All Questions

Filter by
Sorted by
Tagged with
0
votes
2answers
768 views

LFSR Tap sequence 15 bit LFSR

I have been asked to create an LFSR with a polynomial of x^15 + x + 1 and i am confused where the tap sequence would go. The examples I was given show a 4 bit tap sequence with two polynomials: x^3 + ...
0
votes
1answer
89 views

What (Where) is the formal definition of Multiparty Computation? [closed]

I'm just curious where we can see a (original) formal definition of MPC. What (Where) is the formal definition of MPC? We have a bunch of tools to build a MPC protocol. Is oblivious transfer (or OT-...
0
votes
2answers
600 views

Which is slower, AES or GCM hash (GHASH), if CPU has no special instructions?

In an answer to this question: Security of GCM if Implemented with Stream Cipher instead of Block Cipher ...it was stated that: The GHASH part of GCM is usually the problematic one when it comes to ...
0
votes
1answer
520 views

Zero knowledge proof for identity

Quoting a blog authored by Vitalik Buterin regarding ZKP and Ethereum One natural use case for the technology is in identity systems. For example, suppose that you want to prove to a system that ...
0
votes
1answer
168 views

RSA: How effective is this keypair-trash attack [duplicate]

A question that could very well be part of xkcd's "what if?": Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
0
votes
0answers
2k views

Stream Cipher : Never use stream cipher key more than once [duplicate]

Possible Duplicate: Taking advantage of one-time pad key reuse? How does one attack a two-time pad (i.e. one time pad with key reuse)? Denote C is cipher text, m is message, and PRG(k) is a ...
0
votes
1answer
338 views

One-time pad using RSA and Diffie-Hellman functions

Suppose that Alice and Bob use an encryption algorithm based on a one-way function $F$ (Eve knows it), and $r$, a secret key shared between Alice and Bob (Eve doesn't know it). Key is computed as: $K =...
0
votes
1answer
2k views

How to crack SHA256 only letters

I recently created a program that hashes a password using SHA256 and potentially using salt. How can I crack that if I know that the password only contains lowercase letters?
0
votes
1answer
158 views

Impossibility vs implaussiblity

What is the difference between implausibility vs impossibility in the context of Crypto? I came to know that differing input indistinguishability Obfuscation (diO) implausibile but not impossible. Can ...
0
votes
1answer
146 views

Disjunction of several instances of sigma protocol

Assume there exists zero-knowledge interactive protocol for a language $L \in NP$ i.e., if an instance $x \in L$ then prover can convince the verifier, that $x \in L$ with high probability without any ...
0
votes
2answers
1k views

How to calculate a private key from public key on elliptic curve? [duplicate]

Provided, that you have to multiply a well known G by the private key to obtain the public key, why not keep adding G to itself until you reach the public key. The private key should be the number of ...
0
votes
1answer
145 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit?

In reading through the original GCM specification (McGrew & Viega '05), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter ...
0
votes
2answers
141 views

Key vs Algorithm when applied to Enigma

I've just been reading the Why should I make my cipher public? question and answers on this site. I understand Kerckhoffs's principle, but I'm unsure exactly how this applies to Enigma - i.e. where ...
0
votes
1answer
148 views

Should Ed25519 signature verification check the order and canonicity of its inputs?

Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant ...
0
votes
2answers
232 views

Analyzing security flaws of cipher

I know using homebrew encryption can be very dangerous as it is very likely to have many flaws in its design. The following concept is just for learning purpose in case anybody is getting red flags ...
0
votes
1answer
1k views

How Does Progressive Hashing Work?

Example: http://jsfiddle.net/KGtUE/ https://code.google.com/p/crypto-js/#Progressive_Hashing sha256.update("abc"); sha256.update("def"); sha256.update("ghi"); ...
0
votes
2answers
453 views

Is the DES F-function injective for a given subkey?

Is it possible for two different half-block inputs to the DES F-function, with the same round subkey, to produce the same output? That is, if we feed two different half-block inputs $b_1$ and $b_2$ ...
0
votes
1answer
66 views

Given $P=xG$, prove in zero knowledge that I know $sqrt(x)$

Assuming that x has a sqrt. Given $P=xG$ is it possible to prove that I know the $sqrt(x)$ in zero knowledge?
0
votes
0answers
65 views

Private Set Intersection Polynomial Computation [duplicate]

I am trying to implement the protocol mentioned in Section 3.4 of “Efficient Robust Private Set Intersection” in Java. In the Second Step, the Client computes a polynomial of degree $n$ over the ...
0
votes
0answers
141 views

Preventing Quantum Attacks on Cryptography [duplicate]

With the advancement of technology in quantum computing, it's becoming more evident that we need to start thinking about protecting the future integrity of our cryptographic standards. What can we do ...
0
votes
1answer
195 views

Encryption Oracle Avoidance

I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages,...
0
votes
2answers
215 views

How could consumer level OTP + QKD over the internet ever be practical?

Please note, I am in no way questioning the future usefulness of quantum key distribution (QKD) in certain applications. I have no doubt it will prove useful for large banks, and in certain military ...
0
votes
2answers
82 views

What constructions for data authentication are subject to the birthday paradox?

$H(m\mathbin\Vert k)$ as an authentication algorithm, where $H: \{0, 1\}^* \rightarrow \{0, 1\}^{n}$, has at most a strength equivalent to $\frac{n}{2}$ bits. $H((k^\prime \oplus \mathrm{opad})\...
0
votes
1answer
2k views

RSA: Why must e be relative prime to phi(n) [duplicate]

I've got a question concerning fields used in RSA. Let's use the following symbols for my example: {p,q} = primes {e,n} = public key {d,n] = private key I learnt that an inverse element exists if a ...
0
votes
1answer
68 views

Explanation of trace function $\operatorname{Tr}_m(x) = x^{2^{m}} \oplus x$

The following statement is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: For all $ x \in \operatorname{GF}(2^{n})$, it holds that $x^{2^{n}} \oplus x = 0$. If $...
0
votes
1answer
107 views

Computing the cardinality of the co-domain of specific modular exponentiations

Consider the following function: $f: \mathbb{Z}_n \rightarrow Y,~x \mapsto x^e \bmod n$, where $n = p \cdot q$ is an RSA modulus and $\gcd(\varphi(n),e) \neq 1$ (contrary to what's required for a ...
0
votes
1answer
163 views

Will publishing two or more public keys of the same RSA private key cause a security risk?

I want to make an end-to-end messaging platform where everyone is identified with a unique random private key. Everyone uses other peers' public keys to identify and send encrypted messages and verify ...
0
votes
1answer
114 views

Is there a system where multiple people can encrypt a message and then decrypt it in any order? [duplicate]

For example, A encrypts a message. B encrypts that. C encrypts that. Then B decrypts, followed by A then C. Are there systems that allow this? Does such a property have a name?
0
votes
2answers
726 views

Regex searchable word list for space-less monoalphabetic substitution

I am working on teaching myself basic cryptography. In the process I created a simple substitution cipher based on a single alphabet, and a statically defined offset (no key for now). Now that ...
0
votes
2answers
445 views

How to cipher bocks with RSA in ECB mode?

I'm trying to implement a very basic RSA with functions that should generate RSA keys and cipher some text. GenKey function returns a tuple ...
0
votes
3answers
2k views

Key length requirement in a simple XOR implementation

I don't have much previous experience at all with cryptography, this is pretty much the first time I've tried anything similar. I'm trying to implement an extremely simple XOR encryption system in ...
0
votes
1answer
274 views

Padding RSA with random number

I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure. ...
0
votes
0answers
98 views

What type of encryption scheme can prevent cheating in this coin flip protocol? [duplicate]

Consider the following protocol for two parties to flip a fair coin: Trusted party $T$ publishes her public key $p_k$ A chooses a random bit $b_A$, encrypts it under $p_k$, and announces the ...
0
votes
1answer
148 views

Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/...
0
votes
1answer
377 views

Katz/Lindell Problem 7.6

Let $f$ be a length-preserving one-way function, and let $\text{hc}$ be a hard-core predicate of $f$. Define $G$ as $G(x)=f(x)\|\text{hc}(x)$. Is $G$ necessarily a pseudorandom generator? The answer ...
0
votes
1answer
437 views

Key size and finite fields in ECC (References)

So somehow I know that the key size in ECC is defined over the number of elements in a finite field or that it is almost equivalent to that (Correct me if I am wrong). However, other than on Wikipedia ...
0
votes
1answer
4k views

RSA Attack, known public key and ciphertext. Can decrypt the message m?

I'm stuck with this problem: Assume Alice and Bob are using RSA to communicate each other. Given Bob's public key $(217,7)$, Alice send the ciphertext $c=53$ to Bob through RSA encryption. Now, Eve ...
0
votes
1answer
270 views

IV = Filename XOR CipherKey?

i want to encrypt transparently using Rijndael. So this is, what I thought of and I would like to have an opinion from "Experts" whether this will harm encryption strenght. I am using chunks of 1MB ...
0
votes
1answer
77 views

Question on proof of coin-tossing in “how to simulate it”

I am reading Professor Lindell's "How To Simulate It - A Tutorial on the Simulation Proof Technique" paper, which is very enlightening. I am trying to follow through the proof of the security of Blum'...
0
votes
2answers
132 views

Is there a way of increasing the time to brute force a cipher, but by increasing the ciphertext size instead of the key size?

If you have a symmetric-key algorithm that is limited to using a small key size (say 40-bits) is there any way you could increase the resistance to brute force attacks without increasing the key size? ...
0
votes
1answer
762 views

Discrepancy between 3DES in OpenSSL and PyDES [closed]

I'm trying to encrypt some data using triple DES ECB, but I get a discrepancy between OpenSSL and the pyDES library I'm using. When trying to get a KCV value, I'm using a file consisting of 8 bytes ...
0
votes
0answers
42 views

Prove that a signature scheme is RUF-NMA and not EUF-CMA

I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
-1
votes
1answer
1k views

With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?

Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
-1
votes
1answer
105 views

Can we use merely permutation to hide a message?

This question is related to this: When all shares of a secret are given to adversary as a permuted matrix I think the below question is a simplified version of that. Assume we have a 40-bit ...
-1
votes
3answers
315 views

OTP - Reuse key BUT add IV, is it secure enough?

I have already asked a similar question and now I can continue to this question about adding a "extra key" = IV. My last question was about reusing key in OTP (One-Time-Pad). Now this question is ...
-1
votes
1answer
984 views

MD5 proving collision for the famous hexadecimal blocks

Below shows the hexadecimal pair which collides in MD5 (http://www.mscs.dal.ca/~selinger/md5collision/): d131dd02c5e6eec4693d9a0698aff95c 2fcab58712467eab4004583eb8fb7f89 ...
-1
votes
1answer
148 views

Compression function cryptanalysis

A compression function converts a fixed-sized input into a smaller fixed size output. Suppose that one has a large collection of input-output pairs for an unknown compression function. We can assume ...
-1
votes
1answer
151 views

Why is the XOR of plaintexts equal to the XOR of ciphertexts with a two time pad?

I have been working in the vulnerabilities of the Two Time Pad. So i found in a lot of places, StackExchange included saying, that if two plain texts are encrypted (using XOR) with the same key the ...
-1
votes
2answers
2k views

Retrieving the 3DES decryption key from plaintext and ciphertext?

I have a hex key that I want to decrypt with a 3DES key in mode ECB. For example: ...
-1
votes
1answer
1k views

Pedersen commitments and addition

For Confidential Transactions a Pedersen commitment is being used. The commitment preserves addition and the commutative property applies: $$C(\text{BF}_1, \text{data}_1) \oplus C(\text{BF}_2, \text{...

15 30 50 per page