1
vote
3answers
46 views

Should RSA primes p and q differ in length by “a few digits”?

When generating RSA keys in the original RSA paper it is stated: to gain additional protection against sophisticated factoring algorithms, p and q should differ in length by a few digits Why is ...
-1
votes
0answers
10 views

Encryption program help

First I must say that I don't know which coding language is best for creating an encryption program. But I have an idea for an open source encryption program that uses the program itself to encrypt or ...
0
votes
1answer
7 views

Why ssh-gen makes difference between PEM and PKCS8?

Correct me if I am wrong, but PKCS8 is format to store private key info. It could be binary-enoded (DER) or Base64 encoded ...
0
votes
0answers
19 views

How to use the non adjacent form (NAF) algorithm to implement scalar multiplication? [on hold]

I'm confused by the following NAF-algorithm. How could I possibly use it to implement scalar multiplication for elliptic curves? ...
4
votes
1answer
67 views

Is it possible to perform an MPC protocol to compute a product in a polynomial ring?

I hope not to be asking much, but I have N parties, each one holding a polynomial in with 0-1 coefficients and fixed degree $n-1$. I was wandering if it is possible (I mean feasible) to compute the ...
-1
votes
0answers
13 views

Symmetric Cipher Providing full and partial decryption

Let us have Video Data $D$ and we want to encrypt the data in such a way that upon decryption we have multiple decryption keys which will give us full or either partial decryption depending on the ...
-2
votes
0answers
15 views

Decrypting RSA message

I need help with a practice problem for an upcoming test. I've learned the answer to the problem is "well done", but don't know how to get there. Any help is greatly appreciated. Suppose that the ...
12
votes
2answers
780 views

Proving knowledge of a preimage of a hash without disclosing it?

We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256. Alice discloses a value ...
1
vote
3answers
40 views

How to generate many passwords from one passphrase, so that knowledge of one password does not compromise the others?

The limitations are: it should be a function. passphrase is so weak, that if hash of it is known (or big part of hash), then it can be brute forced. I want to get N passwords from one passphrase. ...
7
votes
4answers
1k views

Theoretical pi-based stream cipher

Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream ...
3
votes
1answer
49 views

Block cipher mode of operation with beyond-birthday-bound security

I am looking for block cipher modes of operation that are secure even when the number of blocks encrypted exceeds the birthday bound.
1
vote
0answers
15 views

Does a password that's cracked someone's account increase the chances of cracking someone else's account?

For every find in password that cracks someone's account, does that particular password have a higher probability of cracking someone else's account more than a brute force dictionary choice? How ...
3
votes
2answers
98 views

Same 64-bit preimage resistance security for SipHash and SHA-512/64?

If I have to chose a 64 bit preimage resistant hash function; will there be any difference in security between SipHash and SHA-512/64 (SHA-512 truncated to 64 bits)? How long will it take an ...
1
vote
1answer
18 views

SipHash's (non-)collision resistance

I'm very new to cryptography, and I need help understanding the security claims made in Aumasson and Bernstein's paper on the SipHash. In particular, I'm trying to understand the following statement ...
3
votes
1answer
109 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
0
votes
0answers
32 views

Hash function with good performance on extremely short messages

Are there randomized almost universal hashes that are fast for extremely short messages (usually <10 bytes)? Edit: This is for hash tables, so it only needs to be hard enough to break to make the ...
0
votes
2answers
121 views

How does SSL work on the browser

I recently bought an SSL certificate from a website and was able to make it work on my Apache server. As far as I know, it uses asymmetric keys and the private key is stored on the server while the ...
2
votes
1answer
26 views

What is the branch number of this matrix?

We have the following matrix: $$\begin{pmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{pmatrix}$$ What is the branch number? Is this a MDS marix?
0
votes
0answers
29 views

2-round key-exchange protocol converted to CPA-secure public-key encryption scheme

Show that any 2-round key-exchange protocol (that is, where each party sends a single message) can be converted into a CPA-secure public-key encryption scheme.
0
votes
1answer
57 views

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M ...
0
votes
2answers
80 views

Where is the mistake in my RSA by-hand calculation?

Like several previous askers, I seem to have made a mistake in my RSA calculation, but despite going back over it three times, I cannot spot it. I picked 1000003 and 6000011 as my primes, ...
0
votes
0answers
12 views

Securely register a client in server using AES an RSA

I've designed the following protocol to send the client's public key to the server. Initially, the client knows server's public key, but the server does not know the client's public key. client ...
2
votes
1answer
105 views

Reverse output of general Fibonacci LFSR

Suppose we have some Fibonacci LFSR, and it outputs some sequence. How to change starting LFSR so, that it outputs exactly same sequence, but in reverse order?
0
votes
1answer
18 views

How to use the hardcoded server's public key to register a client application?

I'm designing the security for a smartphone app that can be used to make car reservations. Clients have to register them with their driver's licence through the application and can then book a car. ...
-2
votes
0answers
10 views

how scalar multiplication using periodic sequence in ECC be created?

if it is prepare in java then what steps would be taken? how NIST recommended binary curve be used in the scalar multiple algorithm
-2
votes
0answers
25 views

Security timestamp [on hold]

I want to prove the security of a cryptosystem, that makes use of trusted timestamps. Unfortunatelly I can't find any information about how a secure timestamp is defined (I was looking for sth like ...
1
vote
1answer
244 views

Symmetric mutual authentication with client using a derived secret

I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
1
vote
1answer
37 views

A question about fully homomorphic encryption (FHE)

Hypothesis: We define the messages on a field $\mathtt{F}_p$, where $p$ is a large prime number. I am considering a dynamic outsourced private data scenario. Assume we have 3 messages: $m_1=2, ...
3
votes
1answer
31 views

Prove that the following MAC is insecure

I am trying to prove that the following MAC is insecure, but I don't know how to exploit the properties of the pseudorandom function $F$ involved: Gen generates a uniform $k \in \{0, 1\}^n$. To ...
1
vote
0answers
47 views

Is 3 rounds more secure than 2 in this simplified DES?

Consider the following simplification of DES: a plaintext message block of $2n$ bits of length is divided into two blocks of length $n$ (left half $L_0$ and right half $L_1$). In other words, the ...
1
vote
1answer
34 views

How is the base64 encoded signature in Craig Wright's proof constructed?

Mr. Craig S. Wright might be Satoshi Nakamoto - the inventor of bitcoin. He is currently proving the case. But how is the base64 encoded proof, that is published by himself on his blog post ...
0
votes
1answer
46 views

tls 1.2 finished message stucture

I am implementing TLS 1.2 and using ECDHE_RSA_AES_128_GCM_SHA256 cipher suit. According to RFC 5246 finished messages have {verify_data[verify_data_length]} and verify_data = PRF(master_secret, ...
22
votes
1answer
3k views

Examples of modern, widely used ciphers that suddenly fell?

RC4 and GOST are two major ciphers (defined as being widely used to encrypt large amounts of data) that fell to cryptanalysis (relatively) suddenly. The first becoming totally broken and the second ...
0
votes
0answers
35 views

Is their any symmetric key cipher (block or stream cipher) providing partial decryption?

symmetric key cipher (block or stream cipher) providing partial decryption of data at some points. Although the entire data is not been decrypted but the data decrypted to that specific point should ...
1
vote
0answers
50 views

Is it possible to enumerate the possible RSA keys?

As far as I understand ECDSA keys are smaller than RSA because all of the value of the ECDSA (up to a high number) are valid private keys. Is there any method of compressing RSA keys, based on some ...
2
votes
0answers
38 views

Statistical tests for PRNG that generates a sequence which is not binary

Is there a pratical application to PRNG that generates a sequence which is not a binary one? A ternary, quaternary sequence, for instance. If so, how can we test this? Is there any alternative test ...
3
votes
1answer
60 views

ECFP harder than ECDLP ?

Given two points $P$ and $Q = \sum_{i=1}^{n} x_i.P$ over $E_p(a, b)$ for $x_1,x_2,...,x_n \in \mathbb F_p$. The Elliptic Curve Factorization Problem (ECFP) is to find the points ...
0
votes
0answers
10 views

Why does HS1-SIV use the universal hash function the second time?

HS1-SIV uses HS1-Hash twice: once with the message as input, and the second time with the authentication tag as input. The second use seems somewhat strange to me: assuming that the core is a strong ...
8
votes
3answers
119 views

How to prove the security of block ciphers

I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs... In the field of protocols (like authentication) it ...
4
votes
2answers
54 views

Can one extend the nonce of ChaCha/Salsa20 by XORing the extra bits with the key?

Can one extend the ChaCha and Salsa20 nonces by XORing the extra nonce bits with the key? My reasoning is as follows: the Rumba compression function allows attackers to supply any 48-byte input to ...
0
votes
0answers
34 views

Weil Pairing - Miller's Algorithm

I'm trying to implement Weil Pairing using Miller's algorithm. I have got couple of questions. How to select $m$? As stated in this link page 13, I interated from $1$ to order of point $P$ such that ...
0
votes
0answers
19 views

PHP Apple News HASH HHMAC

I am having a problem generating the signature key in PHP as describred in the Apple nes API documentation found here: ...
-6
votes
0answers
63 views

Here I am like a [on hold]

I don't know if it's the place to ask this, but I realy don't know where to look for this information. I heard someone says "Here I am like a..." And that sentence reminded me of something I have ...
0
votes
0answers
16 views

TLS 1.2 PRF Cipher Suite Specification

I am upgrading our assembler SSL/TLS implementation to support TLS 1.2 and am reviewing RFC5246 specification for TLS 1.2. It states that the PRF is now part of the cipher suite specification but ...
13
votes
3answers
1k views

Does composing multiple substitution ciphers improve security?

Will using two substitution ciphers one after the another be more secure than using single substitution cipher?
4
votes
1answer
48 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin ...
0
votes
2answers
71 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
1
vote
2answers
34 views

Converting a 5-bit s-box to its bit-sliced format

I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network). Most papers ...
0
votes
1answer
27 views

Fully or partially Decrypting Data with Multiple keys

Is there any good paper or research carried out till now that a data is encrypted by a single key or onwer(user) and their are 2 or more decryption keys. One key can decrypt the entire data. Other ...
2
votes
1answer
41 views

Why are the bit lengths of keys and digests equal in Lamport signatures?

In Lamport's one time signature scheme: One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$. Cryptographic hash function to ...

15 30 50 per page