All Questions

1
vote
0answers
5 views

Elliptic curve as a product of 3 cyclic groups possible?

I'm looking for some kind of 3-dimensional Elliptic curve. As far as I know a normal Elliptic curve like $$y^2 = x^3 + ax + b$$ over $F_p$ consists of one or two cyclic groups $Z_m (\times Z_n)$. ...
3
votes
1answer
63 views

Is it possible to validate an email address without the user actually revealing the email address?

Say hypothetically I want a service where users express their opinions. But those opinions are heavily dependent upon where they work, and the best way to prove that they actually work at a specific ...
7
votes
3answers
3k views

Why does the modulus of Diffie–Hellman need to be a prime?

I read a lot about Diffie-Hellman, but there is one thing I dont understand: why does the modulus p need to be a prime? What if it would not be a prime?
1
vote
1answer
49 views

SHA-1 collision for strings of two symbols

Is it possible to have strings of two (Unicode) symbols with equal SHA-1 hash? For example, smth like "ab", "ba".
1
vote
1answer
887 views

RSA: Is it possible to recover the plaintext given that we have the ciphertext and the public key?

The $N$ and ciphertext are huge number that is more than 600 digits long. I'm trying to find the prime factors of $N$ in order to get $p$ and $q$. Using $p$ and $q$ I can get $\phi(n)$. And using $...
1
vote
0answers
34 views

Zero knowledge proofs for a Merkle Tree

Say I have a publicly available Merkle tree, and I want to prove the existence of a leaf (containing a number, maybe) in the tree. I could give the path along with the siblings, for a normal Merkle ...
17
votes
5answers
17k views

Are there hash algorithms with variable length output?

I understand that for example MD5 produces a 128 bit hash value from a given text of variable size. My question is if there is a hash-like algorithm that will produce a hash value where one can ...
1
vote
0answers
23 views

berlekamp massey feedback polynomial

I have a couple of polynomials to find. Can anybody guide me with the steps to find the feedback polynomial using berlekamp massey's algorithm. Example: Key fragment: 10100100001001101001011 seed: ...
2
votes
1answer
37 views

Elliptic curves on finite fields

I've been reading: https://github.com/bellaj/Blockchain/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf On page 22 it shows an eliptic curve over F17. I have added the orange lines ...
1
vote
1answer
57 views

Can POS devices really generate random numbers?

I am doing an implementation of a system designed by a payment company and I am a little skeptical about the way they have designed the end to end cryptography. The system is as follows: There are ...
2
votes
0answers
17 views

Asmuth-Bloom Secret Sharing $m_0$ public?

i am trying to figure out how Asmuth-Bloom secret sharing works and followed the example on wikipedia and replaced it with own numbers. Namely, i used: $S=3$ $k=3$ $n=4$ $m_0 = 13, m_1=45, m_2=46, ...
2
votes
1answer
46 views

Can the Keccak sponge construction be used to create a random permutation of bit strings of length $n$, where $n$ can be any positive integer?

I need an efficient, invertible random permutation of $n$-bit strings, defined by a $128$-bit key. $n$ can be any positive integer from $6$ to $128$. I have no requirements on the security of the ...
1
vote
1answer
66 views

Choosing good entropy $g$ and $p$ for a classic Diffie-Hellman Key exchange

When selecting $g$ and $p$ for the Diffie-Hellman modular exponentiation: $ s= g^x \bmod p $ Which pairs of $g$ and $p$ are considered good nowadays, are recommended by bibliography? What I try ...
-2
votes
1answer
78 views

What is the difference between $\bmod{p - 1}$ and $\bmod p$

I have a doubt in my research work, can anyone tell me; What is the difference between $\bmod {p-1}$ and $\bmod p$
2
votes
0answers
12 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
-4
votes
0answers
17 views

Given a cipher text, How to start the attack on it? How to identify what cipher has been used to encrypt it?

I have a cipher text which contains english alphabets only. How to figure out what method has been used to encrypt it. It doesn't seems a good idea to try all known encryption methods.
0
votes
0answers
38 views

Strong pseudo random permutation implies CCA-security

Let $F$ be a strong pseudo random permutation and define a fixed-length encryption scheme $(\operatorname{Enc,Dec})$ as follows: On input $m \in \{0,1\}^{\frac{n}{2}}$ and key $k\in \{0,1\}^{n}$, ...
1
vote
1answer
22 views

AES-256-CBC with random IV - storing same plaintext as same ciphertext

I am encrypting some information stored in a column of a MySQL database. The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:...
14
votes
2answers
1k views

Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
0
votes
1answer
23 views

One-way function with combination sets as output / image

One-way functions generally operate on bit strings, for the input and the output. Are there any examples of one-way functions that produce a combination set in output? Let's call this function $f$. ...
9
votes
2answers
926 views

Is ECB mode secure if plaintexts are guaranteed to be unique?

I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few ...
5
votes
3answers
919 views

Is the 'Padding Oracle attack' deterministic?

I'm thinking about the example of Padding Oracle attack in CBC mode with PKCS7 padding given in Wikipedia. It says about the guess of the last byte in the plain text: In the worst case, they need ...
-1
votes
1answer
71 views

AES based question

The minimum key length for the AES algorithm is 128 bit. Assume that a special-purpose hardware key-search machine can test one key in 10 ns on one processor. The processors can be parallelized. ...
1
vote
0answers
35 views

Why (N+1)sec's mDP Implementation does not check whether all the XORED received $z$ values are 0

In the original mDP protocol once all $z$ values received from each participant the following calculation is being done: If either $XOR(z_1,z_2,...,z_n) = 0 $ or received invalid Signature then ...
1
vote
0answers
49 views

Diffie hellman: fixed modulus a risk?

In DH, are algorithms with fixed modulus p (large safe prime) to be avoided? What if it was changed every x minutes?
3
votes
1answer
225 views

Decrypting Ciphertext with partial Key Fragment using LFSR and Berlekamp-Massey

Edit Does the state register (the LFSR) always have to remain with 16 bits (I'm assuming yes). If so, are we shifting the register right by one (lfsr>>1) ...
1
vote
2answers
102 views

What exactly is the contents of the LDAP userSMIMECertificate attribute?

I'm trying to setup an LDAP with user certificates. I have already learned that certificates can be stored in either the userCertificate attribute in DER format, or ...
8
votes
2answers
631 views

Concrete evidence for the asymptotics of $\lambda_1(\Lambda^\perp(A))$?

A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications ...
2
votes
3answers
141 views

How to encrypt the truth table in garbled circuits?

I'm learning about garbled circuits, and I'm using the following tutorial: Yao's Protocol. I have a questions regarding to construction (encryption) of truth table in garbled circuits. Slide 14 says:...
3
votes
0answers
269 views

RSA - factorizing $N$ to get $p$ and $q$

I need to decrypt a message encrypted using RSA. I only know the public keys $n$ and $e$. I need to get the private key $p$ and $q$ in order to get the decryption exponent $d$. Now to do so, I know ...
2
votes
1answer
1k views

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
0
votes
0answers
17 views

Which Auxiliary Hash Function to use for Pointcheval's mDP protocol

I study GKE+P group key agreement protocol presented on paper Flexible Group Key Exchange with On-Demand Computation of Subgroup Keys by Michel Abdalla, Céline Chevalier, Mark Manulis and David ...
1
vote
0answers
34 views

SEAL - binary encoded ciphertext

In SEAL, am I able to convert a ciphertext that is encoded with polynomial to a ciphertext that is encoded as binary?
1
vote
0answers
14 views

Temporal or spatial digital signatures

Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the ...
8
votes
5answers
769 views

Entropy vs predictability in PRNGs

If entropy is the measure of surprise, and a given PRNG has a uniform distribution, then the entropy would be high. So the Mersenne Twister(MT) has high entropy. But the MT is also predictable. You ...
1
vote
1answer
31 views

Plaintext Size Limit for ECIES with AES-128 CBC mode

Using the ECIES (Elliptic Curve Integrated Encryption Scheme), is there a limit size of plaintext? (what is the maximum allowed number of bytes to be encrypted with ECIES).
1
vote
1answer
55 views

One-Time-Pad with multiple keys?

Would it be more secure if we used multiple keys in a One-Time-Pad encryption?
5
votes
1answer
79 views
+50

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
0
votes
0answers
28 views

Store the public key and private key [on hold]

i want to implement digital signature scheme in my form sign up in my web, and i read all PKCS from PKI but it made me little confused. i have many questions, where i store my public and private key ? ...
5
votes
1answer
143 views
+100

Proving that the least significant bit of an elliptic curve discrete logarithm is $0$

Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of primer order $q$. Can I prove to someone that ...
0
votes
0answers
21 views

RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will ...
-1
votes
0answers
19 views

is a safe prime subgroup length important?

For most cryptographers, my question may appear silly. Context: Diffie Hellman. Object: finding good primes. Code: given that NodeJS program: ...
2
votes
1answer
32 views

ElGamal variant

I came across this problem, while currently reading "Introduction to Modern Cryptography" by Katz and Lindell. I am new to crypto and just trying to go through the book and solve the exercises, ...
-1
votes
0answers
30 views

Secure comparison protocol

I want to implement the existing comparison protocol using SEAL. For private comparison checking the existence of a 0 is possible with DGK scheme. Is there any other way to do it without DGK scheme? ...
-1
votes
0answers
21 views

How to select best safe primes for DH <-> subgroups?

I run a test on some safe primes. Here is the code: ...
0
votes
0answers
13 views

Is my method of identifying remote ZMQ clients secure?

ZMQ provides a CURVE based authorization / encryption system based on certs/keys. After endpoints are authenticated to the server, they can send an "identity" with each request. Unfortunately they ...
-1
votes
1answer
34 views

Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification. I have taken the following example to learn about NI-ZK from this ...
8
votes
2answers
7k views

How many possible Enigma machine settings?

I'm trying to calculate the amount of settings the enigma machine has. I have found several sites regarding this topic, but it seems like there are two answers to my question. The first answer is 158,...
0
votes
0answers
45 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
5
votes
1answer
96 views

Why threshold number number of shares is required to construct secret?

In this paper of Asmuth–Bloom threshold SSS, the algorithm is as follows: Shares Distribution To distribute n shares of a secret $K$ among the set of participants $P = \{ p_i : 1 ≤ i ≤ n\}$, the ...

15 30 50 per page