Questions tagged [deterministic-encryption]

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm.

Filter by
Sorted by
Tagged with
13
votes
2answers
3k views

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

I was just going over my (old) notes from Coursera's Cryptography I course, and I was puzzled by the description of SIV as providing deterministic authenticated encryption (DAE). The general SIV ...
11
votes
1answer
1k views

What is Deterministic Authenticated Encryption?

I came across something known as deterministic authenticated encryption in my studies, and a lot of people were associating it with Synthetic IV mode. I am having trouble understanding what exactly ...
9
votes
3answers
3k views

Are there deterministic private-key encryption schemes that are CPA-secure?

I'm assuming there can't be such schemes because CPA-security is equivalent to CPA-security for multiple encryptions, and an adversary can distinguish between $(\mathsf{Enc}_k(m_0),\mathsf{Enc}_k(m_0))...
8
votes
1answer
2k views

Deterministic Encryption with AES GCM - how to choose the IV (nonce)

I have not a very large background in cryptography so I hope these questions are not very dumb. I don't want to reinvent the wheel, I'm just looking for advise on the best practices about how to build ...
7
votes
2answers
4k views

Security of Deterministic Encryption Scheme

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. Although we ...
7
votes
1answer
966 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector taken ...
6
votes
2answers
509 views

Do deterministic secret sharing schemes exist?

Are there algorithms for secure secret sharing such that the algorithm depends solely on the value being secured, relying on no randomness in its calculations. If there aren't, is such an algorithm ...
6
votes
1answer
330 views

Deterministic Authenticated Encryption with AES-OFB and HMAC

I have an encrypted column in a database that stores sensitive information. The existing encryption scheme is deterministic and a database index exists on the encrypted value to allow searching. I am ...
6
votes
2answers
3k views

Deterministic Encryption using AES

I am in need of a deterministic encryption algorithm I can use on social security numbers (9 character string, numbers only) that I will store encrypted in a MongoDB and need to be able to search for ...
6
votes
1answer
2k views

Public-Key Deterministic Encryption : Why does not provide perfect security?

I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon . Any ...
6
votes
2answers
3k views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
5
votes
1answer
539 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ is a nonce $m$...
5
votes
2answers
4k views

PRNG determinism?

Looking at getDefaultPRNG() in java.security.SecureRandom makes me very unsure about how to use it. On my desktop, it uses sun.security.provider.NativePRNG, which reads from ...
5
votes
1answer
718 views

Is this method of deterministically using CBC secure?

I'm trying to design a deterministic encryption scheme to enable searching in untrusted databases with the smallest possible IV overhead on ciphertexts. I know it's very bad practice but unfortunately ...
5
votes
1answer
528 views

Katz/Lindell Problem 2.2

2.2 Prove that, by redefining the key space, we may assume that $\text{Enc}$ is deterministic without changing $\text{Pr}[\text{Enc}_k(m)=c]$ for any $m, c$. After banging my head against this ...
4
votes
1answer
916 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
4
votes
2answers
6k views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
4
votes
1answer
1k views

Generating PGP key *without* random generator? (using fixed input only)

I understand why in general, a strong random generator or source of entropy is used when generating PGP keys. However, I have a use case where I want to generate PGP keys deterministically, i.e. ...
4
votes
0answers
481 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
3
votes
3answers
3k views

How can a system be non-deterministic?

Newbie here, so forgive me if this is a stupid question. In math class we learned about RSA encryption (as a practical application of what we learned about the Euler phi function and Fermats little ...
3
votes
1answer
2k views

CPA security of a stateless and deterministic encryption system

Why can no stateless and deterministic encryption system be IND-CPA secure? Is there a formal proof for it?
3
votes
2answers
389 views

Multiple (RSA) public key encryption how to verify others received the same information? Non-deterministic encryption

I have an RSA system between multiple parties. Alice takes the targets (Bob and Oliver) public keys and encrypts a message using them and sends it to them. All parties know each other's public keys ...
3
votes
1answer
549 views

How to recover small messages from textbook RSA?

In the answer to the question Random unique key per message, safe to use key as IV? it was claimed that one can recover a random 128-bit textbook-RSA encrypted value using about $2^{64}$ steps. How ...
3
votes
1answer
332 views

Searchable Symmetric Encryption VS Deterministic encryption?

I am a beginner learning about encryption. The Searchable Symmetric Encryption is better than Deterministic encryption? When I say better I mean smaller leakage.
3
votes
1answer
291 views

Deterministic encryption for a limited space: using HMAC as IV [duplicate]

I need a deterministic encryption scheme. Objectives: Same plaintext is always encrypted to the same ciphertext. Related plaintexts are encrypted to unrelated ciphertexts. (For example, attacker that ...
3
votes
1answer
456 views

Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , $...
2
votes
3answers
251 views

Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?

For common multi-block encryption schemes (CBC, CTR, CFB, stream ciphers, etc), if they are forced to be deterministic, a change in the plaintext will change only the current block and maybe future ...
2
votes
1answer
118 views

Does SIV mode work for asymmetric encryption?

In ECIES and similar asymmetric schemes, is it possible to use a hash of the plaintext as the IV?
2
votes
2answers
373 views

Is this a valid "fix" for deterministic encryption in encrypted databases?

It appears (after doing some light research) that for encrypted databases to be practical enough to be usable, deterministic encryption is required, specifically with regard to the type of encryption ...
2
votes
1answer
218 views

Encrypt user email but be able to find user by email

Sorry for my dumb question, but it's better to ask dumb question than to do dumb things silently. I want to encrypt user email in my DB so that if someone stole the DB (and not the key) - he won't be ...
2
votes
1answer
75 views

Not understanding deterministic authenticated encryption (DAE) security definition

I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains ...
2
votes
1answer
108 views

one-pass deterministic authenticated encryption

suppose there is a router with limited storage but good network connection; it could be a good worker for deterministic authenticated encryption on streams; that means it receives data from another ...
2
votes
2answers
254 views

Search Over Encrypted Data

I'm doing a research about how to search over encrypted data as the title said. And, I saw cryptDB used a cryptographic scheme from Song et.al's article Practical Techniques for Searches on Encrypted ...
2
votes
1answer
266 views

Weakening of Paillier cryptosystem due to ciphertext equivalence and order in CryptDB

The Paillier cryptosystem is probabilistic in nature and IND-CPA secure. By design given two ciphertexts one cannot distinguish whether decrypting those two ciphertexts will result in same or ...
2
votes
0answers
44 views

Secure (sub-exponential time) FHE

In Gentry's easy FHE intro, it is stated that Researchers [1, 8] showed that if $\epsilon$ is a deterministic fully homomorphic encryption scheme (or, more broadly, one for which it is easy to tell ...
2
votes
1answer
97 views

Share secret non-interactively in a verifiable way

In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
1
vote
3answers
2k views

What is the meaning of "probabilistic encryption algorithm"?

I am learning cryptography by myself, and I am not able to understand the meaning of "probabilistic encryption algorithm". How is it different from "deterministic encryption algorithm"? How can ...
1
vote
1answer
400 views

Is there a deterministic one-way collision-free crypto algorithm?

I use usernames encrypted using a function f as ids of records. Users see records identified by f(username). I must not know real usernames. I want to be protected from attack when adversary who has ...
1
vote
1answer
545 views

Deterministic symmetric indistinguishable encryption

Are there any block-cipher modes (or symmetric encryption schemes in general) that are fully-deterministic, meaning same inputs lead to the same outputs (like for all modes with constant IV) and ...
1
vote
2answers
834 views

(Re-)Using deterministic IV in CTR mode / How to: deterministic AES

I am aware of the requirement of an IV to be unique in CTR mode (Why must IV/key-pairs not be reused in CTR mode?). However I wonder if I can use an IV depending on the plaintext deterministically. ...
1
vote
1answer
272 views

Is a tweakable block cipher still considered deterministic in nature?

"a block cipher is a deterministic algorithm operating on fixed-length groups of bits, called blocks, with an unvarying transformation that is specified by a symmetric key. - Wikipedia " But with a ...
1
vote
1answer
68 views

Ignoring the TAG of the AEAD-SIV encryption

I am working with personal data that contain Identifying attributes such as a player ID and i need to prepare the data for analysis purposes, therefore i need to pseudoanonymize the data beforehand. ...
1
vote
1answer
582 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
1
vote
1answer
388 views

Security of deterministic encryption that uses CBC mode and plaintext as iv

As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode? I am sure that the second block used as IV is different than the first block ...
1
vote
2answers
247 views

Standard tools for deterministic RSA key generation using seed?

I'd like to resuse the mnemonic I have from bip39 for crypto in other domains such as ssh and tls, etc. Are there standard tools (ie, openssl) to deterministically generate rsa key/pairs given a seed ...
1
vote
0answers
438 views

Deterministic Signing

A signature scheme has three algorithms (Kgen, Sign, Ver), Kgen is necessarily randomized and Ver is ususally determinstic. Show that it is without loss of generality to restrict the signing algorithm ...
0
votes
1answer
601 views

AES in CTR mode, with a single key, and an IV derived from the plaintext

We need a system to compare cipher-texts for equality, without (the checking system) having access to the plaintext. We found a library that uses AES in CTR mode, with a single key, and an IV based ...
0
votes
1answer
43 views

Deterministic data masking

We are building out data masking framework mainly to mask PIIs. Our scale is pretty large, and masking will be done at ingest time, so we want the masking to be done in a very performant manner. Some ...
0
votes
1answer
54 views

Can any message be decrypted using a given ciphertext and an appropriate key?

Does the following proposition hold for any deterministic, symmetric cryptosystem $(\mathcal{M}, \mathcal{C}, \mathcal{K}, Enc, Dec)$? $$\forall C \in \mathcal{C}: |\{M'| \exists K \in \mathcal{K}: ...
0
votes
1answer
98 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...