2
votes
2answers
101 views

Implementing RSA with small integers in CUDA

I have found some researches dedicated for speeding-up RSA calculations using CUDA. But I am wondering how they do that, given that the biggest unsigned int that could be declared in CUDA is 64 bit. ...
2
votes
1answer
69 views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
2
votes
2answers
86 views

How can a message encrypted with the public key be decrypted with the private key? [duplicate]

I've been reading about encryption and have a basic understanding of the concept. What I don't understand, however, is how a calculation with one key can result in a number that, through calculation ...
2
votes
1answer
92 views

Plaintext and ciphertext block sizes

How can you determine the largest plaintext block size and smallest ciphertext size if you used RSA with $n=59768553302699443$ using an alphabet with $27$ characters?
2
votes
1answer
81 views

Which ciphers produce random ciphertext?

I already know AES produces a "random" output. 5e4e6440826d6afc4535fbf078455f791159701a9df624ddd4e4dda84523b6a7 Its ciphertext doesn't follow a pattern and is ...
2
votes
1answer
86 views

Why is CBC-MAC with length appended not secure?

I've just read about CBC-MAC for the authentication of arbitrary length messages. In particular I cannot figure out why appending the message length before computing the MAC yields a non-secure MAC. ...
2
votes
1answer
68 views

Proven secure scheme under random oracle

Currently I am trying to understand random oracle model in order to make a small presentation about it but I seem to be very confused about it. Since it's an hypothetical model without a real life ...
2
votes
1answer
45 views

Is the IV value in Davies Meyer construction public?

I am learning the construction of Davies-Meyer to construct a hash function from block ciphers. The definition that I found is $$H_i=E_{m_i}(H_{i-1})\oplus H_{i-1}.$$ where $E_k$ is a block cipher ...
2
votes
1answer
204 views

Lattice based attack on RSA

Let $n=pq$ be the RSA module and at least one of $p,q$ is a weak prime.It is proved that the number of such $1024$bit $n$ is at least $2^{759}$. With lattices we can factor these $n$ in a second (I ...
2
votes
2answers
86 views

What is the purpose of Pseudorandom Function Families (PRFs)?

I'm currently in a course in Cryptography, and was wondering why pseudorandom function families exist at all. If there existed one pseudorandom function f(x), based on its definition, could that not ...
2
votes
1answer
196 views

How is the AddRoundKey operation performed in AES-256?

Can anyone explain to me (or send a link to somewhere) how round keys are added in AES-256? I understand that the round keys is added to the state matrix for each round and how XOR works. But since ...
2
votes
2answers
98 views

RSA and difference between factors

As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two ...
2
votes
1answer
75 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
2
votes
1answer
92 views

How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original ...
2
votes
1answer
64 views

Largest number that could be factored in milli seconds

Considering a home pc/laptop as machine used (Say typical 2.4 GHz, 16GB RAM, 4 core processor) for running any factorization algorithm. What would be the largest number that could be factored into its ...
2
votes
2answers
119 views

Why does the time complexity of RSA encryption and decryption depend on the size of the modulus?

I would think that the time complexity would depend on the exponent, not the number of bits in the modulus. For example, if the exponent were 5, using the "naive" method, we would perform 5 ...
2
votes
1answer
146 views

Help understanding basic Franklin-Reiter related message attack

I am trying to understand this attack at the most basic level. I set up the following basic scenario: Let the public encryption exponent, e = 3. Let p, be some arbitrary but known (to the ...
2
votes
1answer
152 views

Confused about how chosen ciphertext attacks work?

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is ...
2
votes
1answer
46 views

Is it secure to use ciphertext feedback with RC4?

Consider the following modification of RC4 to give some "ciphertext feedback" ...
2
votes
1answer
78 views

Diffie-Hellman using a different modulus on both sides

For Diffie-Hellman Key Exchange, the used modulus is the same throughout the process. Is it possible to use 2 different for both sides? For example, $A \gets M^{d_1} \pmod{n_1} $ $B\gets M^{d_2} ...
2
votes
1answer
103 views

Cracking a hash which descends to a single value after repeated hashes

Assume I have a hash function (such as the one below) and a cipher, and I know that if I repeatedly hash any string over and over again, it will eventually descend to one unique value. Is there any ...
2
votes
2answers
37 views

With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

A key pair has a private key $D_A$ and a public key $Q_A$. $D_A$ is an integer less than the curve's $n$. Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a ...
2
votes
1answer
165 views

Finding key of AES in ECB mode

How many plaintext-ciphertext pairs would be needed to guess with probability, say $p=0.5$, the key $k$ of AES under ECB mode? Most of the articles that I found tried attacks on single ...
2
votes
3answers
108 views

Proving that a node is the only child

Say I have a graph of messages like this: A | B / \ C D By including the parent hash in the message to be hashed I can show that B is a child of A, ...
2
votes
1answer
44 views

How to calculate Enc(-m) from Enc(m) in Paillier cryptosystem?

The encryption in Paillier cryptosystem is like this according to Wikipedia: Let $m$ be a message to be encrypted where $m \in \mathbb{Z}_n$ Select random $r$ where $r \in \mathbb{Z}_n^*$ Compute ...
2
votes
1answer
47 views

Is frequency analysis a viable attack on non-text data encoded by substitution?

Is frequency analysis a viable attack on non-text data encoded by substitution (eg image and audio formats encoded with a substitution cipher)?
2
votes
1answer
139 views

How to use CRT to compute 4 square roots while decryption in Rabin Cryptosystem

I'm reading Rabin Cryptosystem which requires to compute 4 square roots $r, -r, s,- s$ while decryption of cipher text $c$ such that $$r = (y_p \times p \times m_q + y_q \times q \times m_p) \mod n ...
2
votes
1answer
107 views

AES/DES question about determine a key

I have a question. If you receive a DES encrypted message for which you would NOT recognize the plaintext if it were decrypted, is there any way to potentially determine the key if all keys are ...
2
votes
1answer
40 views

Data Switching and Information Leakage

Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$. I have a fixed secret value $x$. I mask ...
2
votes
1answer
203 views

Can a file encrypted with one tool be decrypted with different tool? [closed]

I'm new to cryptography and I'm trying implement a file encryption feature into a Python program but I'm running into a big issue...what is needed for someone else to decrypt the file?! Obviously, I ...
2
votes
1answer
402 views

What is required to decrypt an encrypted file?

At the risk of sounding stupid and being laughed at...I must ask this question. What is required to decrypt an encrypted file? Obviously you need the appropriate key to decrypt, but is any other ...
2
votes
1answer
97 views

Are there full cycle cryptographic/one-way hash primitives?

I'm looking for behavior similiar to that of LCGs, (i.e. input and output sizes are same). Full cycle of $2^{32}$ different inputs generates full cycle of $2^{32}$ different outputs, distribution of ...
2
votes
1answer
102 views

What is the difference between CPA and IND-CPA?

I am writing a paper and I got comments from the reviewer that I don’t really understand. Is there any difference between a CPA (Chosen Plaintext Attack) and IND-CPA (Indistinguishability under ...
2
votes
1answer
62 views

Has there been any research on entropy efficient information-theoretically secure PRNGs?

I have an idea for an research project, but I am first wondering if it has been researched or implemented before. I think I have a way to come up with a set of PRNG algorithms which have the ...
2
votes
1answer
47 views

Number generation for Fujisaki-Okamoto commitment scheme parameters

I need to implement the Fujisaki-Okamoto commitment scheme for a project such that I can demonstrate performance of various zero-knowledge proofs in relation to one another, for example Boudot's ...
2
votes
1answer
33 views

TLS: How is the shared secret (via Diffie-Hellman) used in the symmetric crypto function?

So let's say we use a cipher suite with DH key exchange and AES symmetric encryption. Alice and Bob both end up with the same shared secret key $k$. How is this value ...
2
votes
1answer
63 views

Modified version of a CPA-secure encryption scheme

The following encryption scheme: choose a random string $r \leftarrow \{0,1\}^n$ and compute the ciphertext $c= \thinspace <c_0, c_1>= \thinspace <r, F_k(r) \oplus m>$, assuming $F$ a PRF; ...
2
votes
1answer
199 views

Obtain 384 bits from a 256bit MasterSecret

I'm currently implementing, with crypto++, and AES tranmsission system, whose key is based on a previous ...
2
votes
1answer
73 views

A secure function evaluation problem and an alternative of 1 out of n oblivious transfer?

I am considering a "secure function evaluation" problem: Consider two parties: A and B. A has a one-to-one mapping function $f(x)=k$. Basically, the function $f(x)$ can be regarded as a table of two ...
2
votes
1answer
35 views

Leakage in Secure Two party Computation

Am trying to understand Garbled Circuit based approach for Secure Two party Computation. There isn't much leakage in the classic millionaire's problem where the comparison circuit is used. But ...
2
votes
1answer
87 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
2
votes
1answer
61 views

TLS Handshake : Server authentication or only Server ‘s Certificate authentication?

I have some difficulty understanding the way in which the Server is really authenticated by Client in TLS handshake (in case of using RSA key exchange). When Client receives Server ‘s Certificate and ...
2
votes
1answer
36 views

Exchanging keys via third party

In many symmetric key ciphers sender and receiver have to exchange a single key. They may also do it through 3rd party who distributes it to both of them. since 3rd party can read all messages ...
2
votes
1answer
87 views

Possible to determine equivalence of hash codes from different hashing functions?

Let $H_{1}(x)$, $H_{2}(x)$, ..., $H_{n}(x)$ be a list of $n$ secure one-way hash functions such that for a given input $x$ each $H_{i}(x) \neq H_{j}(x)$ when $i \neq j$. Give one hash function to ...
2
votes
1answer
71 views

Using scrypt to generate key + IV/nonce together

Is there any security issue in using scrypt for Key + IV/nonce generation? In other words, can I safely use only a salt for scrypt and derive the nonce along with the key? For example: I have data I ...
2
votes
1answer
34 views

Possible to detect if a message is PGP encrypted/signed (ciphertext)

Let's say I have a text field somewhere (i.e. an interactive user submitted text field on a PHP script, or a console application. Basically anything that accepts user input.) How can I detect if said ...
2
votes
1answer
128 views

Security impact of signing small data using RSA

I have an application which consists of a client and a server. Both have a pair of public and private key (RSA). For communication, both sign their messages and send them to the other part. So a ...
2
votes
1answer
301 views

Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
2
votes
1answer
76 views

One time pad ciphers in emails

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? The distribution of the keyword would pose no problems since I would ...
2
votes
1answer
103 views

Can CFB mode of block cipher be used as a commutative encryption?

Can CFB mode of block cipher be used as a commutative encryption? Is it possible to use CFB mode of AES block cipher to create commutative encryption? With CTR it is possible but not secure.

15 30 50 per page