# Tag Info

4

Wrapping up my comment as an answer: Imagine you’re a Japanese cryptanalyst in the year 1944. There is no such thing yet called “television”, and you’re still decades away from a wordwide network feeding you with all the knowledge you could wish for. In that case there’s only a minimal chance you’ve ever heard or seen a Navajo. So, you’ll be wondering ...

4

Using generic homomorphic encryption the answer for all three is essentially yes. Although 3. in general is probably mainly of theoretical interest as it would be impractically slow. For simply compressed data this is simple since compression should not do anything to hide the data. Just decompress, do the operation and possibly compress the result if ...

2

I guess you do not want to break anything at all. Universal re-encryption pursues the idea that anyone given a ciphertext can WITHOUT knowledge of the public key re-randomize a given ciphertext to an unlinkable ciphertext to the same message. Thus you include an additional encryption of the identity (1 in the group $\mathbb{Z}_p^*$) with independent ...

2

Without knowing $g$ and $h$ we can do as the original paper says: Pick $m,n$ random, both from $\mathbb{Z}_q$ where $n \neq 1, c^m \neq 1, d^m \neq 1$. Then $\sigma' = (c^n, d^n,ac^m, bd^m) \pmod p$ will do. The decryption routine is also in that paper.

2

1) and 2) Either S0, or S1 is used for each 4-bit long part of block depending on key bits. 16 S-boxes are used in each round (because you split 64-bit-long block into 16 parts of length 4) of the Lucifer cipher, so each round needs a 2 byte long subkey. Example: 16 starting bits of the key (the first subkey): 0 0 1 0 1 1 1 1 0 0 1 0 1 0 0 1 (2 bytes ...

2

With such a small block size there is no way to employ RSA padding modes such as PKCS#1 v1.5 padding or OAEP. You could however see the encryption as ECB mode encryption. In that case you could apply padding mechanisms that have been constructed for symmetric block ciphers. Those padding modes however have been defined for bytes rather than characters. ...

1

This is an issue with any block cipher. One solution is to pad the message. This means that, first you split it into blocks and then you will have some remaining characters at the end that are not one whole block. So lets say that the block length is L and you have n characters. You can add at the end of your message L-n extra characters so that with those, ...

1

Remember that the initial value is split into two halves, and each half is shifted independently. If all the bits in each half are either 0 or 1, then the key used for any cycle of the algorithm is the same for all the cycles of the algorithm. This can occur if the key is entirely 1s, entirely 0s, or if one half of the key is entirely 1s or the other half is ...

1

$h=g^x$ so $h^s={g^s}^x$ so for decryption of $m$ we have: $$m=d\cdot c^{-x}$$ I think $a$ and $b$ are not necessary. Also, there exist lot of valid ciphertexts. As cygnusv mentioned you can choose $r',s'$ randomly and this is a valid ciphertext: $$\sigma' = (g^{r+r'},h^{r+r'},g^{s+s'},m\cdot h^{s+s'})$$

1

You can compute $\sigma'$ as follows: $$\sigma' = (a\cdot g^{r'},b'\cdot h^{r'},c'\cdot g^{s'},d'\cdot h^{s'})$$ where $r',s'$ are chosen randomly from $\mathbb Z^*_p$. This produces the following ciphertext, which decrypts to $m$: $$\sigma' = (g^{r+r'},h^{r+r'},g^{s+s'},m\cdot h^{s+s'})$$

Only top voted, non community-wiki answers of a minimum length are eligible