All Questions

3
votes
2answers
151 views

Is forward secrecy overhyped or necessary?

Forward Secrecy, also perfect forward secrecy, gives assurance about session keys even the private key is compromised. This is achieved by generating a random key per session without using a ...
-1
votes
0answers
30 views

Is simple EC arithmetics enough to construct security proofs?

Using the simple rules of modular arithmetics for Elliptic Curves, including associative and commutative rules for $+$ and $*$, where uppercase letters are points and lowercase are scalars on the ...
-2
votes
1answer
46 views

Method for generating random number(s) [closed]

I was reading about random numbers and their usage in security. I'd like to verify with more experienced people how good this method of generating random numbers will be. Human beings are very hard ...
6
votes
0answers
60 views

Offline Group Key Agreement - Cross Device Syncing

I have a specific use case I am interested in. I have spent the better part of the night reading research papers. I am beginning to believe what I want is not possible so I wanted to confirm here. ...
-1
votes
1answer
38 views

What is the difference between Forgery and Chosen-Message Attacks?

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...
2
votes
1answer
45 views

Niederreiter cryptosystem

I can't understand how Niederreiter cryptosystem works. If $c=mH^{'T}$ than why we cannot compute $m$ directly by multiplying $c$ with the $(H^{'T})^{-1}$? Can you give me an example of a "fast ...
0
votes
1answer
95 views

Is LibreSSL affected? - Downgrade Attack on TLS 1.3

https://news.ycombinator.com/item?id=19111707 https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/ No ...
1
vote
1answer
62 views

Implement Google Adiantum else where?

Google made the headlines with its new Adiantum encryption method, and i read (TechCrunch) that: In the meantime don’t expect any instant gains, but future low-power devices may offer better ...
0
votes
0answers
55 views

Is RSA in decline across the board?

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA. Is this the general case?
-1
votes
1answer
51 views

Is a hash more or just equally representative of the first [hashlength] bytes of the hashed one-time pad?

[Clarification edit further down.] To distinguish already existing one-time pad files by their content instead of just their name ... ... is hashing meaningful? Or would the first X bytes (Length ...
0
votes
0answers
23 views

To get 128-bit security for RSA, the modulus should be 4096 bits. How was that determined? [duplicate]

My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it. For something like AES with a 128-bit key, it's straight-...
15
votes
9answers
5k views

Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?

Let's assume a text file that grows at its very end but is otherwise not edited. We now have 100 transmissions of this, but OTP-encrypted (different OTP each time, of course). The first 50% of the ...
0
votes
1answer
23 views

Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
3
votes
2answers
319 views

Encrypting between nodes that have RSA keys: Diffie-Hellman or random secret key?

I have two peers with RSA keys; they want to encrypt a non-trivially sized message between them, so I want a random AES symmetric secret key, which is encrypted with Bob's public RSA key, and sent ...
-1
votes
1answer
44 views

If I hash ABC123, where ABC123 appears five times inside the file, will each of the five instances of ABC123 appear as identical hash values? [closed]

If I hash the word SOUND, where the word SOUND appears five times inside the file, will each of the five instances of SOUND appear as identical hash values?
0
votes
1answer
71 views

Storing passwords in a publicly available database

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...
1
vote
0answers
55 views

Participant workflow in the Cryptography competitions [closed]

I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2. What I'm wondering is what people generally ...
-1
votes
0answers
48 views

Finding $P$ when we know $2\times P$ in given Elliptic Curve [duplicate]

For a given elliptic curve $E$ like this $y^2 = x^3 + Ax + B \pmod p$, can we find the point $P$ if we know that the $Q = 2\times P = (a, b)$? For example $E:\ y^2 = x^3 + x + 1 \pmod {10007}$, we ...
0
votes
1answer
38 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
-1
votes
1answer
72 views

Original papers for hashing functions

I would like to learn how hashing functions are discovered / created. In part of this process I think it would be helpful to see the original works or papers of any authors of cryptographic or non-...
2
votes
0answers
43 views

Adding new share (Shamir Secret Shares ) [duplicate]

I am using this https://github.com/gburca/ssss-js Shamir implementation. I generated 4 shares from secret (threshold of 2). I am wondering if I can recreate (interpolate) original polynomial from ...
3
votes
1answer
49 views

What is the purpose of an Authentication Tag in AEAD encryption schemes?

AEAD encryption schemes produce something referred to as an "authentication tag." What does this tag consist of, what is its purpose, and is the tag itself human-readable data such as a plaintext ...
1
vote
0answers
24 views

Witness-Extended Emulation

I am reading up on Sonic: Zero Knowledge SNARKS from Linear - Sized Universal And Updateable Structured Reference Strings. An excerpt: For soundness, we do not use the standard definition of ...
2
votes
1answer
39 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
2
votes
1answer
40 views

Amplifying PRF Advantage

I am trying to solve this question and I have no idea how to find the value for $q$. I know that I am supposed to find the probability of $q>3q/512$ in terms of the equation $q$, but not sure how? ...
3
votes
1answer
42 views

What does 2-flat mean when discussing APN permutations?

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...
0
votes
1answer
71 views

The meaning of formal and semi-formal in cryptography

The question is about "formal" analysis, proofs, etc... What is a correct definition of a formal proof, or a formal analysis? Is there a good way and a bad way to formally prove something. What is the ...
3
votes
1answer
153 views

Diffie-Hellman private key recover with non-prime modulus

Say we have a classic Diffie-Hellman key exchange. We have the following parameters of a public key: p,g,y Where $p$ is the modulus, $g$ is the base, $y$ is the ...
6
votes
1answer
119 views

Distinguishing generators of RSA primes and moduli

We are trying to distinguish two RSA prime generators: Prime generator 1 draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$, until it is prime output $p$. Prime generator 2 ...
5
votes
0answers
69 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
2
votes
1answer
56 views

Find hash and signature algorithms used in an X.509 certificate signed with RSASSA-PSS

I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly. When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing ...
0
votes
0answers
50 views

Could be generated a symmetric key for every message?

I would like to use IES (x25519 and AES-GCM), but every message used a new session key, does that affect the performance of the system? do I need to used session key to refer to the key that used by ...
0
votes
0answers
13 views

Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
-1
votes
0answers
50 views

Prove that if a SES is statistically secure then it is computationally secure as well

Statistical security definition has a condition that the adversary is not computationally bounded which makes it stricter than Computational security but how would one mathematically prove it using ...
1
vote
1answer
44 views

How is overflow handled in word addition steps in Salsa20?

I feel like I'm completely missing something there. The quarter-round proceeds as follows: ...
3
votes
2answers
2k views

Example of cryptography random number

I read that random numbers are being used in cryptography and security. I think I have idea how to truly generate true random, non-deterministic number. But before continuing further I'd like to ask ...
0
votes
1answer
36 views

What is the difference between static and dynamic tokens?

First, what is the difference between hardware and software tokens? Tokens are "what you have" for example a car key or a chipcard. This would be (I think) hardware tokens? But what are software ...
1
vote
1answer
75 views

Is it safe to send IV in plain text for every request?

Currently, I am creating a project with an IoT device. This is an offline device which shows a QR code which can be scanned by a mobile device, which sends this code to a server. The server handles ...
1
vote
1answer
51 views

ZK due to rewinds, why we need poly number of rewinds?

I've been looking into rewinding techniques for proving ZK and got a bit confused. This answer is good, but I still have questions about challenge size and the number of rewinds. Consider an ...
2
votes
1answer
48 views

Emphemeral key creation from a long term shared secret (without DH)

Assuming I cannot use DH scheme, and the long term key is known to both sides, is there a known algorithm / standard that defines how to derive a short term key from a long term key?
1
vote
0answers
28 views

Rewinding Argument and Forking lemma

In Dan Boneh's crypto book, there is a section describing the "Rewinding Lemma", however I cannot find it explained in other sources on the internet. How does this differ from the forking lemma?
4
votes
2answers
490 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
4
votes
1answer
473 views

Is there a feasible preimage attack for any hash function (no matter how deprecated) today?

Has there ever been a hash function that was actually used in the field, no matter how long ago, for which there is now a feasible preimage attack? All hashes that are nowadays considered 'broken' (...
0
votes
1answer
124 views

What's an entropy measure for the sequence $0, 1, 0, 1, 0, 1, …$?

I'm puzzled by the measure $$E(S) = -\sum p(i) \lg p(i)$$ because I'm considering a source emitting $0, 1, 0, 1, 0, ...$ and having the maximum entropy as given by $E(S)$. Shouldn't $E(S)$ measure ...
0
votes
0answers
27 views

Mitigating leakage of asymmetric encryption scheme leaking the length of plaintext

Asymmetric encryption schemes do leak something about the encrypted plaintext: the length of the plaintext. How can this be mitigated? My solution: Padding the plaintext with some string of the ...
0
votes
0answers
24 views

How the ciphertext generated within a CP-ABE scheme is structured?

In ciphertext policy attribute based encryption 1 we use a tree structure with different keys into order to access attributes and the attributes are embedded to the ciphertext. Could you please let ...
-1
votes
1answer
101 views

How to change hash checksum of a text file without changing the contents in the file

I have created a text file called test.txt and the content of the file is Hello World I would like to change the SHA checksum hash without modifying the contents and filename. Is there any way to do ...
3
votes
0answers
52 views

1-digit MAC with error-catching properties?

The well-known Luhn check digit (used in credit-card numbers) is a public method to append a check digit on the right of a decimal number, so that any 1-digit alteration and any exchange of two (...
0
votes
0answers
23 views

Data masking / Data obfuscation for string int float and date , preserving order and exact matches

I've to mask data into some different value but to keep their property such as order an exact match (substring is yet impossible) What's the state of the art in data masking? I've some data on which ...
6
votes
1answer
244 views

Does Format Preserving Encryption have significant advantages over a randomly generated lookup table?

I have a need to anonymise phone numbers so that I can carry out testing and analysis work on telecoms data sets and comply with GDPR. I typically receive a batch of a few hundred thousand events ...

15 30 50 per page