Questions tagged [algorithm-design]

Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its name.

69 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
366 views

What level of security is provided when a Feistel Cipher is used as a round function of another Feistel Cipher?

Recently, I was reading: Are there any specific requirements for the function F in a Feistel cipher?, and the answer posted mentions a Feistel Cipher named Turtle, which uses a four-round Feistel ...
8
votes
0answers
336 views

Is the key schedule of Serpent a circle?

The creation of the prekeys for Serpent works by XORing some previous values with a counter and a fixed value. Every word is 32 bits big and 4 words form a round key (after applying a S-Box, but this ...
5
votes
0answers
459 views

Shannon cipher with fewer keys than messages

Alice and Bob have a set $\mathcal{M}$ of $|\mathcal{M}|$ messages and a set $\mathcal{K}$ of $|\mathcal{K}|$ keys. Alice wants to send a message $m \in \mathcal{M}$ to Bob. She uniformly picks a key $...
5
votes
0answers
101 views

search of patterns in key schedules

I am developing a new key schedule, and there is this article (Enhanced Key Expansion for AES-256 by Using Even-Odd Method) where the authors also propose a new algorithm and one of the objectives is ...
4
votes
0answers
90 views

Aside from Keccak, are there any keyed/unkeyed permutations where the choice of all rotation constants is not based on heuristic methods?

I am interested to see examples of cryptographic algorithms (namely, keyed or unkeyed permutations that transform an $n$-bit input to an $n$-bit output) where the choice of all rotation values is not ...
4
votes
0answers
220 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
4
votes
0answers
77 views

Is it safe to extend the length of Blake2b’s keyed hash key?

Blake2b keyed hash variation specifies a maximum key length equal to the digest size. It implements this feature simply concatenating the zero-padded key to a boundary of the block size with the ...
4
votes
0answers
212 views

How to make a “zero knowledge” cache/key-value store

I'd like to use a possibly insecure cache for storing expensive-to-calculate sensitive information. My requirements are: If the cache ever gets compromised it should reveal nothing about its ids or ...
4
votes
0answers
432 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
4
votes
0answers
225 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
3
votes
0answers
63 views

Can zero-knowledge proof be used to determine if another person knows a certain movie with a twist ending?

Suppose I want to talk with a co-worker about a movie called "The Twist Movie". I know the movie contains an interesting twist, and bringing up the movie in a discussion about twists in movies might ...
3
votes
0answers
113 views

Are there any cryptographic methods which use multiple cyclic groups?

For some cryptographic methods you can construct them. e.g. elliptic curves (product of two cyclic groups) or Diffie–Hellman (can be product of n-cyclic groups). But they have no usage because at a ...
3
votes
0answers
379 views

Fastest known Elliptic Curve Cryptography “solution” (coordinate systems (multiple?), algorithms, precomputed values etc)?

I am writing an Elliptic Curve Cryptography SDK in pure Swift, and currently I am only using Affine Point and simple Double-and-add. I am soon about to work on a faster solution. I am asking for help ...
3
votes
0answers
1k views

Antshares (NEO) algorithm (dbft) - Vulnerability to attacks - Game theory

This is more a game theory question, I think that this Forum is the best for this question. Please also correct me at the following text if I write something wrong. I understand the consensus ...
3
votes
0answers
37 views

Authenticate a session initialisation request

Consider a system where two devices are connected via a wireless encrypted channel. The channel requires manual pairing and the data passed over the channel is also encrypted using an ephemeral ...
3
votes
0answers
236 views

How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
2
votes
0answers
58 views

Reduction from integer factoring to computational Diffie Hellman

The computational Diffie Hellman (CDH) problem for ${\mathbb{Z}}^*_p$ is given a prime $p$, a generator $g$ of ${\mathbb{Z}}^*_p$, and a pair $(g^i, g^j)$ to compute $g^{ij}$. The value $g$ is called ...
2
votes
0answers
38 views

Can we encrypt data that must be decrypted with any private key plus a server generate bits?

I have come up with a scenario to make a secure data. Suppose I have a public encrypted file that anybody can download. But whenever anyone want to decrypt that data they need to get a key from server ...
2
votes
0answers
156 views

How few cryptographic primitives can we use to derive all other constructions?

We have a lot of cryptographic primitives now, and many methods of deriving one type of scheme from another. There are even some like the Merkle signature scheme, which uses a hash function to derive ...
2
votes
0answers
177 views

If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
2
votes
0answers
165 views

Why do the boolean functions used in cryptographic hashfunctions have 3 inputs (and not more)?

I'm learning about cryptographic hash functions and know why certain boolean functions were chosen to be used in the compression function of cryptographic hash functions (older question). Hash ...
2
votes
0answers
137 views

Why is a LCG not suitable for use in a cryptographic primitive?

Two's complement addition (and multiplication) are non-linear with respect to XOR and AND. This means that for bit vectors over $\mathbb{Z}_2$, the operation $a + x$ cannot be expressed as the matrix ...
2
votes
0answers
32 views

Publishing only items your subscriber previously subscribed to, without you knowing which those items are

Let's say you were given a dump from a security breach. You want to share the email addresses affected by the breach with a separate company who pays you for this service so that they can protect ...
2
votes
0answers
166 views

How to compute the decompositions used in fast FHE bootstrapping?

Leo Ducas and Daniele Micciancio's recent paper "FHE Bootstrapping in less than a second" gave an exciting result that one can compute the `atom operation' of Fully Homomorphic Encryption (i.e. NAND-...
2
votes
0answers
158 views

A question or few about Mental Poker

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman -- http://people.csail.mit.edu/~rivest/ShamirRivestAdleman-...
2
votes
0answers
107 views

Special random distribution algorithm

I am implementing ring signatures as a part of an authorization system. Since the number of users could get high enough to make computation on end-user devices infeasible, I am thinking of "...
1
vote
1answer
62 views

Are there any LFSR-based ciphers with variable feedback polynomials?

All LFSR-based stream ciphers that I know of use a fixed feedback polynomial (i.e. the taps are always in the same position). I know that, at least for non-trivial output lengths, it is necessary to ...
1
vote
0answers
82 views

Explaining Berlekamp-Massey Algorithm in simple/layman term?

My foundation in Mathematics is not great. But I would like to understand how Berlekamp-Massey Algorithm works and how it is used in lay-man terms. The only thing I find out there is the emphasis on ...
1
vote
0answers
295 views

Additive homomorphic secret sharing

I am new to cryptography esp, homomorphic encryption. I would like to know if the following is possible using something similiar to additive homomorphic secret sharing. Please apologize me if its too ...
1
vote
0answers
151 views

Is a hash function based on multiple nested iterations of HMAC-SHA-256 cryptographically weaker than SHA-512?

Let $M$ denote a message. Choose (arbitrarily or randomly) five different sequences of bits (their lengths are allowed to be arbitrary, assuming that our HMAC construction will not exceed the ...
1
vote
0answers
80 views

Are there any pseudo-random permutation algorithms for any number of words in the input independently of the word size (as in MD6 core function)?

I am interested in fixed pseudo-random permutation algorithms that are defined for any number of words in the input (but there might be some minimal number of words, e.g. 8), where the word size may ...
1
vote
0answers
186 views

What cryptographic primitives use AES or its Round function?

I have found the following two block/stream ciphers or Hash Construction that make use of AES or its round functions A New 128-bit Key Stream Cipher LEX 3D: A Three-Dimensional Block Cipher ALE ASC-...
1
vote
0answers
49 views

Cryptographic Tagging of Information over an Insecure Channel

Is there an efficient algorithm for the tagging and location of information over an insecure channel, where two parties (the tagger and the intended recipient for the tag) can recognize a piece of ...
1
vote
0answers
31 views

Distinct keys but value revealing

Suppose we have a trust party $P_A$ that can be used to manage a data transfer from parties $P_I = P_i, \ldots, P_{i+n}$ which do not trust each others to a party $P_R$ which is also not trusted. ...
1
vote
0answers
216 views

Use of Initialization Vector in a Hash Function

Why is an Initialization Vector used in a hash function? Some hash functions do not seem to need an IV, why do other hash functions need one?
1
vote
0answers
44 views

How to prove that a perfectly secure cryptographic protocol is not possible in a given scenario?

This question was inspired from the discussion related to this question on security StackExchange. Now I was wondering given a scenario, is there a general approach to prove that a cryptographic ...
1
vote
0answers
60 views

What are the positive consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

What are the positive consequences for choosing 8 S-boxes for DES vs 1 S-box for AES? I could guess side channel resistance, but I can't find anything on it.
1
vote
0answers
135 views

Issue Factorization Quadratic Sieve

Good evening, I'm about to write my own quadratic sieve implementation in C using GMP library for large numbers. I'm facing an issue while attempting to do the last factorization step for the number: ...
1
vote
0answers
105 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $\...
1
vote
0answers
127 views

How to encrypt an image with logistic chaotic map?

I need to encrypt color images, using logistic chaotic map. Could you please recommend an algorithm for this? All the articles that I've found on the Internet are completely unclear.
1
vote
0answers
314 views

Encryption & decryption of integers using modular multiplicative inverse and extended euclidean algorithm

I'm looking for a neat algorithm, which is capable of encrypting an integer to another integer and decrypting it again AND is secure. When I was in university, my professor showed me an awesome way ...
1
vote
0answers
1k views

How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key. I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using ...
1
vote
0answers
495 views

How represent message in Menezes–Vanstone elliptic curve cryptography

I ask about represent message in Menezes–Vanstone elliptic curve cryptography I now encrypt function as follow $C_1 = (M_1 * K_1) mod\ P$ $C_2=(M2 * k_2) mod\ P$ My question is about how much the ...
1
vote
0answers
25 views

Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
1
vote
0answers
110 views

Parallel-resistant proof-of-work scheme without hidden knowledge

Follow-up to: Parallel-resistant proof-of-work scheme? Is there a proof-of-work scheme that: can only be solved serially; given the solution, can be verified in minimal time; deterministically ...
1
vote
0answers
299 views

Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
1
vote
0answers
153 views

Does anyone have a copy of the paper describing the HiSeC™ algorithm?

I'm trying to create a remote controller compatible with HiSec algorithm. It's so old that “National Semiconductor” (now “Texas Instruments”) discontinued NM95HS01/02 and docs are unavailable. Does ...
1
vote
0answers
72 views

Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done. Are there any Asymmetric Encryption Algorithms where the ...
1
vote
0answers
577 views

Method and explanation for calculating difference in speed between DES and RSA

Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
1
vote
1answer
132 views

Getting the Encryption Function From the Decryption Function + Decryption Key + Encrypted Item

Is it mathematically possible to always be able to get the encryption algorithm used to encrypt a certain item (file, number, text, ...etc.) by knowing the decryption algorithm that will be used to ...