All Questions

0
votes
0answers
13 views

Method for Cryptanalysis of a keyword-keyletter cipher?

I am a CS student who is in an introductory Cryptography course. I am not looking for the complete plaintext of this message, as I am not looking to cheat. I am simply stuck, and have no idea what to ...
0
votes
0answers
15 views

Building the private key for polynomial RSA

Suppose my cryptosystem is such that I have: $n=x^{2048} + ... + x^3 + x^1$ $c = m^e \bmod \ n$ How do I construct my private key $d$?
0
votes
0answers
13 views

maximum key stream sequence per key/iv pair in communication protocols

in the paper "LIZARD – A Lightweight Stream Cipher for Power-constrained Devices", one of the design rational of Lizard cipher is key stream size per key/iv pair. A5/1 produces only 228 keystream ...
0
votes
0answers
19 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
0
votes
0answers
7 views

getting decrypted message from RSA_public_decrypt? [migrated]

I signed/encrypted a message in buffer with RSA_sign(). When I decrypt the buffer with RSA_public_decrypt(), the returned value is a digest (X509_SIG) and is not the decrypted message. I want to ...
-1
votes
1answer
45 views

SHA-3 Step by step?

Can somebody explain me or give me a link of a step by step SHA-3 explanation it has been really hard for me to undesrtand it. I would love to see an explanation since it's input untill the digest is ...
0
votes
0answers
42 views

How does the squeeze function in the NaCL Poly1305 implementation work?

The NaCL ref implementation of the Poly1305 algorithm uses the following reduction function (which is called squeeze()): ...
0
votes
1answer
14 views

Needham–Schroeder fix by adding opponent's identity to the first message

Recap: Needham–Schroeder is as follows: $A \rightarrow B : \{A, N_a\}_{pk_B}$ $B \rightarrow A : \{N_a, N_b\}_{pk_A}$ $A \rightarrow B : \{N_b\}_{pk_B}$ Then, there is a MITM attack by Lowe ...
2
votes
1answer
53 views

I don't want to store passwords, can I use them as an encryption key for another field?

I'm not a 'cryptographic' anything, so if this is a super-dumb question please let me know (politely). So here's the deal, say I don't want to store passwords because that opens me up to all sorts of ...
0
votes
0answers
21 views

How to do division using Beaver Multiplication Triples

It is very straight-forward and intuitively to achieve addition, subtraction and even generalized polynomial using Beaver's Multiplication Triples. However division seems difficult to achieve on two ...
0
votes
1answer
18 views

RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU The encryption method specifies part of the encryption ...
6
votes
2answers
701 views

What does this paraphrase of the birthday problem mean?

The following is an excerpt from A Generalized Birthday Problem - David Wagner: One of the best-known combinatorial tools in cryptology is the birthday problem: Problem 1. Given two lists $L_1, \...
-1
votes
0answers
34 views

Cryptography over non-elliptic curves [duplicate]

I'm just curious, what is the decisive factor to be restricted to elliptic curves? In theory, as long as we have a generator $g$ to have a suitable key pair $K, k: k\in F_q $ such that $K\equiv g^k \...
0
votes
0answers
46 views

What does XOR mean in regards to AES cryptography? [on hold]

This might be too basic to answer but I am learning about the different modes of operation and I am trying to grasp the material and having trouble deciphering the meaning. I was just wondering if ...
0
votes
0answers
17 views

Mixed HMAC / GMAC with fixed IV

I was just thinking about improving the performance of HMAC - what would be the issues in doing the following: Let $G_K(IV,M)$ be GMAC with a key $K$, for IV and message $M$. Let $H$ be a secure hash ...
22
votes
1answer
2k views

Why does AES have exactly 10 rounds for a 128-bit key, 12 for 192 bits and 14 for a 256-bit key size?

I was reading about the AES algorithm to be used in one of our projects and found that the exact number of rounds is fixed in AES for specific key sizes: $$ \begin{array}{|c|c|} \hline \begin{array}...
2
votes
0answers
40 views

Impossible to construct collision resistant hash function from one way function

[Simon 98] showed that it is impossible to construct collision resistant hash function from one way functions in a black-box way. I read the paper but barely understood it. Is there any source, where ...
1
vote
0answers
46 views

Quantum Resistant Algorithms and types: PKE vs PKEs vs KEM vs KEMs vs DSS

I am trying to wrap my head around the second round Quantum Resistant Algorithm candidates currently under the NIST PQC Effort. Can someone verify if the following is a correct summary of the 17-...
0
votes
2answers
71 views

Can an attacker exploit the nonuniform distribution of letters in a diceware password to improve a brute force search?

I use some diceware pass phrases in some places but I have one question that I can't find the answer to. Let's say I roll the dice and get $N$ words with a total of $M$ letters and that I don't put ...
2
votes
0answers
40 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
3
votes
1answer
56 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
0
votes
0answers
21 views

EKCDSA Implementation [migrated]

I have two implementations of sign() for EKCDSA, one in Java (on BitBucket) and one in C (on GitHub. Java: ...
0
votes
0answers
23 views

HSM nCipher: OCS protected key with quorum m/n [on hold]

I'm developing a server that implements a stamping server using a key protected by an OCS. The current configuration uses a quorum of 1/3. So when the server is starting, it asks the passphrase of the ...
0
votes
1answer
28 views

Elliptic Curves for Pairings

how can is possible to know if an elliptic curve is suitable for protocols that adopt pairing? For example, in Certificateless Cryptography with pairing, is it possible to know if all elliptic curves ...
0
votes
0answers
19 views

Comparison between Paillier Homomophic Encryption and Public key Encryption with equality test (searchable encryption)) [on hold]

I am writing a paper where i am replacing C Paillier Homomophic Encryption and Public key Encryption with equality test (searchable encryption)). So i need to compare
0
votes
1answer
32 views

Why is it better to add and double points on an elliptic curve using projective space?

I have been given a textbook which defines the addition of two points on an elliptic curve and the doubling of a point on an elliptic curve. This textbook explains elliptic curves in projective space ...
1
vote
2answers
44 views

With randomized encryption, ciphertexts must be slightly longer than plaintexts in order to allow for more than one possible ciphertext per plaintext

Can anyone give me a simple example of this? "For example, if there are $2^{64}$ possible cipher texts per plain text, cipher texts must be at least 64 bits longer than plain texts" This is ...
1
vote
0answers
32 views

Prove that Alice’s solution x is equal to Bob’s plaintext m

The answer to the second part of this question exists already. However, I need help understanding how the first part of the question is solved. I have a feeling that it must have something to do with ...
1
vote
0answers
22 views

Linear combination IOP for SNARK registers

The STARK paper says Our ZK-STARK uses a separate Reed-Solomon codeword for each register, leading to w many codewords, each of lower degree ...
2
votes
0answers
23 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
0
votes
0answers
15 views

SEAL-CKKS max multiplication depth

I am trying to understand how SEAL-CKKS scheme works and I wonder what multiplication level can we achieve using this scheme? Like 100 possible?
2
votes
2answers
101 views

Why should one model an entropy source in order to build a TRNG?

Some assert that a theoretical model of the unconditioned source must be created when building any TRNG. It's believed to be a fundamental requirement. So a few related questions arise:- What is a "...
4
votes
2answers
63 views

Hardness of LPN problem with small secret

The Learning Parity with Noise (LPN) assumption states that, for a fixed secret $s$ chosen uniformly from $\{0,1\}^n$, then the distribution that outputs $(a,a\cdot s+e)$, where $a$ is uniform in $\{0,...
4
votes
0answers
99 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
4
votes
1answer
73 views

Are commutative digital signature possible?

Say we have a message $m$. Signer $S^1$ will sign this message using his digital signature to produce: $$\operatorname{Sign}_{S^1}(m)$$ Now, say another signer $S^2$ wants to sign the output of the ...
-1
votes
0answers
26 views

Decode location of an RSA encryption message [on hold]

You have intercepted an RSA encrypted message with encoding exponent 7221 and base 5829679010047531. Decode the location: 815427339135043, 5556391338134431, 2892812128428033. I have to find the ...
2
votes
0answers
46 views

Is it possible to check if a number is the product of two primes without factorizing it?

I have a large number which I suspect may be a private RSA key (although its size, at 613 bits, seems a bit unorthodox). I have started to run a factorization algorithm on it, and after a few hours ...
1
vote
2answers
42 views

Zero Knowledge for Low Entropy Witness

For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
0
votes
0answers
34 views

Cryptography and Security Self Learning [on hold]

I'm an IT developer but interested in Cryptography and Security. Not only I want to learn about cryptography but also want improve my skills for network security job roles. So I was looking for ...
0
votes
0answers
33 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...
0
votes
0answers
23 views

Convert affine to projective coordinates and vice versa in ECC? [on hold]

I am working on a small project. A point $Q=(1,38)$, using point doubling $\{ a=-3,p=43\}$, i got $2Q=(41,5)$. Now in projective coordinate $Q=(1,38,1)$ taking $z=1$. Calculating $2Q$, I get $2Q=(22,...
-2
votes
0answers
23 views

Part of a challenge, from a group of adults, who break ciphers [on hold]

I am part of a group of adults, a cipher club who like to decode random ciphers, from texts to symbols and other things. We were presented with a set of 5 ciphered text, and we have managed to crack 3 ...
2
votes
1answer
29 views

Attack on a Feistel Cipher given the key and half of the ciphertext

Consider a classical Feistel Cipher, with the round functions given and the keys used in the ciphering process. Is it possible to reconstruct the original data if half of the ciphered text is given? ...
0
votes
2answers
38 views

human readable unpredictable & no collision uid based on time

I need to create an unpredictable uid based on time. I plan to allow it to work during a time frame of 100,000,000 seconds. So the seconds will go from 00000000 to 99999999. I need an algorithm that ...
0
votes
0answers
25 views

Prove that a signature scheme is RUF-NMA and not EUF-CMA

I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
2
votes
2answers
26 views

Mathematical explaination of file encryption for multiple persons with multiple keys

Let's say I want to encrypt a document which only can be read by John, Mike, and Dave. This can easily done with PGP/GPG: Import John‘s, Mike‘s, and Dave's public key Encrypt the document using those ...
0
votes
0answers
12 views

I2P Tunnel Creation Build on Request Record Question en(de)cryption method

Not sure if anyone here can help, but if so, sure would appreciate the help. If we read the https://geti2p.net/spec/tunnel-creation documentation page on how I2P creates a tunnel, we can read on the ...
1
vote
1answer
66 views

Comparing Shanks' Algorithm to Brute Force

I'm trying to understand how/why Shanks' algorithm solves the discrete log problem $y=g^x \bmod p$ faster than a brute force search does. Any explanation would be great.
0
votes
2answers
70 views

Meet-in-the-middle probability of success

In page 358 of Bruce Schneier's Apllied Crypto, when explaining the meet-in-the-middle attack, he states that the success probability is «1 in $2^{2m - 2n}$» with two plaintext/ciphertext pairs, and «...
0
votes
0answers
22 views

How to use Windows User Certificate (S/MIME) to sign data [migrated]

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...

15 30 50 per page