All Questions

0
votes
2answers
65 views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
0
votes
0answers
25 views

A paper question about the security of hybrid encryption scheme

Why the decryptor can still use K to access the data even when K is updated? QAQ
3
votes
1answer
71 views

Where can I find open source code for Encryption Switching Protocol?

The concept of Encryption Switching Protocols was introduced in CRYPTO. I was wondering if there is any pseudo-implementation of the protocol available or can I get some insights on how to implement ...
2
votes
2answers
83 views

Monotonicity of min-entropy

Let $Z^t = (Y_1,\ldots,Y_t)$ be a sequence of random variables each taking values in $Y$. The random variables are not necessarily i.i.d but we know the joint distributions. i.e for every $z = (z_1,......
1
vote
0answers
51 views

Strongswan KDF Test

How can a KDF implementation for IKEv2 application, specifically in strongswan implementation case can be verified for conformance with NIST SP800-135, please? SP800-135 KDF recommendation further ...
0
votes
1answer
38 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
0
votes
1answer
56 views

Question on proof of coin-tossing in “how to simulate it”

I am reading Professor Lindell's "How To Simulate It - A Tutorial on the Simulation Proof Technique" paper, which is very enlightening. I am trying to follow through the proof of the security of Blum'...
3
votes
1answer
57 views

Zero-knowledge proof for Paillier parameters

For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters $(e,N)$ form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can ...
0
votes
1answer
40 views

How does the 'Flatten' function reduce the coefficients of a vector/matrix?

Seen here, at the bottom of page 5, Flatten() is defined as: Flatten(a)=BitDecomp(BitDecomp$^1$(a)) For an n-dimensional vector a$=(a_{1,0},...,a_{1,l-1},...,a_{k,0},...,a_{k,l-1})$. Where $a_{i,j}$ ...
-1
votes
1answer
74 views

What are the inverse operations in elliptic curve cryptography?

Public-private key cryptography is based on inverse operations that use separate input. In elliptic curve cryptography, what are those inverse operations?
2
votes
0answers
25 views

Leftover hash lemma-like without lossy functions

In short: Are lossy function the only way to prove security using leftover hash lemma for computationally secure protocols? Longer: I recently discovered/understood the leftover hash lemma, that ...
2
votes
2answers
225 views

Have there been efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction?

Have there ever been some publicized efforts to prevent length extension attacks of hashing algorithms that are based on the Merkle–Damgård construction (MD5, SHA1, SHA2, ...)?
1
vote
1answer
54 views

What is the inverse function of the finite field GF($2^3$) and GF($2^4$)?

I am currently reading a paper Cryptanalysis of a Theorem Decomposing the Only Known Solution to the Big APN Problem. In this paper, they mention that they used $I$ which is the inverse of the finite ...
3
votes
1answer
717 views

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea: If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input ...
1
vote
1answer
35 views

LWE secure with one entry without noise

I'd like to know, is Learning With Error (LWE) (with modular noise) "secure" if one entry has no noise? More precisely, I have: a random matrix $A \in \mathbb{Z}_q^{m \times n}$ a random string $s \...
0
votes
0answers
58 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
1
vote
0answers
64 views

If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, ...
0
votes
0answers
19 views

Difference between PMKID and the 4-WAY handshake attack

I am wondering why if you intercept the PMKID in an exchange between the AP and the station it takes more time to break the password (2 times more) if you compare it to crack the password from the 4-...
2
votes
0answers
34 views

Selection of parameters for Massey-Omura Cryptosystem

I have 4 questions about Massey-Omura Cryptosystem. Are there standards that define these parameters? How to choose a group order? What is better to take the function f? What is the recommended key ...
8
votes
3answers
2k views

What is the fastest integer factorization to break RSA?

I read on Wikipedia, the fastest Algorithm for breaking RSA is GNFS. And in one IEEE paper (MVFactor: A method to decrease processing time for factorization algorithm), I read the fastest algorithms ...
0
votes
0answers
22 views

construct parity check matrix from hamming code (3,4) [migrated]

So I have this question. let $${F_4} = \{0, 1 , x, x^2 | x^2 = x + 1 \}$$ Use Ham(3,4), with a parity-checkmatrix having columns in lexicographical order, to decode (a) 1111111 1111111 1111111; (...
1
vote
1answer
59 views

Understanding Baby-Step Giant-Step Algorithm and discrete logarithm

Studying the Baby-Step/Giant-Step Algorithm, I have some questions: In the algorithm, $p$ is the order of group, $x$ is solution. We rewrite $x = i * m + k $, but why do we make $m =\lfloor\sqrt{p}\...
2
votes
1answer
69 views

Registration Code Entropy

I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system. The registration ...
2
votes
2answers
66 views

Is it possible to use X.509 for a symmetric-key algorithm?

I read on wikipedia what is X.509: In cryptography, X.509 is a standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, ...
0
votes
0answers
15 views

How to best handle a user revoking their own roles / access? [migrated]

Suppose we have roles A, B, C where C can add other C, B, A while B can only add other A, and A can’t really add anyone. Now what if a B or C acts rashly and revokes their own role? They have to ...
1
vote
0answers
46 views

How can I compute the theoretical total key-space for 521 bit elliptic curve ECDH private keys?

Assume a dumbed down RSA: the private hey is $3 \times 5 = 15$. $3$ and $5$ are the private key and $15$ is the public key. To brute force it, find the two prime factors of $15$ ($3$ and $5$). Is ...
4
votes
0answers
45 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
2
votes
1answer
59 views

What does $x^{1/e}$ mean in cryptography in this open butterfly structure?

I am currently reading a research paper that introduces this thing called a butterfly structure. I am confused about the structure of the open butterfly in this paper which has the equation $H^{\...
0
votes
1answer
156 views

Difference between RC2, RC4, RC5 and RC6

Can anyone point out the core differences between RC variations?
3
votes
1answer
63 views

Differential cryptanalysis tutorial of Howard M. Heys

I am currently working on some research about differential cryptanalysis. There is a lot of literature about that topic in the internet. One of the most known paper is the tutorial on linear and ...
1
vote
0answers
53 views

Breaking the discrete logarithm problem in subgroups of $G$

I need to find the discrete logarithm of 20 modulo 71 where the generator of the group is 7. I need to break the group $|G|=2 \times 5 \times 7$ in subgroups $|G_1|=2, |G_2|=5, |G_3|=7$. I am new to ...
0
votes
1answer
72 views

Reed Solomon secret sharing and as a one-time symmetric key?

Shamir's Secret Sharing is just a special case of Reed-Solomon where only one coefficient is used to store the secret instead of the entire polynomial. McEliece however, suggests that the latter can ...
1
vote
1answer
58 views

Upper bound for the length of non-interactive zero-knowledge proofs of knowledge

In a hybrid protocol $\pi$ for which I want to proof uc-security in the absence of corrupted parties, there is an ideal functionality $\mathcal{F}_{SMT}$ for secure message transfer that leaks the ...
6
votes
2answers
159 views

Understanding forking lemma and oracle replay attack

Many signature schemes use forking lemma to prove security, like scheme in here.In short, that goes through a reduction technique which called oracle-replay attack to solve the difficult algorithmic ...
2
votes
0answers
43 views

Crack a polyalphabetic cipher given a pair of (plaintext, ciphertext) encrypted by it

The original question only states that a classical cipher is used, and I am going to articulate 1) why I think a polyalphabetic substitution cipher is used AND 2) my attempts so far. The Question <...
3
votes
1answer
109 views

Assumptions on one-way functions

What are the assumptions we make to propose a one-way function? I only know of some number theoretic assumptions, but what are the other assumptions you can possibly make, which if true, would imply ...
0
votes
0answers
58 views

Proofs required to deem Homomorphic Hash-based Digital Signatures secure

I just discovered something amaze about homomorphic hashes. With them, we can build hash-based digital signatures so small, fast and without Merkle trees and sort of that. The question is which kind ...
3
votes
1answer
60 views

Design a OT-based Private Set Intersection protocol to obtain $A \cap B \cap C$?

This is a tutorial question for a Foundations of Privacy computer science course, I'm unsure on how to tackle it because we haven't talked much about these particular topics in class. (a) Assume ...
4
votes
1answer
691 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
2
votes
1answer
59 views

How do i approach file encryption using encrypt-then-mac? [duplicate]

I'm programming a cryptographic application that encrypts files, locked with the password the user supplies. It's not intended to be used in production. It's a project for me to learn more about ...
2
votes
0answers
53 views

Order of g in Paillier Scheme

I'm trying to understand the Paillier Scheme but there's something I can't understand in the keyGen algorithm : Ensure ${\displaystyle n}$ divides the order of $g$ by checking the existence of the ...
0
votes
0answers
67 views

padding oracle attacks on AES-CTR [closed]

I am newer in crypto and in python also (the only programing language I understand a little bit). And I would know how padding oracle attacks works on AES-CTR. All codes I have found is about padding ...
1
vote
0answers
30 views

Proving at most one affine permutation mapping $x$ to $u$ and $y$ to $v$ with $x,y \in \mathbb{Z}_n$ and $\gcd(x−y,n) = 1$

Suppose that $x,y \in \mathbb{Z}_n$ with $\gcd(x−y,n) = 1$. Prove that for any $u,v \in \mathbb{Z}_n$ there is at most one affine permutation mapping $x$ to $u$ and $y$ to $v$.
1
vote
2answers
48 views

Difference between when select x from $\mathbb{Z}_{p-1}$ and $\mathbb{Z}_p$ in discrete logarithm Problem?

Reading "Security Arguments for Digital Signatures and Blind Signatures" paper, I confused by some questions. Q1. when it refers to "El Gamal signature scheme", The key generation algorithm: it ...
0
votes
2answers
111 views

Cryptographic hash where the hashing function input is similar to the result

I was wondering if there is a cryptographic hash where the resulting hash is identical to the input for the hash function. If this is the case, would it be a weakness in the hashing function?
0
votes
2answers
53 views

Predicting value of E(k,0) for Block cipher with random and secret key

Some mode of operation of block ciphers rely on the fact that E(k,0) is an unpredictable value when k is random and secret (with 0 denoting the all-zero binary string). Why is this a reasonable ...
0
votes
1answer
27 views

Randomly initialised global counter used to encrypt the kth message with IV = IV + k mod 2^n

The use of an increasing IV is not secure for a block cipher. That is, using a random IV for the first message then IV + 1 for the second , IV + 2 for the 3rd etc. How can I construct an attack to ...
2
votes
1answer
64 views

Is this protocol for masking DB ids sound?

Problem Statement I don't want to expose my internal database ids (or other internal private ids) so to make it harder to abuse them, by e.g. guessing the next id of a sequence or similar. It is not ...
4
votes
2answers
130 views

Is there an efficient 2 out of 3 secret sharing scheme based on XOR?

I want to know if there is an efficient secret sharing scheme based on XOR such that a share of the message is given to three people and at least two must combine their share in order to construct the ...
-1
votes
1answer
52 views

Hashing algorithm with fixed range rather than fixed size output [closed]

I have read that output that varies by key size or file size can leak information. So if it should produce fixed size then what is the scenario if it produces fixed range? By fixed range I mean that ...

15 30 50 per page