1
vote
1answer
85 views

Can you exchange a shared key without any hardness assumptions?

Imagine that P=NP, and one way functions don't exist. Can two people end up with a random shared key of arbitrary length, if every exchange is public? They have true RNGs, and know who they are ...
0
votes
1answer
125 views

Size of a MAC for a quickly checked message?

Let suppose that we have to check a message that was written one second ago. The message is discarded immediately after having being checked. What "minimal" size for such a MAC is secure ? Thank you. ...
1
vote
0answers
92 views

Existence of encryption schemes where $F_{k}^{-1} \big( F_{k}(A) + R \big) = A + O(R)$

Is there a encryption scheme in literature, where I can do something like $$F_{k_1}^{-1} \big( F_{k_2}(A) + R \big) = A + O(R)$$ where, $A$ is a $m \times n$ real matrix, $R$ is a $m \times n$ real ...
-1
votes
1answer
154 views

Generating cyclic group for Ciphertext-Policy Attribute-Based Encryption [closed]

I am doing Project under the topic CP-ABE.I need to generate a symmetric bilinear group Go of prime order p and with generator g...Then how to choose random elements from Zp....kindly anyone help ...
0
votes
2answers
113 views

Counter Mode with a sequence of zeros bits plaintext, is it secure?

I had a quiz last week in computer security course. There was a confusing question that I am still looking for a good and clear answer. First, I know that counter mode with a good block cipher is ...
1
vote
1answer
63 views

What does K stand for in frequency analysis

It was from frequency analysis lecture and the professor mentioned but I cannot recall. The K value for English was .067, German was .076. The lowest K was Russian which was .056. When the frequency ...
-1
votes
2answers
319 views

How fast would a polynomial time factoring algorithm compute?

I know factoring is the chief means of breaking RSA keys. I know an algorithm that runs in polynomial time would be able to break an RSA key pair "quickly". But how quickly is "quickly"? Note, I'm not ...
0
votes
1answer
71 views

Weak Boneh-Boyen Signature in Composite order group

In the paper Ring Signatures of Sub-linear Size Without Random Oracles, authors have remarked that the scheme is instantiable in composite order setting, too. I am attaching the following reference ...
0
votes
1answer
359 views

Encrypting with Davies-Meyer hash function scheme

So I need to to illustrate Davies-Meyer hash function for a message “123” with 1-byte blocks. I can use the extended ASCII representation where each character is represented as a byte. And I can pick ...
1
vote
2answers
51 views

Automatic generation of secure passwords with the least inconvenience for a user

I'm working on a web site for a private company that should allow them to upload files, which will be later retrieved by their affiliates. The site will be available from a public Internet using ...
2
votes
1answer
548 views

SHA1 Partial Collision

I'm working on a little python script that reads in two fairly similar English sentences (they're in text files - reading them in) and I'm trying to force a SHA1 partial collision (e.g. first 32 bits ...
0
votes
1answer
322 views

CPA security of a stateless and deterministic encryption system

Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it?
0
votes
1answer
49 views

Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
0
votes
2answers
113 views

RSA generation of private key using public key

In RSA private key generation e*d ≡ 1 mod φ e is public, also n is public. How to prove mathematically, generation of ...
1
vote
1answer
191 views

PRF based on the GGM construction

What's the differences between the concepts “pseudorandom generator” and “pseudorandom number generator”? In fact, I want to implement a pseudorandom function based on GGM's construction at ...
0
votes
1answer
188 views

Noise bound in FHE over the integers

I'm studying the paper Fully Homomorphic Encryption over the Integers by Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan. I have questions about the proof of Lemma A.1. In page ...
0
votes
0answers
250 views

Python implementation of a blind signature scheme which doesn't involve RSA

RSA seems a bit creepy after the Snowden revelations and i'm looking for a simple python based blind signature library to fiddle around with. So far i've been unable to find anything. What am i ...
8
votes
2answers
977 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
1
vote
1answer
886 views

What is the difference between a hash function and a pseudorandom function? [duplicate]

Read the title. I've seen in RFCs that some MAC functions are called "pseudorandom functions". What are those? How are they different than hash functions? Why can't a hash function be used instead?
0
votes
1answer
501 views

Why does the DES crypto algorithm NOT use 2 rounds?

Now, if we were to go round by round, you could give a distinct reason for not using a single round since after just one round, the right half of the text comes directly, as-is, to form the left half ...
21
votes
3answers
5k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
1
vote
0answers
55 views

Decrypt a message which is encrypted using XOR? [duplicate]

This is a puzzle asked in a contest. Given that encryption , decryption happens as per following rule/code: ...
1
vote
1answer
123 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
0
votes
1answer
108 views

Negative exponents in Shoup's threshold RSA?

I'm trying to implement threshold RSA operations, starting with decryption based on Peeters, R., Nikova, S., & Preneel, B. (2008). Practical RSA Threshold Decryption for Things That Think. ...
0
votes
1answer
120 views

Proof that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$

What is the proof for the fact that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$ Where: $N = P * Q$ where $P$ and $Q$ are both primes. $\varphi(N)$ ...
2
votes
1answer
87 views

Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
0
votes
1answer
70 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ...
0
votes
3answers
1k views

Kryptos : K1. What is the origin of the “palimpsest” keyword?

I'm studying the Kryptos sculpture with its cryptographic puzzles K1 to K4. I understand that the keyword "palimpsest" was reverse-engineered using the tableau (and brute-force computer processing), ...
6
votes
0answers
233 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
2
votes
1answer
419 views

Can public key be recovered from ciphertext & encrypted private key?

I'd like to implement something like a write-once public/private encrypted shared secret (no better quick description for the lack of terminology knowledge). I guess, I'm trying to implement HSM. The ...
1
vote
1answer
258 views

XOR cipher with three different ciphertexts and repeated key, key length known. How do I find the plaintexts?

Let us say we have three different plaintexts (all alphabets, A-Z): $x$, $y$ and $z$, each of length $21$. Let the key, $a$, be also of length $21$. Now, what we have is $x \oplus a$, $y \oplus a$ ...
1
vote
2answers
184 views

The perfect way of using IV in CTR mode

I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret ...
0
votes
1answer
63 views

Why is it a quadratic equation?

In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in $\mathbb{Z}_n$ as shown below. But, my idea of quadratic equation was a second order polynomial equation in a ...
2
votes
2answers
81 views

One-way function definition

I cannot understand why a one-way function $f$ is defined in this way $\text{Pr}(f(A(f(x))) = f(x)) < \frac{1}{p(n)}$ and not $\text{Pr}(A(f(x)) = x) < \frac{1}{p(n)}$ where $A$ is a ...
0
votes
1answer
182 views

One time pad probability

I'm trying to solve a question about one time pads but I'm not sure if my assumptions are correct. I am to assume that I have a one time pad with perfect secrecy. This one time pad is used to ...
2
votes
1answer
59 views

Do any stream ciphers with aperiodic keystreams exist?

Exactly what it says on the tin. I can imagine constructing such keystreams from: The binary expansions of irrational numbers Chaotic systems like the logistic map or the Lorenz attractor. The ...
-1
votes
1answer
12k views

Decrypt files with original file CTB-Locker [closed]

I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ...
4
votes
1answer
748 views

Merkle hash tree updates

It seems that merkle hash tree (MHT) traversals have been discussed somewhat in the literature, but there does not appear to be much written on inserting, deleting, and updating leaves. Is this lack ...
1
vote
0answers
35 views

Reducing key shares in Damgård-Dupont threshold RSA

I'm working on understanding and implementing Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC ...
1
vote
2answers
129 views

Usage of GF(p^m) fields, where p != 2

$GF(2^m)$ Galois fields are widely used in different cryptographic algorithms, for example, in Rijndael. However, $GF(p^m)$ fields are possible with any prime $p$, not only 2, but $GF(2^m)$ fields ...
2
votes
0answers
360 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
4
votes
0answers
244 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
2
votes
2answers
607 views

Can AES in CCM or GCM counter mode interoperate with AES in “plain” counter mode (CTR)?

I am exploring the use of Windows CNG to replace some OpenSSL-based code that takes advantage of AES in counter mode. From the outside, everything should look the same after the switch. The section ...
2
votes
2answers
1k views

DES Encryption Algorithm all 64 bits for key instead of 56 bits

Would a DES algorithm that uses all 64 bits for the key instead of just the 56 bits be more secure? I have been thinking about it but those 8 bits used for parity are very useful and but including ...
0
votes
1answer
76 views

Is there a reference that prove that the AES Key Schedule generate random looking round keys?

Starting from uniformly random generated AES master key, is there a reference that prove that an specific roundkey can be considered as uniformly random generated as well ?
13
votes
1answer
16k views

Many time pad attack [duplicate]

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
3
votes
2answers
351 views

Achieving 32-bit verification code with 16-bit CRC? [closed]

I am programming an embedded chip that has a hardware 16-bit CRC module. I have to protect some data bytes $d_0,d_1,...,d_{n-1}$ against corruption caused by sudden loss of power; a 32-bit CRC would ...
6
votes
2answers
582 views

State of the art RSA key generation

I would like to know if there is an algorithm to generate a RSA key at the state of the art of the present cryptanalysis. Beside the key lenght I know there are some weakness in the choice of prime ...
6
votes
3answers
2k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
3
votes
1answer
338 views

Definition of the Decryption oracle

In the context of public-key encryption, what would be a formal definition of the decryption oracle? I know the informal definition (i.e., a function that is available to the adversary and that ...

15 30 50 per page