All Questions

0
votes
0answers
12 views

Is it possible to get different plaintext from a single ciphertext using different keys?

I will explain better my question here. Suppose to have a chipertext that you can't decrypt, but you know that the plaintext can be A,B or C. Then arrives to you the key which is used to encrypt the ...
1
vote
0answers
10 views

How many bits are needed to commit one bit non-interactively in the standard model?

I'm wondering the state-of-art result about how many bits are needed to commit a single-bit non-interactively? I noticed in the paper of Naor's bit commitment: http://www.wisdom.weizmann.ac.il/~naor/...
0
votes
2answers
19 views

AES_256_ENCRYPT_CTR(key, sha-1(plainText)+plainText) VS AES-GCM, which is more secure?

What if we encrypt sha-1 hash of the plain text, along with the plain text using AES-256 in CTR mode? How much future proof the above method would be in comparison to AES-GCM or any other method ...
0
votes
1answer
21 views

Is this MAC correct and secure?

Let $m \in \{0, 1\}^{2n} = m_1 || m_2$. Let's also assume that $F_k$ is a PRF and $G$ is a PRG defined as $G: \{0, 1\}^n \rightarrow \{0, 1\}^n$. Now, Let's define the $MAC$ scheme as follows: $$MAC(...
1
vote
1answer
40 views

Disadvantage of the using a counter within plain text for encrypting with AES256 and authentication?

What if we use a counter within the plain text and then encrypt the plain text with aes 256 to encrypt & authenticate? For example: encryptAES(32bit_counter+plain_text_of_96bit); or encryptAES(...
1
vote
1answer
30 views

AES decryption of MixColumn

In the encryption of MixColumn you use the constants 01, 02 and 03. I don't understand why the inverse of 01 becomes both 0D and 09. I also don't understand how you get 01, 02 and 03 in the first ...
0
votes
1answer
25 views

DSA: How to calculate 224-bit $q$ for 2048-bit $p$

$p$ is a 2048 bit prime number $q$ is a 224 bit prime number I know that $q$ is a prime divisor of $p-1$, thus $p=1 \bmod q$ but I couldn't write efficient code to calculate this. I can calculate ...
0
votes
1answer
39 views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
1
vote
0answers
20 views

If F is a PRP then the tweakable block-cipher based on the Merkle-Damgard construction is a secure TBC

Assume $F$ is a PRP then the tweakable block-cipher based on the Merkle-Damgard construction (take this as the way I understand, here is the equation): $F_k[t](m) := F_{F_k(t)}(m)$ is a secure TBC. ...
0
votes
1answer
22 views

modular reduction algorithm over $F_{2^m}$ doesn't seem to work when order of polynomial being reduced is small

I was considering algorithm 2.40 (arbitrary reduction polynomials) in the Guide to Elliptic Curve Cryptography and... it doesn't appear to work when the order of the polynomial you're trying to ...
0
votes
1answer
47 views

What risks are involved when choosing a curve for an implementation of ECC?

What risks are involved when specific curves are chosen for an ECC implementation? How should I audit a system that uses ECC with regards to a specific curve? Bonus: How can I (or a cryptographer) ...
0
votes
0answers
43 views

Computational Complexity of SHA-3 (SHAKE128)

Please, I got the question "what is the computational complexity of SHA-3 (SHAKE128)"? What does that mean and how can I calculate that?? *I am using SHA-3 (SHAKE128) in my mechanism to hash fix ...
1
vote
0answers
31 views

El Gamal Signatures, Need help explanining a step, Where does the “775” come from? Image included

I understand all of the previous steps, but I don't understand what is happening to "S2" in that the number "775" showed up. Where does the 775 come from? I can't seem to get it, and I've tried ...
-1
votes
1answer
30 views

Why is the Rabin mapping not a permutation over $\mathbb{Z}_N^*$

Why is the Rabin mapping: $f_i(x_i)=x_i^2 \bmod N_i$ not a Permutation over $\mathbb{Z}_N^*$?
2
votes
1answer
92 views

Explaining Chaotic Cryptography

I will venture myself into studying chaotic cryptography. However, I find it hard to explain what chaotic cryptography entails to those that have some knowledge of cryptography. Neither can I explain ...
2
votes
1answer
46 views

Proof of membership in an aggregated BLS signature

Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given: $m_1...m_n$ are $n$ distinct messages $p_1...p_n$ are private keys with $P_1...P_n$ being ...
2
votes
1answer
48 views

Is PRG On Concatenation of Input a PRG

This is a homework assignment, so I'm not expecting full solutions, just general guidance. Let a PRG $G:\left\{ 0,1\right\} ^{n}\to\left\{ 0,1\right\} ^{l\left(n\right)}$ (where $l\left(n\right)$ ...
7
votes
1answer
74 views

WOTS+: Why does it XOR before running data through the hash function?

I'm implementing WOTS+ in a new language and I can't seem to wrap my head around the fact that WOTS+ XOR's their input with its mask right before hashing it. I tried to look for any reasoning but so ...
1
vote
1answer
59 views

Can wiping a disk writing zeros on an encrypted device be a weak point?

Can cryptsetup suggestion of wiping a disk before encryption with zeros written to an encryted device as described in question 2.19 as the recommended method on the CryptsetupFAQ (the part that starts ...
8
votes
4answers
770 views

Why is SHA-512 limited to an input of $2^{128}$ bits?

Both SHA-384 and SHA-512 are limited to an input size of less than $2^{128}$ bits. Considering SHA-512 has a higher output size, couldn't it include more input data?
1
vote
1answer
35 views

Permutation and modes of operation

I'm reading the book "Serious Cryptography A Practical Introduction to Modern Encryption" from Jean-Philippe Aumasson, and in the first chapter, it is written this : We can try to abstract out the ...
-3
votes
0answers
31 views

Anyone here who can help me to solve these questions? [duplicate]

Please, i need the answers of below questions.
1
vote
1answer
40 views

Use partial hash to verify entire hash

I've had an idea about storing parts of SHA256 hashes and I'd like to find out how secure it is, or how much less secure it is than storing the entire hash. For example, users can share this list of ...
0
votes
0answers
21 views

how can i decrypt enigma plugboard in python

algorithm in python to decrypt ENIGMA plugboard (5 couples) i already created an algorithm who break rotors positions and rings , but plugboard i couldn't do something interesting, any propositions ?
0
votes
0answers
16 views

can't decrypt AES-256-GCM log file! [HELP] [on hold]

i'm trying to decrypt a log file that containt some chat messages ( in french ) it is encrypted with AES-256-GCM then encapsulated into a TLS session: Take a look at the file here https://ufile.io/...
-1
votes
0answers
34 views

What is the key to these encrypted messages? [on hold]

So I'm trying to reverse engineer a lock system that consists of a chip reader and a control unit. There are only two devices on this network, the reader which reads a rfid like chip and the control ...
0
votes
0answers
16 views

Is this still considered to be differentially private?

I'm currently trying to understand and apply edge differential privacy to social network data using Python. As an example, the original network has n = 3012 nodes ...
-1
votes
2answers
78 views

Determining whether functions are one-way or not

I read a book about one-way function. In this book, I saw 2 exercises that I can't understand and don't know how to solve. Can anyone help me to solve these? Is $f(x,y)=x+y$ a one way function? Is $f(...
1
vote
2answers
46 views

How is Diffie Helman secure when the exchanged number is a power of the generator less than the modulo

I'm trying to understand how Diffie Helman is still secure when $A$ ends up being a power of $g$ less than $p$. I chose $p$, where p is prime, and $g$ is a primitive root modulo $p$. $g=2$ and $p=...
1
vote
3answers
115 views

What is the largest key size that could be carried by a shuffled deck of playing cards?

If you are carrying a standard 52 card pack of cards (no jokers) what is the largest key size, or the amount of data the cards can hold? Without the cards being marked or distinguishable from an ...
0
votes
0answers
23 views

Efficient accumulator with constant witnesses

I'm looking for a data structure similar to a dynamic accumulator that has the following properties: Small size: ideally under 100 bytes for the accumulator, and also under 100 bytes for witnesses ...
-5
votes
0answers
55 views

Please help me to slove below questions, i know its bit childish but someone solve this for me. Please [on hold]

Please help me help me. I would appreciate if someone help to solve this for me Please.
5
votes
0answers
39 views

Why would the use of Curve25519 in Dragonfly leak information?

An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote: One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
0
votes
1answer
53 views

Mathematics behind the paper “how to leak a secret” for ring signature

I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001). On page 8/14, in chapter 3.4, the authors present the following "combining function": $$C_{k,v}(y_1, y_2,\ldots,y_r) = ...
2
votes
2answers
36 views

Does side-channel attacks offer any difficulty to Stinson's concept of `provable security'?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
3
votes
1answer
715 views

Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
2
votes
1answer
24 views

Estimate Security level of the Rabin Signature

I'm trying to figure out how long the modulus $n$ has to be in the Rabin Signature scheme, to provide 128 bit security. We assume that the used hash function is "secure enough". Then the naive ...
2
votes
1answer
253 views

SSL - encrypt with private key and then with public key?

Say there are 2 sides that wish to communicate: side A and side B. Let's say we are looking at side ...
0
votes
0answers
40 views

Is it possible to generate same RSA key on purpose?

I want to ask if I have a RSA private key can I use it to generate RSA key that is identical. If yes how can I do it?
0
votes
1answer
36 views

Hash Collision Probabilities

Please give help! how can I calculate the probability of collision? I need a mathematical equation for my studying. Assume, I am using SHA256 to hash 100-bits. Thus: SHA256 {100} = 256-bits (hash ...
0
votes
1answer
29 views

The goal, the method, and the interface of the signcrypt primitive.

Some time ago, I proposed making the site more educational by teaching correct cryptographic programming. The proposal had had somewhat good reception, but was met with cold ice as there had been ...
2
votes
1answer
233 views

What are the curly brackets in this cryptographic hash function definition?

Reading the Schnorr signature Wikipedia page, I stumbled upon the following statement: All users agree on a cryptographic hash function $H:\{0,1\}^*\to\mathbb{Z}_q$. What do these curly brackets ...
-2
votes
1answer
59 views

Is this device authentication method (using AES-256) secure?

Let's say we have: client_id_ran: 256 bit random text (chosen only once for whole system) used to generate client_id by ...
1
vote
2answers
43 views

Decrypting ciphertext that is missing a block

In the AES encryption, suppose that the key is known. The ciphertext is also known except for a block of the same size as the key. In the worst case scenario for the attacker, how hard is it for ...
1
vote
1answer
89 views

Given a particular $1600$-bit output $Y$, is it feasible to find a $1600$-bit input $X$ such that $\text{Keccak-}f[1600](X) = Y$?

I have read this answer on Crypto.SE and I want to clarify a few details. Does this property of $\text{Keccak-}f[1600](x)$ imply that if we know a particular $1600$-bit output $Y$, it is feasible ...
0
votes
0answers
42 views

Can you tell how many times data has been encrypted?

I'm using multiple RSA keys to encrypt a piece of data. The data length is constant but the data itself is not. Each time I encrypt I prepend a 64 bit string to the newly encrypted ciphertext. This ...
0
votes
1answer
28 views

Can we find the exact number given remainder of the numbers with mod m?

I have around 1500 numbers. The numbers $x_i$ are calculated as $x_i$=($p*t_i$) mod m. $p$ constant and same for all the numbers while $t_i$ are chosen randomly everytime. For example the given ...
0
votes
0answers
62 views

RSA restore part of D from E and N

I have full bits of public key $(n,e=65537)$ but from the private key, I have the lower half bits of $d$. Can I restore the whole RSA private key from that data and use it for decryption?
1
vote
0answers
26 views

Is there an instance where integrity protecting metadata is bad?

In JWEs there's a unprotected data field as well as recipients are not integrity protected. Is there a case where integrity protecting this data would be a problem? If it doesn't make a difference, ...
0
votes
1answer
30 views

Oblivious transfer with trusted third party Trent

I am trying to solve this exercise. Assume an oblivious transfer protocol that uses a trusted third party Trent. Alice's messages $M_0$ and $M_1$ are binary values of length $k$. Bob's message ...

15 30 50 per page