Questions tagged [deterministic-encryption]

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm.

Filter by
Sorted by
Tagged with
1 vote
1 answer
168 views

Deterministic salt for KDF

What would be recommended way to make deterministic password based file encryption? I can use SIV mode, but KDF (like Argon) takes salt for which I could use SIV tag, but I cannot make it because I ...
LightBit's user avatar
  • 1,649
3 votes
2 answers
125 views

A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?

A HRNG that is NIST 800-90 compliant must use a DRBG in some way regardless of whether it adheres to a RBG1, RBG2 RBG3(XOR), or RBG3(RS) construction. This violates the requirement that the OTP is ...
randumb20's user avatar
3 votes
2 answers
649 views

Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?

NIST 800-90C defines 3 classes of random bit generation (RBG) constructions: RBG1, RBG2 and RBG3. All constructions must include a DRBG from NIST SP 800-90A. The particular construction in question is ...
randumb20's user avatar
2 votes
0 answers
15 views

When can the types of data be distinguished during the addition of encrypted data to a deterministic encrypted data set with equal proportions?

This question is about adding new data with different proportions to a dataset with equal proportions for each type of data, and determining at what point the added data can be distinguished. For ...
xiao's user avatar
  • 31
1 vote
0 answers
82 views

When could CPA work against non-deterministic encryption schemes?

Is there a non-deterministic encryption scheme that is vulnerable to a CPA? I got asked this in an interview and I answered with no but the interviewer said that my answer is wrong. Would somebody ...
mad0x60's user avatar
  • 111
1 vote
0 answers
74 views

Question about Security of Multi-Signature Scheme

I am a developer trying to follow best practice guidance as established by the IETF for my applications. I was researching standards for ECDSA key generation for some work that I have to do in the ...
librehash's user avatar
  • 145
1 vote
0 answers
131 views

Can I use content-derived deterministic encryption key with hybrid encryption?

My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
metala's user avatar
  • 11
0 votes
1 answer
133 views

Pseudonymization hashing using public key

I have logs containing sensitive data (mail addresses, usernames etc.) that need not only be made GDPR compliant, but in general be secured as best as possible, so anonymization/hashing would be an ...
Senshi's user avatar
  • 103
1 vote
0 answers
86 views

Katz/Lindell Problem 2.2 - Purpose of proof where you redefine the key space?

I am self-studying by using "Introduction to Modern Cryptography: Principles and Protocols" (2nd edition). I am looking at the following problem. Prove that, by redefining the key space, we ...
Foobar's user avatar
  • 247
5 votes
1 answer
306 views

What is the best way to pseudonymise IP addresses while retaining the ability to identify those that share a subnet?

Background: I'm developing an app that is based around registered users voting on stuff, and I want to create a heuristic that involves IP addresses as one way to flag accounts for further ...
Inkling's user avatar
  • 161
0 votes
0 answers
50 views

Necessity of non determinism for multiple message security

In Katz & Lindell's textbook (2nd edition)) is said, that only non deterministic encryption can lead to security for multiple encryptions. Now I looked at the experiment for multiple ...
Titanlord's user avatar
  • 2,224
2 votes
0 answers
80 views

Secure (sub-exponential time) FHE

In Gentry's easy FHE intro, it is stated that Researchers [1, 8] showed that if $\epsilon$ is a deterministic fully homomorphic encryption scheme (or, more broadly, one for which it is easy to tell ...
mikeazo's user avatar
  • 38.5k
0 votes
1 answer
118 views

One way text→text function

I need a way to map some printable text to other printable text. E.g.: Ian BoydKcp Zbas Notice some of the important ...
Ian Boyd's user avatar
  • 1,011
0 votes
1 answer
174 views

Deterministic data masking

We are building out data masking framework mainly to mask PIIs. Our scale is pretty large, and masking will be done at ingest time, so we want the masking to be done in a very performant manner. Some ...
Mandar's user avatar
  • 103
1 vote
1 answer
187 views

Ignoring the TAG of the AEAD-SIV encryption

I am working with personal data that contain Identifying attributes such as a player ID and i need to prepare the data for analysis purposes, therefore i need to pseudoanonymize the data beforehand. ...
user3160046's user avatar
0 votes
1 answer
74 views

Can any message be decrypted using a given ciphertext and an appropriate key?

Does the following proposition hold for any deterministic, symmetric cryptosystem $(\mathcal{M}, \mathcal{C}, \mathcal{K}, Enc, Dec)$? $$\forall C \in \mathcal{C}: |\{M'| \exists K \in \mathcal{K}: ...
Jeremy's user avatar
  • 101
0 votes
1 answer
753 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
Nitish Bhardwaj's user avatar
0 votes
1 answer
263 views

Deterministic Encryption - Generating IV from password key

I need to encrypt file and directory names/paths but I need the encryption to be deterministic. I need to sync the local files with a cloud storage provider so I can't use probabilistic encryption. ...
stackiee's user avatar
  • 101
1 vote
2 answers
2k views

Standard tools for deterministic RSA key generation using seed?

I'd like to resuse the mnemonic I have from bip39 for crypto in other domains such as ssh and tls, etc. Are there standard tools (ie, openssl) to deterministically generate rsa key/pairs given a seed ...
Scott Klarenbach's user avatar
2 votes
1 answer
121 views

Not understanding deterministic authenticated encryption (DAE) security definition

I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains ...
hakoja's user avatar
  • 2,715
0 votes
1 answer
401 views

Do probabilistic one-way functions imply deterministic one-way functions?

Suppose $f$ is a probabilistic one-way function. Then my question is, does there exist a construction of a deterministic one-way function $g$ based on $f$? Or is it possible that probabilistic one-...
Keshav Srinivasan's user avatar
0 votes
1 answer
251 views

Symmetric Encryption, meet in the middle attack, effective key length

What is the effective key length of a deterministic encryption scheme, given a meet-in-the-middle attack scenario when you encrypt five times (64 bit keys for each)? . Say the encryption scheme has |...
bb2prime's user avatar
0 votes
0 answers
137 views

What is the best deterministic authenticated encryption algorithm to date?

We have a main database where certain properties are PII and want to setup a read-only replica so other parts of the business can able to access (e.g. analytics) We'd like those PII properties to be ...
gtramontina's user avatar
3 votes
2 answers
686 views

Multiple (RSA) public key encryption how to verify others received the same information? Non-deterministic encryption

I have an RSA system between multiple parties. Alice takes the targets (Bob and Oliver) public keys and encrypts a message using them and sends it to them. All parties know each other's public keys ...
James Crash's user avatar
2 votes
1 answer
161 views

one-pass deterministic authenticated encryption

suppose there is a router with limited storage but good network connection; it could be a good worker for deterministic authenticated encryption on streams; that means it receives data from another ...
Cyker's user avatar
  • 729
0 votes
1 answer
87 views

Security of key bits under indistinguishability for randomized encryption

My question is about symmetric randomized encryption. Let c=E(k,m,r) be a randomized block encryption function where r denotes a random input chosen for each message block m. k and c denote the ...
Viren Sule's user avatar
2 votes
1 answer
119 views

Share secret non-interactively in a verifiable way

In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
Markus Knecht's user avatar
0 votes
0 answers
594 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
user67152's user avatar
5 votes
1 answer
1k views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
user67091's user avatar
6 votes
1 answer
476 views

Deterministic Authenticated Encryption with AES-OFB and HMAC

I have an encrypted column in a database that stores sensitive information. The existing encryption scheme is deterministic and a database index exists on the encrypted value to allow searching. I am ...
Nathan's user avatar
  • 135
7 votes
2 answers
5k views

Deterministic Encryption using AES

I am in need of a deterministic encryption algorithm I can use on social security numbers (9 character string, numbers only) that I will store encrypted in a MongoDB and need to be able to search for ...
josh's user avatar
  • 173
0 votes
2 answers
916 views

What Are the Risks of AES-GCM [Key, Nonce, Message] where Nonce = Message

A group of bankers will store sensitive financial information on a server owned by a third party. I represent the 3rd party server. The financial information will be stored as plain text on the ...
user66406's user avatar
7 votes
2 answers
17k views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
majackson's user avatar
  • 181
2 votes
2 answers
304 views

Search Over Encrypted Data

I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
Simão Dolores's user avatar
0 votes
2 answers
538 views

Does encryption using PRP mean indistinguishable encryption against an eavesdropper?

I am a student studying cryptography by reading "Introduction to Modern Cryptography". I have some confusion about encryption using PRP (e.g., AES). Briefly speaking, a keyed deterministic ...
kkita's user avatar
  • 3
-1 votes
1 answer
119 views

why Blum-Micali algorithm is deterministic algorithm

Can anyone give me the answer of the following question. Justify why Blum-Micali algorithm is deterministic algorithm ?
Zubair Ahmed's user avatar
1 vote
1 answer
521 views

Is there a deterministic one-way collision-free crypto algorithm?

I use usernames encrypted using a function f as ids of records. Users see records identified by f(username). I must not know real usernames. I want to be protected from attack when adversary who has ...
visa's user avatar
  • 13
1 vote
1 answer
737 views

Deterministic symmetric indistinguishable encryption

Are there any block-cipher modes (or symmetric encryption schemes in general) that are fully-deterministic, meaning same inputs lead to the same outputs (like for all modes with constant IV) and ...
dave4422's user avatar
0 votes
1 answer
796 views

AES in CTR mode, with a single key, and an IV derived from the plaintext

We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext. We found a library that uses AES in CTR mode, with a single key, and an IV based ...
Jacco's user avatar
  • 121
8 votes
1 answer
3k views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
inieto's user avatar
  • 183
3 votes
1 answer
408 views

Searchable Symmetric Encryption VS Deterministic encryption?

I am a beginner learning about encryption. The Searchable Symmetric Encryption is better than Deterministic encryption? When I say better I mean smaller leakage.
Robert's user avatar
  • 31
5 votes
1 answer
769 views

Katz/Lindell Problem 2.2

2.2 Prove that, by redefining the key space, we may assume that $\text{Enc}$ is deterministic without changing $\text{Pr}[\text{Enc}_k(m)=c]$ for any $m, c$. After banging my head against this ...
CRYPTONEWBIE's user avatar
3 votes
3 answers
5k views

How can a system be non-deterministic?

Newbie here, so forgive me if this is a stupid question. In math class we learned about RSA encryption (as a practical application of what we learned about the Euler phi function and Fermats little ...
Justin Sanders's user avatar
0 votes
1 answer
156 views

Is deterministic encryption appropriate for low entropy plaintext when CPA is not a concern?

We have a trusted application that observes sensitive identifiers, e.g. credit card numbers. We want to send data associated with these identifiers to an untrusted analytics service that will ...
Ben's user avatar
  • 113
2 votes
3 answers
292 views

Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?

For common multi-block encryption schemes (CBC, CTR, CFB, stream ciphers, etc), if they are forced to be deterministic, a change in the plaintext will change only the current block and maybe future ...
Daffy's user avatar
  • 2,379
1 vote
1 answer
548 views

Security of deterministic encryption that uses CBC mode and plaintext as iv

As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode? I am sure that the second block used as IV is different than the first block ...
Bobo Liao's user avatar
1 vote
0 answers
720 views

Deterministic Signing

A signature scheme has three algorithms (Kgen, Sign, Ver), Kgen is necessarily randomized and Ver is ususally determinstic. Show that it is without loss of generality to restrict the signing algorithm ...
cryptoMan2's user avatar
10 votes
3 answers
5k views

Are there deterministic private-key encryption schemes that are CPA-secure?

I'm assuming there can't be such schemes because CPA-security is equivalent to CPA-security for multiple encryptions, and an adversary can distinguish between $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_0))...
sahisb's user avatar
  • 113
3 votes
1 answer
402 views

Deterministic encryption for a limited space: using HMAC as IV [duplicate]

I need a deterministic encryption scheme. Objectives: Same plaintext is always encrypted to the same ciphertext. Related plaintexts are encrypted to unrelated ciphertexts. (For example, attacker that ...
v6ak's user avatar
  • 631
3 votes
1 answer
843 views

How to recover small messages from textbook RSA?

In the answer to the question Random unique key per message, safe to use key as IV? it was claimed that one can recover a random 128-bit textbook-RSA encrypted value using about $2^{64}$ steps. How ...
SEJPM's user avatar
  • 45.9k