25
votes
0answers
2k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
19
votes
0answers
679 views

Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$

Suppose you want to select a prime $p$ such that finding e.g. $\log_2(3)$ in $\mathbb{Z}_p$ is expected to be either at least as hard as the general Discrete Logarithm Problem in $\mathbb{Z}_p$, or at ...
10
votes
0answers
191 views

AMD and RDRAND instruction

The latest AMD programmer manuals, dated June 2015, include the RDRAND instruction in the instruction set. For completeness, it lacks ...
10
votes
0answers
675 views

Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique (described here): it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed ...
9
votes
0answers
278 views

How were shift amount constants in MD5 found?

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in ...
8
votes
0answers
94 views

Turing's (still?) classified inference engine algorithm?

Does anyone know the algorithm used by Turing's Colossus inference engine, so highly classified that the Brits kept it secret for decades after WW II? Indeed, it may still be classified. Several ...
8
votes
0answers
74 views

K friedman - two texts explanation

I have a question, I read the k friedman test to determine the period of a vigenere cipher text, and I understand something like this: Friedman's K test tries to find out what period of the cipher by ...
8
votes
0answers
444 views

Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
8
votes
0answers
968 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
7
votes
0answers
77 views

Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : ...
7
votes
0answers
155 views

Santa Claus' secret permutation

This December, $N$ friends play secret santa: they select a random permutation $\sigma$ of $N$ (without fixed point). For Santa Claus, everyone has to bring a gift to the next person in the ...
7
votes
0answers
119 views

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...
7
votes
0answers
207 views

Are there any practical attacks that create a printable chosen prefix MD5 collision?

I would like to create two ASCII text messages with the same MD5. Is this possible? If not, is there a similar but less strict attack that could work? Or to rephrase my last question: what are the ...
7
votes
0answers
179 views

Verbatim of early work on public-key cryptography?

In late 1997, the history of public-key cryptography was turned around with the announcement by the CESG (April 2000 archive) that public-key cryptography was theorized in a 1970 note [1] by James ...
7
votes
0answers
181 views

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Define a commutative block cipher with keyspace the finite set $K$, and message space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto ...
7
votes
0answers
169 views

Has the distributed project “Number Fields @ Home” project benefited cryptography in any meaningful way?

Is there any new understanding, property, or knowledge that has come from the Number Fields @Home distributed computing project? Has any outcome advanced the study of cryptography, or altered ...
7
votes
0answers
253 views

Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
6
votes
0answers
62 views

Calculation of the avalanche effect coefficient

Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...
6
votes
0answers
53 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] ...
6
votes
0answers
81 views

Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
6
votes
0answers
222 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
6
votes
0answers
211 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
5
votes
0answers
58 views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (Private Key $d$ ...
5
votes
0answers
53 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
5
votes
0answers
54 views

Confusion on Private Information Retrieval by Keywords

PIR protocols retrieve an item from the database without the server knowing which item it is. But classic CPIR(Computational PIR) or IT-PIR (Information Theoretic PIR) protocols requires the user to ...
5
votes
0answers
101 views

Homomorphic system that allows Hamming distance computation?

How can I work out Hamming distance between two binary vectors securely? I would like to know how I can apply homomorphic techniques here.
5
votes
0answers
67 views

What is the fastest modular reduction algorithm available?

I have been browsing for the fastest and most efficient modular reduction algorithms and came across quite a few. But the one in A Fast Modular Reduction Method (2014) by Zhengjun Cao, Ruizhong Wei ...
5
votes
0answers
139 views

help with cryptanalysis of a sponge permutation

I have been studying and researching hash functions. So far my research has led me to the sponge construction. It appears that the permutation used in the sponge to stir the state is more or less ...
5
votes
0answers
40 views

An MPC protocol from Elgamal is a good solution a homomorphic multiplication?

I want to compute a multiplication between many secret values and then distribute the result to everyone involved. For this, I thought about an MPC protocol built from Threshold Homomorphic Elgamal. ...
5
votes
0answers
30 views

OTR AKE protocol implementations security

While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR ...
5
votes
0answers
31 views

Understanding the definition of HGD

On the section 4.2, page 10, of the paper Order-Preserving Symmetric Encryption, the authors define two subroutines: the first one is called $HGD$ and the second one is $GetCoins$. I have doubts ...
5
votes
0answers
78 views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
5
votes
0answers
68 views

Why is AES-SIV not used, but AESKW, AKW1?

I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ...
5
votes
0answers
68 views

Rule 30 Cellular Automaton for Cryptography

Steven Wolfram of Mathematica uses a pseudorandom number generator based on Rule 30 for applications in Mathematica software but I would like to know if a pseudorandom generator based on Rule 30 is ...
5
votes
0answers
86 views

Proof that perfect privacy implies that the number of keys is at least the number of messages

I was reading a proof to the statement: Perfect privacy implies that $|K| = |M|$ where I am pretty sure that $K$ is the set of keys and $M$ is the set of messages. The proof is the following, ...
5
votes
0answers
117 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
5
votes
0answers
38 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
5
votes
0answers
46 views

Can a one-way accumulator be used in place of a digital signature?

Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to: verify that the data has not been tampered with, and verify that the message is in fact ...
5
votes
0answers
227 views

How to break a columnar transposition cipher?

I'm currently studying for a cryptography exam. I've been given ciphertext that has been encrypted by a columnar transposition cipher. I've been given no shift key length or key word, the only thing I ...
5
votes
0answers
63 views

Elliptic curve point addition with $Z_1 = Z_2 = 1$

Elliptic curve point addition and point doubling operations using Projective and Jacobian coordinates require fewer field multiplication operations when considering $Z$ coordinates of input points ...
5
votes
0answers
31 views

Safe generation of $k$ points on a curve such that the mutual discrete logs are hard?

I have a multiplicative group $G$ of prime order $p$ implemented using a twisted Edwards curve (similar to Ed25519). I want to compute a set of $k$ distinct points $P_1,...,P_k$ that generate $G$, ...
5
votes
0answers
110 views

Would the encryption of bigrams and trigrams weaken the code?

Supposing a rotor machine of the 1940s or 50s, with 36 characters instead of 26. Would the encryption of the ten additional characters as the most frequent bigrams or trigrams weaken the code? What ...
5
votes
0answers
254 views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encountered different variations of it. The basic structure is the following: (1) A --> B: rA (2) B --> ...
5
votes
0answers
322 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
5
votes
0answers
114 views

Homogenous and heterogeneous Unbalanced Feistel Networks

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ...
5
votes
0answers
245 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
5
votes
0answers
302 views

LT codes with Homomorphic hashing

I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
5
votes
0answers
322 views

Odds of false error detection in a randomness test using the chi-squared test?

Common Criteria classifies the requirements for true Random Number Generators, and specifies how these should be tested against failures (these can occur accidentally, or following deliberate attack, ...
4
votes
0answers
64 views

Is correlation in vector distributions “dangerous”?

Consider the two vector distributions $\xi,\chi$ described below, each one outputting integer vectors of length $n$ with coefficients in $\{0,\dots,n\}$. Distribution $\xi$ samples each coefficient ...
4
votes
0answers
34 views

What's the reasoning behind the design of the TLS 1.2 PRF?

TLS 1.2 defines a PRF-like construction $P_{hash} : \{0,1\}^* \times \{0,1\}^* \rightarrow \{0,1\}^l$ for key derivation, etc. To quote the spec: We define a data expansion function, ...

15 30 50 per page