All Questions

0
votes
2answers
47 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
0
votes
0answers
26 views

Bit based Division Property of AES MixColumn

I'm studying about division property that is proposed by todo et al. I have a question about division property for AES mixcolumn. In bit based division property, how can I calculate output division ...
1
vote
1answer
69 views

How should I address message size limits in RSA encryption?

I am making an end-to-end encryption software program in Java using RSA. I am using BigIntegers and its number theory methods. (I know this is a very slow approach, but I just want to learn to the ...
0
votes
1answer
85 views

Could a quantum computer recover files from ransomware if the attacker doubly encrypted them with RSA-4096?

How would a quantum computer decrypt a file (or find the keys to such a file) if it were encrypted with standard RSA 4096 encryption, but encrypted two times with different keys? The keys are known by ...
2
votes
2answers
94 views

Why aren't Complex number fields used in cryptography?

Most of the cryptography is limited to use of real integer fields. Complex numbers are seldom used. Is there any reason for it? Wouldn't complex numbers provide more structure? If there is already ...
0
votes
1answer
42 views

Question regarding of the ECC test vector format

I am trying to find some ECC test vector for using. I just find some post (like this) and github resource (like this ) They are good reference to my C test code but I'd like to get some more advice... ...
3
votes
0answers
66 views

As of 2019, what are the most important questions in zero-knowledge research? [on hold]

Important meaning; where the most research is being focussed. Maybe because a break-though seems possible or a break-through would have big consequences. Any questions that are being researched ...
-3
votes
1answer
71 views

how to decrypt if p=q in RSA [duplicate]

p,q should be different,but if I let p = q,and encrypt the plaintext,then I can't decrypt it,so can decrypt it?
0
votes
0answers
40 views

How to calculate RSA public key by modulus unknown format and exponant value?

I'm trying to calculate the RSA public key by modulus value and exponent value. I got the values from an API by Apple. You can find the API here. The documentation for the API can be found here. ...
1
vote
0answers
31 views

Meet-in-the-middle attack (on custom encryption scheme)

This is a question I had from an exercise session. Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES ...
2
votes
1answer
65 views

In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo? [duplicate]

I want to change some encryption options while using GnuPG to encrypt a file symmetrically. 1) However, for choosing the cipher algorithm, GnuPG has two commands and I don't know which one to use. ...
1
vote
1answer
67 views

RSA - Very big Modulus and Ciphertext

Is there a known weakness in RSA when the value of modulus (n) is very large? n = 2466 digits e = 65537 c = 2466 digits n cannot be factorized. I checked on ...
1
vote
2answers
85 views

Invalid curve attack: finding low order points

Background Here's a description of page 182 of "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes and Vanstone. Here's a quote from that page: The main observation in invalid-curve ...
1
vote
1answer
50 views

Is it possible to change the generator without knowing the private key used?

For example, prover sends P = xG and verifier somehow sends back P = xH without learning x. Is this possible?
3
votes
1answer
61 views

How would I prove a number is not within a range?

This would be the opposite of a rangeproof. For example, I wanted to prove that my number was not between 0 and 200 in zero knowledge? On a separate note: how would I prove that I hold a number, but ...
1
vote
0answers
54 views

How do I find an efficient sqrt algorithm for primes? [closed]

For example, If my prime was congruent to 3 mod 5. Is there a list where I can find for these primes which do not take the form 3 mod 4? Edit: Excluding the general tonelli-shanks algorithm
5
votes
10answers
534 views

Soft question: What are examples of beautiful proofs in cryptography? [on hold]

These may include any proofs, reductions, constructions, etc. For example, simple solutions to problems which at first sight seem difficult. Elegant construction that hide deep mathematical concepts, ...
0
votes
1answer
38 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
4
votes
2answers
307 views

Universal hash functions with homomorphic XOR property

Let $H = \{h_r : U \rightarrow [m]\}$. What are the currently known most efficient algorithms such that $H$ is a universal family and fulfils the homomorphic XOR operation property $\forall h \in H \...
1
vote
2answers
98 views

Alternatives to Mersenne Twister

We have Mersenne Twister pseudorandom number generator. It has several variants, CryptMT among them, that is of cryptographic grade. There are alternatives to Mersenne Twister, like Xorshift or ...
0
votes
1answer
42 views

Is the following non-interactive zero-knowledge set membership protocol provable secure?

Given the following Zero-knowledge set-membership protocol https://infoscience.epfl.ch/record/128718/files/CCS08.pdf]. That is given in the following steps (Please refer to page 9). The Verifier -...
-1
votes
1answer
83 views

RSA encryption, Number theory [duplicate]

In RSA algorithm we have the value of $e$ & $d$ exponent and also one of the prime numbers. My question is how to produce another prime number that is not equal to the first one and the digit of a ...
-2
votes
1answer
33 views

Given a point $c$ in a field $Z_p$. Can we get another value $c^{'}$ such that $\left(c^{\prime}-c\right)$ is invertible in $Z_p$?

If we have a point in a field $c$. Can we get another value $c^{'}$ such that $\left(c^{\prime}-c\right)$ is invertible in $Z_p$ ?
0
votes
1answer
88 views

Best practices when encrypting a file with three different ciphers [closed]

I have some files that contain important information, so I want to encrypt them by the most secure encryption method possible. I've read countless StackExchange answers on similar questions and some ...
6
votes
1answer
141 views

Are DSA and ECDSA provably secure assuming DL security?

Is there proof that the DSA construction, also used by ECDSA, is secure assuming that discrete logarithms in the relevant group representation are difficult?
0
votes
1answer
32 views

Questions about indexing a hash output to compose a final key

Recently I have watched the video Multi-Precision Arithmetic for Cryptology in C++, at Run-Time and at Compile-Time (at 21:56 seg) : The speaker says that to use a byte from the user key as a ...
57
votes
6answers
8k views

Soft question: Examples where lack of mathematical rigour cause security breaches?

Cryptographic tools can often become adopted even when their security proofs lack mathematical rigour - or altogether missing. Are there famous cases of security breaches in the industry, where the ...
4
votes
3answers
163 views

Ways to make white-box cryptography AES implementation more difficult to be broken

Background: I want to use white-box cryptography to hide the keys stored in a client application. I am looking for existing implementations of white-box cryptography, such as AES 128 or 256. But I ...
2
votes
1answer
49 views

How does changing input size affect The Goldreich-Goldwasser-Micali Construction?

If we want to construct a PRF that is length preserving, it is easy to show with hybrid proof that the resulting construction is a PRF. But what happens when we have longer input. Supose that the ...
-2
votes
2answers
73 views

question about RSA [duplicate]

I am very new in cryptography field, what I want to ask but I cannot find an answer is this: In public key cryptography, such as in RSA, does it matter if the adversary knows/can detect the public key?...
0
votes
0answers
65 views

How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
3
votes
2answers
55 views

Whats wrong with my El Gamal signature example

I'm trying to digitally sign a message m using El Gamal. So far I've been unable to verify the digital signature ive made using El Gamal. I am using prime number, p = 8369. prime root g = 3031. ...
2
votes
2answers
122 views

Hashing a hash for authentication

I currently use Argon2 to derive a key (I will use a salt which I will save in a file as plaintext for when I later need to derive a key again) from a given password which I will use to encrypt a file ...
1
vote
0answers
33 views

Is Hybrid Encryption CCA secure?

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' =...
2
votes
1answer
160 views

Asymmetric CSPRNG where the public key only works backward

Is there an asymmetric cryptographically secure pseudo random number generator in which the public key only goes backward? For example, I'd like to generate 5,000 digits, then provide the public key ...
4
votes
0answers
81 views

What is the “brand X” cipher mentioned in the Usenet thread about RC4?

In the original Usenet thread about RC4 when it was finally reverse engineered, a user by the name of Michael Johnson mentioned that the RC4 algorithm looked surprisingly like another proprietary ...
0
votes
0answers
37 views

Security of Nomenclators [closed]

A nomenclator is a type of cipher which has a codebook attached. The one I have in question is a numerical codebook with two homophonic ciphers and two distortion tables for the code groups. Could one ...
0
votes
0answers
24 views

Does the oracle have to have access to the encryption key to the padding oracle attack to work (CBC & PKCS#7)?

Does the oracle have to have access to the encryption key to the padding oracle attack to work (CBC & PKCS#7)? I tried much to get a attach to work, but the oracle doesn't have access to the ...
2
votes
2answers
93 views

Asymmetric keys (e.g. RSA) must be so much longer than symmetric keys (e.g. AES). Why? [duplicate]

I have been reading that RSA has to do with math (prime numbers), while symmetric key encryption deals with blocks of data and modifying the blocks with replacements and remappings, but I still don't ...
0
votes
1answer
156 views

Is there any theory to measures and determine the strength of an encryption protocol?

To determine the strength of an encryption protocol, there are elements like key size, Strength of an algorithm, Performance of an algorithm or etc, I have studied these topics but I could not find ...
0
votes
0answers
27 views

File Compare Deduplication In Cloud Computing

I want to implement a file level deduplication program in the clouds as part of my research paper. What are the basics that I need to get covered first before being able to proceed with this research. ...
1
vote
2answers
43 views

What is the Knowledge Of Secret Key Assumption (KOSK)

From what I've read it seems to be where an entity must prove that they own the secret key. Which is done by signing a message M using said secret key. Is this ...
-1
votes
1answer
37 views

Rijndaelcipher mix column query

I quote a wikipedi para that says The operation consists in the modular multiplication of two four-term polynomials whose coefficients are elements of ${\displaystyle \operatorname {GF} (2^{8})} $. ...
2
votes
1answer
48 views

How does the random oracle model simplify proofs versus using the standard model?

If I use the standard model, then the proof must rely on mathematical assumptions. Will this security proof, generally be longer/more complex? Is there an example where the random oracle has been ...
0
votes
0answers
19 views

Does proving security in the random oracle model ensure that using a hash function is secure?

In security proofs, I have seen the random oracle model and the standard model. If I prove security in the random oracle model, does this mean that if I use SHA-3, assuming sha-3 cannot be broken, ...
0
votes
1answer
43 views

Ciphers based on Keywords

I am looking for different ciphers that use a key word (like "hello" or "awesome") to encrypt a given text. I know about the Keyword Cipher already; I'm looking for others.
0
votes
0answers
21 views

Key Value Based Key Derivation

For a system that is using public key cryptography to authenticate users and their actions I'm trying to solve (ease) UI/UX problem so that users will be able to use login/passwords they're accustomed ...
0
votes
1answer
25 views

Can randomness protect a list of signatures against forgery attacks?

Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
1
vote
1answer
23 views

OT extensions paper: Why is $G_{m+1} \nleq m \times AND_B$?

I am reading this paper, in which Beaver shows how to take a small number of Oblivious Transfers (OTs) and extend them into an arbitrary number of OTs by implementing a pseudo-random number generator ...
1
vote
0answers
22 views

Question about the BCP cryptosystem

Is it possible to have a multiparty untrusted generation of the public parameters for the BCP cryptosystem (https://www.iacr.org/archive/asiacrypt2003/01_Session01/03_106/28940037.pdf), so that a ...

15 30 50 per page