All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Efficient way of generating a random number of N (less than 64) bits with exactly M bits equal to one

Would there be an efficient way to implement a function with the following signature: unsigned long long int random_word(size_t n, size_t m) that would generate ...
0
votes
1answer
15 views

CCA security of this schema

Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly ...
1
vote
1answer
41 views

Do Partially Homomorphic Encryption schemes also suffer from noise overflow?

Do PHE schemes in general also suffer from noise overflow problem?
3
votes
1answer
148 views

Randomness Testing of Cryptographic Algorithim

I am new to algorithim randomness and confused at I guess a basic level question. Is it common for any cryptographic algorithim to have repetitions in its output i.e.let say 34 and D8 are two ...
2
votes
2answers
108 views

How can we effectively compute the sqrt of some element in the group?

I only know one way, if this group is a cyclic group, and we know the element can be expressed in $g^m$, then $g^{(m/2)}$ is the answer. Another question, if $m$ is an odd number, can we be sure ...
-1
votes
0answers
12 views

Decode/decrypt Cipher text of unknown custom algorithm [on hold]

I have a university assignment by the professor to decode unknown encoding schemes but i haven't able to decode. The message is sample of communication between Indian external affairs to different ...
0
votes
0answers
17 views

Does BLS aggregating signatures allow duplicate signatures?

If there is a message $m_1$ that $H(m_1) \rightarrow g^r$ and there is another message $m_2$ that $H(m_2) \rightarrow g^k$, where $g^k$ is also a generator of $G$, is this possible? then $g^r$ could ...
2
votes
1answer
54 views

Statistical Analysis of Cryptographic Hashing Algorithms

I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256? To be specific, how will I generate ...
0
votes
0answers
22 views

1-out-of-2 Oblivious Transfer Security

Just started reading Oblivious Transfer. I am searching for a proof of security based on RSA implementation but I can't find anything simple to understand. Can someone direct/show me to an easy to ...
2
votes
0answers
44 views

Pollard's $(p - 1)$ factorization method runtime

Wondering if anyone knows a good reference for Pollard's $p-1$ algorithm's runtime? I was looking on the Wikipedia page and the runtime cited there is $\mathcal{O}(B\cdot \log B\cdot \log^2 n)$. ...
0
votes
1answer
56 views

How are Data Science and Cryptography related?

Is there any interesting connections between Data Science And Cryptography. Data Science involves using Statistical Analysis to analyze data while Cryptography also involves Statistics in ...
0
votes
0answers
33 views

How does the challenger choose the message randomly in the one-wayness game of PKE?

I have read some papers that give the definition of one-wayness of PKE schemes. Let $\Pi = (G,E,D)$ be a PKE scheme, and the security game of OW-CPA is defined as follow: $$\mathrm{Adv}_{\Pi,\...
0
votes
1answer
48 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
0
votes
1answer
22 views

Classification of BFV and CKKS scheme?

I would just like to ask what is the classification of both BFV and CKKS scheme are they Somewhat Homomorphic or Fully Homomorphic? Brakerski/Fan-Vercauteren (BFV) [Brakerski12, FV12, BEHZ16, HPS18] ...
1
vote
3answers
99 views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
1
vote
1answer
100 views

Is it safe to reuse the password when using AES-CTR with scrypt?

I want to encrypt several files with the scrypt encryption utility. Here is an overview of its file format, which gives an indication of what it does: ...
0
votes
0answers
29 views

In using Boolean Circuits model of Computation in Homomorphic Encryption why is is considered fast?

I am currently doing some reading on Homomorphic Encryption for research purposes and based on my reading using the Boolean Circuit Model of Computation specifically in regards to Fast Fully ...
0
votes
0answers
6 views

CP-ABE implementation in cpabe toolkit

I have designed a CP-ABE scheme which is different from original scheme by bethencourt. Now the cp-abe toolkit supports the original scheme and in order to use the toolkit for my scheme I have to ...
0
votes
1answer
38 views

Finding and matching SHA512 Unsalted Hash

We are given a list of possible strings, there are $32^{16}$ ($=2^{80}$) to be exact. We also have the unsalted SHA512 of the original target string. How long would it take to go through those ...
1
vote
1answer
30 views

What does (06) in “CRL Signing (06)” mean?

In "Certificate details -> key usage -> CRL Signing (06)", what does "(06)" in "CRL Signing (06)" mean?
4
votes
0answers
52 views

Is it possible to construct a hash-based public key encryption scheme?

I know hashes can be used to construct symmetric encryption schemes (HMAC running in counter mode), signature schemes (SPHINCS), pseudorandom generators, etc. One thing that's missing is public key ...
7
votes
1answer
332 views

Algorithm to find primes $q$ and $p$ with $q\, |\, p - 1$?

I understand that if $p$ is prime then $p-1$ must be composite (at least divisible by $2$ as it is even). But how does an algorithm find a prime $q$ such that $q \cdot r = p - 1$. I thought prime ...
0
votes
1answer
24 views

why is index “a non-negative integer less than $2^{64}$” in the KDF for UMACs?

https://tools.ietf.org/html/rfc4418#section-3.2.1 describes the parameters for KDF as follows: ...
-2
votes
0answers
33 views

Hey, anyone know if this is a color cryptography? If yes what? [on hold]

Me and a group of friends are solving an ARG, we found some videos where every frame was an image like this one.
2
votes
0answers
35 views

Are there any symmetric Partial Homomorphic Encryption Schemes?

Note that I am asking specifically for Partial Homomorphic Encryption (PHE) schemes and not Somewhat Homomorphic Encryption (SME) schemes. I believe there are several SHE schemes that are symmetric ...
3
votes
0answers
76 views

RSA, factoring with middle known bits of one prime?

It was shown by Coppersmith, that we can factor the RSA modulus with half of the most significant bits of one of the primes. And for the lsb case, assume that we known $p_0,k$, and $p=p_12^k+p_0$. ...
0
votes
0answers
32 views

Decrypting a weak PRNG Mersenne Twister Stream Cipher

I am currently working on the crypto-challenges presented here. I created a simple stream cipher using a Mersenne Twister RNG. It basically works as follows: Seed a RNG with the key (basically up to ...
0
votes
0answers
32 views

Generating anomalous elliptic curves with given order [on hold]

First of all please see this paper, I want to fully understand the section 3 and 4 of this paper and write a script that generates an anomalous elliptic curve with given prime order. Furthermore how I ...
3
votes
1answer
40 views

General factoring and one-way functions

Let a function $f$ be one-way, if there exists a probabilistic polynomial time algorithm to find the preimage of $y = f(x)$ for uniformly chosen $x$ with non-negligible probability. Define the ...
3
votes
3answers
338 views

What security risks does exposing the size of the plaintext entail?

For this question my focus is exclusively on symmetric block ciphers (with a particular interest in AES256 in CBC mode). I have read much discussion on various ways to pad the plaintext so that the ...
13
votes
3answers
5k views

How do I detect a failed AES-256 decryption programmatically?

I have implemented a simple encryption/decryption program based on AES-256 in CBC mode1. Actually, it is more precise to describe it as a compression+encryption / decryption+decompression program. ...
1
vote
0answers
31 views

Security of querying multiple Merkle trees

Suppose Alice has committed to several sets of values using Merkle trees. For example, let's say there are 2 sets of values, and each set represents leaves of a separate tree like this: $a_0, a_1 ......
1
vote
1answer
35 views

How to prove an encryption scheme is not CCA secure

Given the following context below, how does one show or prove the encryption scheme is NOT IND-CCA secure The IND-CPA secure private-key encryption scheme for n-bit messages can be constructed from a ...
0
votes
0answers
19 views

Partial key reuse in hash for one time pad cipher

There are 2 computers who are going to exchange lots of small packets of data between each other. To generate a shared secret, an elliptic key exchange takes place. If this key is hashed with the ...
3
votes
2answers
127 views

Why does square root $\pmod n$ find $p$ and $q$ (as $n = p \cdot q$)?

Let $n = p*q$, with $p \neq q$ and $x^2=1 \pmod n$, $x+1 \neq 0 \pmod n, x-1 \neq 0 \pmod n$ (So x is a non-trivial square root mod n.) I don't see how $\gcd(x+1,n) \in \{p,q\}$ follows. I ...
0
votes
0answers
26 views

Could this Method be Used to Create a highly Compressed Alternative to Merkle Proofs?

See equation below as I see an easier alternative, as I'm having trouble explaining it. Is there a hash function where many hashes can be combined together in a way where any single hash can be ...
3
votes
1answer
115 views

Does knowing that the exponent is in a certain range help solving discrete log?

given: $c=g^i \bmod P$ $g$ generator for group with group size $\varphi(P)$ $g,P,\varphi(P)$,c is known by the attacker He wants to know $i$. Now the attacker also knows $j,k$ with $j<i<k$ $k-j$...
0
votes
1answer
56 views

RSA vs Elliptic Curves

I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
1
vote
0answers
27 views

Unicity Distance of the Merkle-Hellman Knapsack Cryptosystem with Hidden Public Key

The original Merkle-Hellman scheme has undergone many successful attacks, the most famous being Shamir's from 1982. As Shamir noted about his method, "An important property of the proposed attack is ...
0
votes
0answers
22 views

What text encoding scheme is this? [on hold]

Sorry in advance; I'm not sure where to ask this. http://www.eventresourcespresents.com/artist_search If you search for any text at the above link, what you search for will be encoded in the new url....
3
votes
0answers
42 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
2
votes
2answers
75 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
3
votes
1answer
159 views

Decrypting arbitrary numbers with RSA

I want to construct a hash-chain where I want to share millions of small AES-128 keys with Bob over a period of time. Bob should not be able to predict the future keys if he knows the past keys. I ...
2
votes
2answers
87 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
0
votes
1answer
68 views

Proving the CCA-insecurity of El Gamal encryption scheme

I am trying to prove that El Gamal Encryption is not CCA-Secure. If an adversary queried the encryption oracle for the encryption of $m=1$, he'll get a pair $(c_1,c_2)=(g^y,g^{xy}\cdot m)=(g^y,g^{xy}\...
-2
votes
0answers
27 views

How to compute the number of instructions in python [on hold]

Could you please tell me how I can compute the number of instructions of a program written in python. thanks
-1
votes
1answer
63 views

How do discrete logarithm with modulo a prime and a non-prime compare?

Let $c_N = g^i \mod N$ and $N=p \cdot q$ and $c_P = f^j \mod P$ and $P$ a prime We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
0
votes
1answer
38 views

What is / How would I calculate the number of bits(?) I need to make the probability of a collision very small?

If I wanted to create a TOTP-esque algorithm that generated a string n characters long, with each character being a base64 character, generated from a user secret <...
6
votes
1answer
68 views

Limitations of boolean and arithmetic circuits

Much of modern cryptography is based around working with boolean or arithmetic circuits. For example in Multi-Party Computation the 'famous' results allow for the secure computation of any function ...
1
vote
1answer
57 views

Cipher recommendation for known-plaintext attack

I need to encrypt a 4-digit number. The cipher-text can be up to 11 digits long and there are no limits for the key size. Considering that the attacker has access to both the cipher-text and the ...

15 30 50 per page