after being initially seeded, can accept and incorporate client data as the only ongoing source of "entropy". It is not directly for a cryptographic purpose, ... 1answer 250 views Pairings in Identity-based encryption vs. Attribute-based encryption The bilinear map in Identity-based encryption should satisfy$e(aP,bQ)=e(P,Q)^{a\cdot b}$whereas Attribute-based encryption schemes use$e(P^a,Q^a)=e(P,Q)^{a\cdot b}$with$a,b\in\mathbb{Z}_p$and ... 1answer 198 views “Fine grain Cross-VM Attacks on Xen and VMware are possible” and OpenSSL 0.9.7 Here's a paper that just made its way into Cryptology ePrint Archive: Fine grain Cross-VM Attacks on Xen and VMware are possible!. Its a good survey of past attacks and presents a couple of new ... 1answer 89 views Do Chosen-Chiphertext attacks only apply to public-key cryptosystems? Do Chosen-Chiphertext attacks (CCA-1/2) only apply to public-key Cryptosystem? 1answer 777 views How to select$g\$ in Paillier Cryptosystem

For my cryptography class project in university I have selected Paillier Cryptosystem as a course project ...
241 views

What is the difference between PRF and a Random Oracle?

What is the difference between Pseudo Random Functions and Random Oracles? Is the difference only about the domain of PRFs and Random Oracles, former having a fixed domain and latter can act on any ...
547 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
250 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
589 views

Why the need to hash before signing small data?

I’ve got two questions: I’m doing the following: Data : uuid + int + nonce Signature: ECDSA(sha256(Data) ) To verify the signature: ...
210 views

Is there a time-space tradeoff attack for breaking symmetrical cryptos?

Is there any known techniques for using time-space tradeoff for speeding up symmetrical crypto breaking? Kind of like rainbow tables speed up breaking hashes by using huge precomputed tables. Is ...
2k views

Is it true that for RSA with no padding, the length of data must be equal to the length of key?

The question pertains not in terms of security but computing operational functionality, as it how the computation is done. Is it true that for RSA with no padding, the length of data must be equal to ...
171 views

Explanations for the complexity values for second preimage attack on GOST?

I've been reading the article "A (second) preimage attack on the GOST hash function" by F. Mendel et al (link) and I'm having some difficulty to grasp some of the values of complexities/probabilities ...
245 views

McEliece key size

There's a lot of references about McEliece key size being the barrier for proper usage of the algorithm, exactly (or roughly) how large are the keys?
178 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...