1
vote
1answer
90 views

Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says,given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
1
vote
1answer
40 views

Winternitz Signature Scheme Verfication

I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is ...
1
vote
1answer
75 views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
1
vote
2answers
167 views

Is One Time Pad considered Chosen-Plaintext Attack Secure?

If we're considering Chosen-Plaintext Attack setting, then the adversary has access to the Encryption Oracle right, and we know that OTP is only considered secure if we use the key only once. How ...
1
vote
1answer
54 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
1
vote
3answers
129 views

Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
1
vote
1answer
77 views

Clefia Vs AES 128 bit

I am running a comparison between Clefia (Lightweight cipher from Sony Corporation which is a standard now http://www.sony.net/Products/cryptography/clefia/standard/index.html) and AES 128 bit. The ...
1
vote
2answers
116 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
1
vote
2answers
64 views

Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?

I read something about the padding oracle attack when analysing the use of an AES-encryption of data in a database and was "scared" it could be a serious issue. But after investigating a bit further, ...
1
vote
1answer
146 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
1
vote
1answer
81 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
1
vote
1answer
72 views

Can a cryptographic hash be used as a cryptographic RNG?

Say I roll a six sided die 200 times (6^200 = ~2^517) and string all the results together into a long string of numbers and hash then result with SHA-512. Can I use that result for cryptographic ...
1
vote
1answer
103 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
1
vote
3answers
81 views

Why do we get the following equation in case of a One Time Pad?

If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that $E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$ My first question is, is the ...
1
vote
1answer
74 views

algebraic attacks for mixed operations (mod 2 and mod 256) [closed]

If a cipher has mixed operations, e.g $\oplus$ (addition mod $2$), and addition modulo $2^8$. How we we going to express them mathematically? Thanks in advance!
1
vote
1answer
142 views

Creating a random password based off of a prime number

So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a ...
1
vote
3answers
120 views

Salsa20-GCM composition secure?

AES-GCM seems to be used by everyone but I never seen even one post about Salsa20-GCM. Is it secure? Wikipedia mentions that GCM ...
1
vote
1answer
81 views

Are there any valid, and person readable, checksums possible?

We've been trying to produce a valid, and pretty, MD5. Something that has repeating digits, or spells a word, or something. It's probably more difficult than spelling out the dictionary on a ...
1
vote
1answer
47 views

What does invertibility of the cryptographic primitive mean?

source: http://www.cosic.esat.kuleuven.be/publications/thesis-152.pdf ,page 32 Note that key recovery implies invertibility of the cryptographic primitive (because due to the Kerckhoffs’ ...
1
vote
1answer
245 views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
1
vote
1answer
160 views

Concatenation of two strong hashes may have striking weakness

For any hash functions $H_0$ and $H_1$, it is easily proved that their concatenation $H_0\|H_1$, defined by $(H_0\|H_1)(X)=H_0(X)\|H_1(X)$, is at least as resistant as the strongest of $H_0$ and $H_1$ ...
1
vote
1answer
43 views

Is this discrete log generalization a well known cryptographic assumption?

Assume you have a finite group $\mathbb{G}$ and an integer $n$. Given $g_1,\dots,g_n,t$ chosen uniformly from $\mathbb{G}$, consider the problem of finding a vector $(a_1,\dots,a_n)\in \mathbb{Z}^n$ ...
1
vote
3answers
149 views

DH and PKI for KeyExchange

My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. ...
1
vote
1answer
96 views

What aspect of elliptic curve encryption paradigms makes them especially susceptible to quantum based attack algorithms?

This was a statement made during a talk at today's DFN-CERT conference but unfortunately it wasn't explained further. Can anyone shed light on why elliptic curves are susceptible to quantum based ...
1
vote
2answers
109 views

Equivalent key size between HMAC and AES?

I have seem comparison between AES and RSA, e.g., AES 128 bit key is equivalent to RSA modulus 3072 bits. Is there such comparison between AES key size and HMAC?
1
vote
1answer
95 views

Crypto++: How to re-generate pseurandom integers in Crypto++

I'm using Crypto++ to implement my protocol to mask a value $y_i$ by a seudorandom value $r_i$ such that $m_i=y_i \cdot r_i$. Since there are many $r_i$'s I want to generate them using PRG and then ...
1
vote
1answer
45 views

Do any stream ciphers with aperiodic keystreams exist?

Exactly what it says on the tin. I can imagine constructing such keystreams from: The binary expansions of irrational numbers Chaotic systems like the logistic map or the Lorenz attractor. The ...
1
vote
2answers
36 views

Combined message separation

I have two ciphertexts, I suppose that its RC4 with reused key. I have XORed both ciphertexts and obtained message containing combined cleartexts. I suppose that the underlaying messages are written ...
1
vote
1answer
61 views

Verifying identity using a sha-1 hash

I was reading http://blog.zorinaq.com/?e=74 which is about a Windows kernel developer. The developer proves that he is an actual developer by posting the SHA1 hash of a particular revision of a file. ...
1
vote
1answer
68 views

How bad would it be to reuse the random blinding factor in a scheme like Paillier?

A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with $r \in ...
1
vote
3answers
92 views

Possible to use an accumulator to “license” or restrict the qty of certificates being used?

Suppose in a future version of x509 PKI, it is possible to limit the quantity of certificates being used, what would that look like? Here is a concept that won't work in the real world, but ...
1
vote
2answers
130 views

NTRU key generation

I've been experimenting with an NTRU open-source C implementation here I've noticed something (potentionally) strange with a certain set of params: NTRU_EES1087EP2 (defined here). When generating ...
1
vote
1answer
191 views

Performance bottlenecks in Paillier encryption

I'm implementing Paillier encryption and I'd like some recommendations about improving its performance. Firstly, I have to note the following: I have already set g=1+n to get rid of one ...
1
vote
1answer
129 views

Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
1
vote
1answer
102 views

Associative but NOT Commutative Reducing Function Construction with Existing Hash Function(s)

Is it possible to construct a binary reducing function based on any existing cryptographic hash function satisfying the associative property but not the commutative property? So formally: Using an ...
1
vote
2answers
973 views

How can a cryptosystem be unconditionally secure?

The definition of an unconditionally secure cryptosystem states that the cryptosystem cannot be broken even with infinitely computational ressources and time. However, since most books define the ...
1
vote
1answer
111 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
1
vote
1answer
139 views

what are the plaintext's for the RC4 stream cipher test vectors in RFC6229?

https://tools.ietf.org/html/rfc6229 has stuff like this: ...
1
vote
1answer
86 views

one time pad regarding

If I had two ciphertexts $$c_1 = m_1 \oplus y_1 \text{ and } c_2 = m_2 \oplus y_2$$ will it be possible to obtain $$z_1= (m_1 \lor m_2) \oplus y_1 \oplus y_2 \text{ and } z_2= (m_1 \land m_2) ...
1
vote
1answer
110 views

Malleability of homomorphic encryption

El Gamal is a malleable homomorphic encryption system, so is Rabin. Are all homomorphic encryption systems malleable? Or are there any that are not malleable? Thanks!
1
vote
2answers
211 views

Proving the semantic security of the One Time pad

Currently hearing a lecture on cryptography, and the professor gave us the definition of semantic security, which is roughly the following (formally not quite complete, but you get the idea): ...
1
vote
1answer
87 views

Does it necessary the public key is prime number in RSA algorithm?

I read some books talk about RSA cryptography but I did not understand something when choosing a public key $e$ Sometimes the condition is $1<e<$$\phi(n)$ Where $\phi(n) = p-1 * q-1$ also ...
1
vote
1answer
81 views

Arithmetic modulo 1

In the context of lattice-based cryptography, in particular the Learning With Errors (LWE) problem, I see some definitions given in terms of equations modulo 1 (see for example, Appendix A of this ...
1
vote
3answers
230 views

Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
1
vote
2answers
100 views

I don't care about replay attacks. What should I do with the nonce in nacl?

My system forwards encrypted and/or signed messages on a gossip network. Replay is part of the design. What should I do with the nonce? I'm tempted to just set it to the same number always. Is this a ...
1
vote
1answer
239 views

Hash collision using the leading 40-bits of SHA-1

I am trying to implement Floyd's cycle finding algorithm for finding a leading 40-bit hash collision in the SHA-1 algorithm. However, my code will not find a repetition even with 800,000,000 hashes. ...
1
vote
1answer
124 views

Where have all the cypherpunks gone?

In 1992, cypherpunks was created as a mailing list for activists advocating for cryptography. Arguably, the cypherpunks mailing list was the foundation for the movement and the centre of it all. ...
1
vote
2answers
715 views

What is more secure, a ciphertext encrypted with AES-256 or encrypted with 3 different AES-128 keys?

Or better yet, is encrypting a block with 2 AES-128 keys just as secure as encrypting a block with 1 AES-256 key? By the way, I've only recently been learning cryptography stuff; I've made working ...
1
vote
1answer
82 views

Is $(f(X), G(X))$ pseudorandom?

If $f:\{0,1\}^n \to \{0, 1\}^n$ is a one-way function, $G:\{0, 1\}^n \to \{0, 1\}^m$ is a pseudorandom generator, and $U_m$ is the uniform distribution over $m$-bit strings. Is the joint distribution ...
1
vote
1answer
77 views

Why do we need password in a server which uses TLS?

Suppose a server uses TLS to protect communication between us and the server. I observe that in the TLS handshake protocol, password is not mentioned anywhere. Then why do we need to have a ...

15 30 50 per page