Tag Info

New answers tagged

0

It can be proved, mathematically, that your (2), (3), and (4) are all equivalent under chosen plaintext attack. That is, if you can do any of those things then you can also do the other two! It should be obvious that (2) implies both (3) and (4): if you can decrypt a message then you know which message it is, and also you know it's not random noise. The ...


6

This isn't really a "hard" answer, but an attempt to give some intuition or motivation. One can interpret indistinguishability as an overapproximation of the most common notions of security: Any system that is broken in a more practical way will also fail to meet indistinguishability, that is, all practically important security requirements are in fact ...


4

Katz & Lindell mention in their book "Introduction to Modern Cryptography: Principles and Protocols" an example of an IND-CPA attack from World War II. Navy cryptanalysts suspected that Japanese ciphertexts containing the fragment "AF" where referring to the Midway island. Then, they told officials at Midway to send unencrypted messages reporting they ...


5

For starters: Paillier and RSA are based on very similar assumptions, and both systems would be broken immediately by an algorithm to factor large composites. Additionally, knowing $\phi(n)$ or $\lambda(n)$ is quite essential to both systems, because the trapdoor for decryption is based on that. As you can see, the relation to RSA is quite close, and thus ...


1

The short answer is yes. It would be considerably more secure. But nowadays, classical encryption methods like Playfair and Vigenère are so easily broken by computer analysis that they offer next to no security whatsoever. Aiming for something "considerably more secure" than either of these is really setting the bar very low. Specifically, although the ...


4

If you can generate uniform random numbers, you can use a variant of Fisher-Yates. //given an array s with the elements to be permuted for i from n-1 to 1: t = rand(0, i) # inclusive swap(s[i], s[t])


3

Yes, but it's different and not as cost-efficient. The discrete log variant of the number field sieve goes (very loosely) like this: Collect logarithms of many small primes using sieving and linear algebra (the precomputation stage) Represent the target field element as a product of small primes and use the small logarithms to recover it (the individual ...


2

Sure you can do. There are many lattice attacks, using your second assumption, to ECDSA (which also applied to DSA). For instance see Smart and Howgrave-Graham and Shparlinski and Nguyen. All the lattice attacks base on finding small solutions (for the ephemeral key $k$ and the private key $a$) to the signing equation $sk-ra\equiv H(m)\pmod q.$ If you have ...


1

You can do this slightly better with an additional $\mathcal{0}(2^{56})$ memory and with $\mathcal{0}(2^{56})$ time. You can notice that the relation $c \leftarrow E_{k_1}(E_{k_2}(m))$ can be rewritten as $D_{k_1}(c) = E_{k_2}(m)$ (just apply the decrypt function on both sides. First step consists in the generation of every pair $(k_2, E_{k_2}(m))$ and ...


0

The hash can only be calculated once you know the plaintext (and, in your case, the Random Text as well). If you already know the plaintext there is no need to know the key anymore. So basically you have a scheme here that either offers no security at all, or a scheme that is impossible to decipher, even for the intended users (apart from guessing the ...


2

Essentially, instead of checking against a (salted) hash of a password, you suggest using the hash (since you can choose hashing = keygen) as a key to encrypt a kind of test value. The main question is whether this adds or reduces security. If you store the hash/key directly, the chance of a randomly chosen password hashing to the same value is $2^{-n}$, ...


0

Your proposal is not good. First, the checking procedure is wrong: Checking password validity: calculating test_hash=cipher(test_password+salt) for a given test_key=keygen(test_password+salt) check if test_hash consisting only symbols/bytes of predefined dictionary (...) I guess you meant: calculating test_phrase=decipher(hash) with ...


2

I see no reason to expect your construction to be cryptographically secure. A single MWC generator is not something that was ever designed to be cryptographically secure. A cryptographically-strong PRNG needs to be designed in a very different way from a non-crypto PRNG. In particular, it sounds like MWC was designed to have a long period. But having a ...


0

The Pearson product-moment correlation coefficient is what you evaluate, in general, when you perform DPA (CPA would be a better name for this, but DPA is used also in this context). It is defined as: $\rho(X,Y) = \frac{cov(X,Y)}{\sigma_X\sigma_Y}$ Where $X,Y$ are your vectors, $cov$ is the covariance and $\sigma_X$ is the standard deviation of X. In your ...



Top 50 recent answers are included