All Questions

2
votes
1answer
53 views

Partial Known Message Pre-Image Attack on SHA-1

If the last 448 bits of a sha1 block input are known (only the first 64 bits are unknown). Is it possible to do a preimage attack using SAT solvers or something else? Or do I have to brute force all $...
1
vote
0answers
39 views

How does the user check whether $y < M$ without knowing all shares?

CRT-based Verifiable Secret Sharing Scheme In this paper, section 4 Verifiable Secret Sharing Scheme, the dealer phase and the combiner phase are as follows: Dealer Phase To share a secret $d \in ...
0
votes
1answer
28 views

Caculating Correlation for CPA attack on AES

I am having some trouble understanding how to calculate the correlation coefficient for CPA attack on AES. In the article Study of Deep Learning Techniques for Side-Channel Analysis and Introduction ...
1
vote
1answer
37 views

Repeated Vignère Cipher

I was looking into the Vignère Cipher when I thought of something. Would you improve the security of the cipher if you shifted each letter (from the text you want to encrypt) with each letter of the ...
0
votes
0answers
29 views

Chameleon hashes as encryption keys

I'm a newbie to cryptography and I have been wondering about the possibility of using Chameleon hashes as symmetric encryption keys. Here is my scenario and my thought process: Let us consider a ...
0
votes
0answers
106 views

Is this the right way to implement a One-time Pad? [on hold]

Intro You can use it to secure files on your computer, online communication and/or lists of passwords where you only need to remember one to encrypt and decrypt the others. It uses a symmetric cipher....
4
votes
2answers
108 views

Is it hypocritical to use AES-256 and RSA 2048 in the same application?

I see a common claim that AES-256 is the gold standard and is good future proofing, often in the same wind as "just use 2048-bit keys for RSA". Security documents seem to recommend both AES-256 and ...
0
votes
0answers
67 views

Yukel's Sieve - Factorization of Numbers into a Square Sieve

https://www.youtube.com/watch?v=liTTGeitpGQ https://www.youtube.com/watch?v=2nOwgiweyqc https://www.youtube.com/watch?v=rGwFsOG27DQ I came across these videos explaining a pattern that is found in ...
2
votes
1answer
33 views

Extracting Zip using Only the AES Key

I have set myself a little challenge, to see if I can decrypt my own text file from with a ZIP file... The AES Key from my encrypted ZIP is all I have managed to extract, how do I decrypt the ...
2
votes
1answer
62 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
1
vote
0answers
39 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
-1
votes
1answer
38 views

Length extension attack for file download

I am trying to understand the length extension attack. I found this tutorial where the author performs length extension on a file download URL. Original URL: http://example.com/download?file=...
0
votes
0answers
44 views

Show that CPA-security implies security against plaintext recovery

Consider the following experiment: $k = Gen(1^n)$ $m \stackrel{u}{\in} \{0,1\}^{l(n)}$ $c = Enc_k(m)$ $m' = B(1^n,c)$ Define the winning event as $m' = m$. I would like to show that if the ...
6
votes
1answer
371 views

Does Shannon perfect secrecy imply a deterministic encryption algorithm?

Consider an encryption scheme $(Gen,Enc,Dec)$ where $Gen$ is the key generation algorithm, $Enc$ is the encryption algorithm, where $c \leftarrow Enc_{k}(m) $ is taken to mean that the message $m$ in ...
5
votes
3answers
175 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
0
votes
1answer
35 views

Burmester Desmedt Key agreement. Is the division a floating point one or an integer one

As I look upon Burmester Desmedt algorithm: I notice that the intermediate key $K_i$ is getting calculated as: $K_i=(k_{i+1}/k_{i-1})^{x_i} \mod p$ Thus I wonder wheher the division $k_{i+1}/k_{i-1}...
0
votes
0answers
5 views

How does Argon2id store salts in PHP? [migrated]

The PHP implementation of Argon2id generates a salt for the developer. How does the application keep track of this salt? As a developer, how do I account for backups and otherwise ensuring that I don'...
0
votes
0answers
6 views

Attempt to encrypt plain text with RSA public key throws error “unable to load Public Key” [migrated]

I received an RSA public key from a colleague by way of a pem file: ...
0
votes
2answers
54 views

Question about IV from CBC/AES-256

I'm developing a program to encrypt and decrypt a file with AES-256/CBC in Java. And I want it to be safe enough. In my case, I generated random AES key for each file to encrypt and decrypt them. My ...
1
vote
1answer
64 views

Is a hashing algorithm considered broken if a collision happens under $2^{n/2}$?

If for example we would find a hash collision for SHA256 with $h(x) = h(x')$ for $x \ne x'$ and $x, \space x' < 128$ bit (meaning both $x$ and $x'$ are smaller than 128 bit), would SHA256 be ...
1
vote
1answer
28 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
9
votes
2answers
235 views

Does GCM (or GHASH) only provides 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
2
votes
1answer
46 views

Generating a small EDDSA curve

I have an application that would benefit from very small (e.g. 16-20 byte) EDDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" security, so ...
1
vote
0answers
51 views

Explaining Berlekamp-Massey Algorithm in simple/layman term?

My foundation in Mathematics is not great. But I would like to understand how Berlekamp-Massey Algorithm works and how it is used in lay-man terms. The only thing I find out there is the emphasis on ...
2
votes
0answers
43 views

Understanding LFSRs and Berlekamp-Massey Algorithm [duplicate]

I have a tutorial question which focuses on LFSRs and Berlekamp-Massey Algo (which is totally out of my syllabus). Please forgive me if my questions seem stupid. I'm given these information: {"...
-1
votes
0answers
24 views

Feistel cipher - how to calculate the round function [closed]

If i have for example on the right side: 1110 and as a round key: 1100. What is the output of F(1110,1100)?
1
vote
1answer
71 views

ChaCha with 64bit integers as a PRNG with streams

Can I use ChaCha with four rounds as a good non-cryptographic PRNG with different streams if I use 64 bit integers instead of the standard 32 bit integers? I need a bigger state and this seems the ...
-1
votes
1answer
52 views

Equivalence of cryptographic problems

Are integer factorization, discrete log and ECDH problems equivalent? I know that factorization and discrete log are equivalent but are one of those two problem equivalent with ECDH? Cand someone ...
3
votes
0answers
41 views

Is there a bilinear map on a non abelian group or non cyclic group?

I've recently been studying a pairing map on cryptography. In usual definition, a pairing map is always defined on the cyclic group G. Is it possible to construct a bilinear map on a non-abelian group ...
-2
votes
0answers
43 views

Classical definitions of encryption and masking

What would be the difference between encryption and masking, using the definitions around 30-50 years ago? Currently all articles link to RODO (GDPR requirements for data masking and anonymization) ...
0
votes
0answers
44 views

Can we build a zero knowledge mapping using public-key encryption?

I'm trying to understand if this design is possible. I want to build a mapping that is zero-knowledge, between a (pubkey, proposalId) => bytes form, without ...
4
votes
0answers
57 views

Key size, performance, and security tradeoffs for AES-GCM, CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
0
votes
2answers
62 views

Why does Laravel only support AES-256-CBC?

Modern Laravel uses OpenSSL to provide AES-256-CBC encryption along with a MAC. However, I was under the impression that this is not a particularly secure approach. Why does Laravel only support AES-...
3
votes
1answer
49 views

SPHINCS and HORST: can we sign the same message twice?

I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
6
votes
4answers
3k views

One Time Pads and “Bit Flip” Attacks

One Time Pads and Vulnerability to "Bit-Flip" Attacks: I've seen it in this group, and apparently there are a (small) number of voices on the 'net opining that those relying on OTP are essentially "...
2
votes
2answers
106 views

Entropy of a random message chosen by an adversary from a subdomain

Assume we have a set of random bit strings: $S=\{s_1,...,s_n\}$, where each of them is of length $\lambda$ ($s_i\leftarrow\{0,1\}^{\lambda}$). We give the set $S$ to an adversary who picks one of the ...
-2
votes
0answers
39 views

how can we write the code for order preserving encryption? How can we prove that OPE is cryptograhically secure? [closed]

I am working with order preserving encryption for secure query processing. Can anyone please help me to get the basic algorithm or code for order preserving encryption?
3
votes
1answer
68 views

Golomb's Randomness postulates

In Handbook of applied cryptography, Golomb's randomness postulates are given: Let $s$ be a periodic sequence of period $N$. Golomb’s randomness postulates are the following. R1: In the cycle $s_N$ ...
-1
votes
0answers
41 views

what is the name of the following protocol? [closed]

I have 2 parties (A and B) who don't trust each other. My goal is to design a protocol so I ensure they trust each other. I'm thinking of a name to such protocol like "with No A2B Prior Trust"?
0
votes
0answers
24 views

Dynamic accumulator with only non-membership witness

Goal: Construct a dynamic accumulator which can add elements and provide non-membership witnesses. I wanted to know if my construction is correct. Consider a group $Z_p$ where $p$ is prime number. ...
3
votes
1answer
59 views

In NIST modulus and key size recommendations is `group` equivalent to modulus and `key` equivalent to exponent?

Looking at the following NIST recommendations for a discrete logarithm, for 2016-2030 and beyond they list 3072-bit number for the group and 256-bit for the ...
2
votes
0answers
45 views

How can I determine the Hill cipher key in this case?

I have been struggling with a Hill cipher problem for many days, without any luck. I have the following ciphertext, which I know is an encrypted excerpt from an Edgar Allan Poe story: ...
4
votes
1answer
181 views

Can we estimate the loss of entropy when applying a N-bit hash function to and N-bit random input? [duplicate]

Someone pointed out recently to me that a cryptographic hash function " is not designed as a bijective mapping from N bit input to N bit output". So if I feed an N-bit cryptographic hash function ...
0
votes
0answers
26 views

Speeding up quotient determination in high-radix montgomery modular multiplication

In this paper Simplifying Quotient Determination in High-Radix Modular Multiplication, the authors have proposed to replace the original modulus $M$ in Montgomery Multiplication $ABR^{-1} \bmod{M}$ to ...
1
vote
1answer
40 views

64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext

I have a question from an exam; We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 ...
1
vote
2answers
55 views

Integrity check of a binary firmware file with hash function

I need to provide a mechanism that it is possible to verify the integrity of a firmware image flashed on an embedded system. The procedure should be, that if someone has doubt on the firmware’s ...
0
votes
0answers
14 views

Setup phase in Ciphertext-Policy Attribute-Based Encryption

I am having hard time understanding the setup phase in Ciphertext-Policy Attribute-Based Encryption. What is the role of each parameter?
0
votes
0answers
19 views

What are dual codes and the codewords denoted by these dual codes in terms of trace?

I am currently reading a research paper (linked below) that mentions "Consider only maps that vanish at 0, their short codes $C_f$ and their duals $C_f^\perp$. The duals can be written as $C_f^\perp = ...
1
vote
1answer
57 views

Inverse of an element in a RSA group

Consider a RSA group $Z_N$ for $N=pq$, where $p,q$ are large prime numbers. Under strong RSA assumption, can an adversary efficiently compute the inverse of a random element $z$ from $Z_N$ without ...
1
vote
1answer
24 views

What is the link between the parity check matrix, double-error-correcting codes and APN permutations?

I am currently reading a research paper (linked below) which mentions that a map $f:V:=GF(2^{m}) \rightarrow V$ which vanishes at 0 is APN if it satisfies the condition that it is a binary code $C_{f}$...

15 30 50 per page