All Questions

0
votes
0answers
47 views

Verifying valid public key and finding private key? [duplicate]

A naive user of RSA has announced the public key $n = 2903239, e = 5$. Eve has worked out that $n = 1237×2347$. Verify that the public key is valid and explain why the private key is $d = 2319725$. [...
2
votes
1answer
57 views

How to compare the order of elements in cyclic groups?

In a cyclic group with randomly looking behavior like the one used in secp256k1, is there any known efficient algorithm to compare the order of two randomly given elements $P_1$ and $P_2$ and find out ...
1
vote
2answers
52 views

Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext? [duplicate]

I am reading a book about web security and they are now talking about AES CBC. After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain ...
0
votes
0answers
71 views

Computing a probability

Let $(w_1,\cdots,w_l) \in (\{0,1\}^\lambda)^l$, and $r_1,\cdots,r_l $ are chosed as uniformly random from $Z^*_q$ such that $r_1+\cdots+r_l=0$ and $q$ is a large prime number. Also, Let $F$is a ...
1
vote
1answer
37 views

Key, plaintext block and ciphertext block permutations question

Question: If a cipher’s key size is $k$ bits and its block size is $b$ bits, how many possible keys are there, how many possible plaintext blocks are there, and how many possible ciphertext blocks are ...
17
votes
4answers
4k views

Using Tweets as a Random seed

I would like to start by saying I know nothing about Cryptography and was reading up on how to choose a random seed and this link is something that I found. What I basically understood that the seed ...
2
votes
1answer
98 views

What is the point at infinity on secp256k1 and how to calculate it?

I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for ...
1
vote
1answer
37 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
2
votes
0answers
84 views

How should we assess the quality of steganography?

I am asking this question instead of extending the discussion of another question (Perfect Steganography). I did try starting a chat room (https://chat.stackexchange.com/rooms/87636/perfect-...
0
votes
0answers
4 views

Fail to Sign/Verify signinature in C# [migrated]

I am trying to use the .Net RSA functions to sign a Hash, but when i try to Sign the hash and then verify the Signed string it turns out false... Is this the wrong place to ask? (Is this more of a ...
0
votes
0answers
23 views

In AES is 0x11b is the specified field generator? [duplicate]

As I know all arithmetic operations in AES are done over $GF(2^8)$ so I want to know which field generator AES uses? is it 0x11B? and choosing another field generator would it give a different results?...
2
votes
1answer
70 views

One-round feistel network (DES) attack

I can't find out how to break 1 round of feistel network (obtaining the key). I understand why this equation takes place: $R_1 \oplus L_0 = f(R_0, k_1)$ EDIT: The function f looks like this: But ...
4
votes
1answer
60 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
3
votes
2answers
481 views

Can AES be used with a static key?

I am making an embedded system for a project that uses AES. As I cannot accommodate key generation (hardware constraints) I am using a static key. I can use another small algorithm to create dynamism ...
0
votes
2answers
88 views

How to create a private key using $n,e,d,p,q$ where $n$ is prime

Someone has incorrectly created a public/private key pair where $N$ (modulus) is a prime number. This makes $p$ and $q$ trivial as they they are $n$ and $1$. $d$ is solved from $d \cdot e = \bmod (...
0
votes
2answers
77 views

zero knowledge proof of encryption

I am trying to see if there is a way to prove that a ciphertext c was encrypted under a given Public Key, Pk, without revealing the plain text message m.
0
votes
0answers
8 views

Hybrid encryption tools besides openssl and gnupg? [migrated]

I'm looking for something off-the-shelf, or relatively simple/safe to construct, which can encrypt large (>2GB) backup files with a public/private keypair, and can be configured and deployed easily ...
3
votes
1answer
101 views

Fiat-Shamir zero knowledge protocol

In Fiat-Shamir protocol, the final calculation is $$y^2=x\,v^c$$ Where $c$ is the random $\{1,0\}$, $x$ is the witness and $v$ is the public key $s^2 \bmod n$. My questions are: What stops the ...
7
votes
2answers
401 views

Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN: It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
0
votes
0answers
42 views

Digital Signature Verification failed using SHA256withRSA in Python [migrated]

I am trying to validate the digital signature with given certificate files for the offline aadhaar KYC verification application. This instruction is given in the documentation for the verification. ...
-1
votes
0answers
18 views

maskGenAlgorithm for RSA signature with PKCS1-PSS padding [migrated]

I am generating RSA signature using RSA_PKCS1_PSS_PADDING. I am setting digest algorithm as SHA256 using EVP_get_digestbyname() and EVP_DigestSignInit(). And salt length parameter as -1 using ...
2
votes
1answer
69 views

Interlock Protocol for Preventing Man-in-the-Middle (MitM) Attack

Trying to turn bookish knowledge to practical: Alice sends half of the encrypted data to eve, eve eavesdrop and tries to decrypt the data and fails as eve has only half of the encrypted block. So, ...
5
votes
1answer
119 views

Are EC public key values evenly distributed?

At my Day Job(tm) we've encountered a bug wherein if the leading digit of the X or Y value of a public key are zero, "shit happens" (this bug is in our code - I'm not suggesting there's some problem ...
1
vote
1answer
77 views

Why does RSA signature need padding?

Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those ...
0
votes
1answer
25 views

Basic question on hash-based signature scheme

If a hash-based signature schemes such as W-OTS is used, do we still need public key based certificates to prove ownership of a public key? I understand that hash-based signatures are one of the ...
2
votes
1answer
47 views

Given a SHA-256 message block, is it possible to undo the transformation of the internal state?

Consider the transformation described in section 6.2 of RFC4634 ("US Secure Hash Algorithms (SHA and HMAC-SHA)"). Given the message block M(i), and hence the ...
0
votes
0answers
21 views

Rolling Code via Encrypted Index vs Pre-Generated Keys

I am planning on designing a system that needs a password to be operated, using a rolling key. Now I am facing two options, as far as I am concerned: Having an index saved, which will be incremented ...
1
vote
1answer
53 views

Message authentication vs entity authentication

Does message authentication authenticate the entity? If the answer is "No", because message authentications like MAC work with the shared symmetric key, then my second question is: Does a message ...
1
vote
1answer
73 views

Could the reversibility of adding function be considered a weakness to secp256k1?

I have just started studying cryptography and secp256k1. I just wonder that adding two points can be easily reversible when the generator point is publicly known. I mean that if $Q=\operatorname{...
1
vote
1answer
44 views

Definition of Short Authentication String

I am studying for my cryptography final and I passed by the following term: short authentication string. Please, can anyone explain it to me, thank you very much.
1
vote
1answer
99 views

Is There an Opensource Manual Calculation of AES-128 bit?

Is There an Opensource Manual Calculation of AES-128 bit as in Cronos I have to learn calculations manually.
4
votes
1answer
73 views

Magic Number to calculate number of rounds for M-R in FIPS 186-4

In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases. Does anybody ...
1
vote
1answer
67 views

Comparable or partially homomorphic public key derivation for signatures?

Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key? Example: let's say I derive a public key ...
2
votes
0answers
58 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
1
vote
0answers
78 views

What is meant by the term “hostile environment”? [closed]

I come across many time a term called ”hostile environment” in cryptographic literature. What does “hostile” mean exactly? Is it unknown third parties which are responsible for handling and routing ...
2
votes
1answer
181 views

why do we asume that in the registration process communication is over the secure channel?

I was reading some research papers and saw that in Registration phase/process it is always assumed that communication is over the secure/private channel, whereas, all of the phases communication is ...
0
votes
1answer
198 views

What is Perfect forward secrecy?

I have read that when a user contacts an entity like a bank, it creates a pre-master key and then selects a master key for subsequent communications. Can the lack of PFS, create a security flaw if ...
8
votes
1answer
380 views

Where would a “half round” come from?

In the hierocrypt-L3 description, the cipher takes 6, 7, or 8 rounds. Example source code also seems to follow this same specification of 8 rounds for 256-bit keys. Wikipedia shows 8.5 rounds for ...
1
vote
1answer
125 views

RSA2048 smallest possible modulus

what is the smallest possible modulus for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be. According to OpenSSL source ...
6
votes
1answer
92 views

What is the use of SCRAM-SHA-256 (over SCRAM-SHA-1)?

The Salted Challenge Response Authentication Mechanism (SCRAM) specified in RFC 5802 can use arbitrary hash functions to operate. The base version from RFC 5802 uses SHA-1. From my understanding, ...
2
votes
2answers
87 views

Why Random Secret Necessary Almost in all digital Signature Algorithms

I've read some introduction documents about digital signatures, and all they said is Signer calculates a hash of data to be signed. This hash is encrypted with the private key. Verifier reads the ...
1
vote
1answer
68 views

Using zk-snarks to check if value is greater than another

Can I use Zk-SNARKS to prove that a given secret value is greater than another public value. for Example to prove that secret_value >10 . if so How would such a circuit look I am using snarks.js ...
0
votes
0answers
12 views

Is there a way of “bitwise” decrypting a corrupt Bitlocker encrypted raw HDD-image [migrated]

I'm facing a situation, where I'd like to decrypt a "corrupted" Bitlocker protected drive (Windows 10 Partition) by using the known 48-digit recovery key. Corrupt means, I executed a restore (Windows ...
2
votes
0answers
42 views

What is modulo switching, in a nutshell?

Coupled with the terms bootstrapping and relinearization, the term modulo switching appears a lot in the FHE literature. What is it and how does it relate to the other two?
2
votes
0answers
44 views

Generation of a symmetric encryption key in TPM

I know that keys in a TPM key hierarchy are encrypted with their parent keys. And I read that those parent keys (for instance an asymmetric SRK) need to have some symmetric secret for said encryption. ...
3
votes
2answers
95 views

Lightweight block ciphers that support decryption with minimal overhead?

Lightweight block ciphers are mostly expressed for encryption routine and efforts are made to keep it as light as possible mostly in terms of gates count and power usage although some try to keep ...
2
votes
0answers
57 views

Concept for a RSA “repeater”. Is it sensible?

I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
1answer
65 views

Continuous logarithms in cryptography

Cryptographic procedures seem to almost exclusively use discrete logarithms rather than continuous logarithms. Hence, I assume there are good and sound reasons for this. In essence, answers provided ...
4
votes
1answer
59 views

Differences between NewHope-CPA-KEM and NewHope-CCA-KEM

According to the web page for NewHope, an R-LWE post-quantum key encapsulation mechanism (KEM) candidate for standardization, it comes in types that are or IND-CPA or IND-CCA secure. I know what CPA ...
1
vote
1answer
31 views

Using Yubikey to store PIN protected secret for disk encryption

I want to store a secret on Yubikey and used it for the disk encryption. The crucial is, I want it to be PIN protected. There are a limited number of PIN tries, and after three attempts the Yubikey ...

15 30 50 per page