All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

calculating the branch number/ active bundles of a cipher

I have read the papers Wide Trail Strategy and Wide Trail Design Strategy for Binary MixColumns. These papers describe the need for a good linear transformation in a cipher, a provable mechanism to ...
0
votes
1answer
48 views

Diffie-Hellman Key Exchange

I apologize if this is in the wrong section. I am completely new to Cryptography. I was presented with the following problem and I am trying to find something that will explain to me how to proceed. ...
0
votes
0answers
31 views

How to determine if ElGamal message was a quadratic residue?

Consider the following ElGamal encryption (using a generator of $\mathbb Z^*_p$): Key gen: find a big prime $p$ and $g$ a generator of $\mathbb Z^*_p$. choose $a\in \mathbb Z_{p-1}$ randomly and ...
1
vote
2answers
144 views

Stream cipher and block cipher usage in network data encryption

Stream ciphers are usually used for streaming data encryption, such as voice, and also for low layers data encryption. For example, MACSec uses AES-GCM encryption. In L3 ad L4 security protocols (...
1
vote
1answer
77 views

Questions about using PRF to construct PRG

Let F be a secure pseudorandom function with 128-bit key and 256-bit block length. Which are the following functions G are secure pseudorandom generators? (Select all that apply.) A. $G(x)=F_x(0...0)$...
1
vote
1answer
23 views

PKCS#7 Signed Data contains always different signature

I am wondering why CMS (PKCS#7) Signed Data contains always a different signature of the original data when the SHA256withRSA signature algorithm is used. (using ...
0
votes
1answer
26 views

How to correctly pad by PKCS#7 for AES?

I want to implement AES-CBC mode with PKCS#7 padding, along with a way to validate a correct padding given the ciphertext. My initial understanding was that for an input of size ...
1
vote
0answers
57 views

Does this break the pre-image resistance of the hash function?

Supposing a secure hash function $f(\cdot): \{0,1\}^* \rightarrow \{0,1\}^n$ satisfies pre-image resistance. That is, given a hash value $y$ it should be difficult to find any message $x$ such that $y ...
3
votes
1answer
123 views

AES CTR: Random IV

I want to use AES CTR with a random IV, as this would be the easiest way for me. I have a cryptographic module, that supports true random number generation. Due to compatibility, I must use AES CTR. ...
2
votes
1answer
33 views

How do salt and initialization vector differ?

Reading through the NodeJS API docs I came across IV for the first time. From what I can tell it has the same role as a salt in password hashing? Are they equivalent?
0
votes
0answers
9 views

RSA-SHA1 problem [migrated]

I need to create a RSA-SHA1 signature in nodeJS, I am using the following code ...
5
votes
2answers
132 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
8
votes
2answers
977 views

Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that: 3.1 AEAD (Authenticated Encryption with Associated Data) ...
1
vote
2answers
88 views

Question about the proof of the change of base formula for the discrete logarithm

I was looking at the proof of a change of base formula for the discrete logarithm in this paper (page 6, 4th bullet indent). In the intruduction, the paper states: Let $F_q$ be a finite field of order ...
4
votes
2answers
119 views

Why does TinyJAMBU-128 claim only 112-bit security?

I am trying to understand the security level of TinyJAMBU-128. As shown in Table 4.1 page 12 of this document, TinyJAMBU-128 claims 112-bit security. However, it has a 128-bit key. How have we lost 16 ...
1
vote
1answer
57 views

By what modulo calculations with discrete logarithms are performed?

For odd prime $p$, I have been given a group $\mathbb{Z}_p^*$ of all invertible elements from $\mathbb{Z}_p$. Basically, $\mathbb{Z}_p^* = \{1,2,\ldots , p-1 \}$. I also have $a$ and $b$, which are ...
1
vote
1answer
59 views

Multiply by 3 problem with MixColumns in AES

I have problem with multiplying bytes by 3 in MixColumns (as in Cryptography And Network Security) $$\begin{bmatrix}02&03&01&01\\01&02&03&01\\01&01&02&03\\03&01&...
0
votes
0answers
14 views

Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs? [migrated]

For example, let’s say I pick a random secret and hash it. Now, in the hypothetical hash-based scheme, my hash effectively replaces my public-key hash, and my random secret effectively replaces my ...
2
votes
1answer
123 views

What's going on with the complicated implementations for map_to_curve in draft-irtf-cfrg-hash-to-curve?

I've been looking into implementing cPace, and I saw that two cipher suites defined for it refered to draft-irtf-cfrg-hash-to-curve for its protocol definition. Part of cPace requires mapping a string ...
1
vote
0answers
24 views

Equality with Bilinear Maps

Let e be a bilinear pairing function and $g_1$ and $g_2$ be the generators of $G_1$ and $G_2$ Given $e(a,g_2^x), e(b,g_2^y), g_2^x,g_2^y$ is there a way to find out if $a = b$?
5
votes
1answer
436 views

Why using hash trees instead using a single hash value?

If one have files $x_1, x_2, .., x_n$. What are the benefits of using hashing trees $-$ also known as Merkle trees $-$ (for example in git) instead of computing one hash value $h(x_1,x_2,..,x_n)$ ?
0
votes
2answers
94 views

Is CTR more secure than CBC?

In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity. A block cipher by itself is only ...
1
vote
0answers
58 views

Which of these ECC libraries is more secure, fast and commonly used? [closed]

I have a python project and for this project, I need to use Weierstrass-based ECDSA. On the web, I've found two libraries; Library 1 is called fastecdsa: Library 2 is called ECPy: I couldn't see any ...
3
votes
1answer
136 views

Security of RSA variants with $e=n-2$ and $e=n$

RSA as defined by PKCS#1v2.2 allows public exponent $e=n-2$. And textbook RSA was born with $e=n$ (see second bullet here). Are these variants essentially as secure as (textbook) RSA with fixed $e$? ...
0
votes
0answers
21 views

Value of Prime P in shamir secret sharing

How the value of prime integer taken in Shamir's Secret sharing scheme. I have taken p which is greater than my secret and the no of shares. When i do calculation without modp then secret reconstruct ...
4
votes
2answers
95 views

RSA algorithm: Must $e$ be less than $\varphi(N)$?

I understand why $e$ must be co-prime to the totient of $N$, but I see in many explanations of RSA that $e$ should be less than $\varphi(N)$. Is there a reason for this? Is it for ease of a small ...
0
votes
0answers
28 views

Why is a PGP signed message structured the way it is? Historical background or standard?

I am pretty sure there's a good reason for this, but it just occurred to me I've been just taking for granted that all PGP signed messages look something like this: ...
0
votes
2answers
71 views

Show how an efficient algorithm for computing discrete logarithms with base a can be used to efficiently compute discrete logarithms with base b

I have an exercise that says the following: Let $p$ be an odd prime, and let $a$ and $b$ be generators $\mathbb{Z}​_p^*$. Suppose that we have an efficient algorithm $A$ for computing discrete ...
4
votes
2answers
488 views

how to use these hash functions in python?

In this article https://www.mdpi.com/2073-8994/12/10/1687/htm, specifically in the section 4.1 of the initialization phase,the following cryptographic hash functions have been chosen: \begin{align} ...
1
vote
1answer
61 views

Encryption algorithm with shortest ciphertext for long strings

EDIT: My original problem was that if I have to encrypt large amounts of data, AES would expand the data even more, but this is not the case. This question states that AES does not expand data at all. ...
1
vote
1answer
26 views

PKCS#7 CMS - Message digest calculation process

i'm studying RFC 5652 in order to know exactly how to encode/decode PKCS#7 ASN.1 data. I don't understand how one can create a signature when the field "signedAttrs" is present: The result ...
1
vote
1answer
55 views

Why is data signed with SHA256-RSA-PKCS and digest signed with RSA-PKCS different?

I need to sign some data using RSA. I have the digest that I can sign but the signature turns out different from the signing source data. There is data in data.bin and its sha256 digest in digest.bin <...
3
votes
2answers
77 views

does CFB support random read access?

According to Wikipedia block cipher modes of operation, simplified CFB supports random read access. but what about the real CFB where we have a shift register? below are pictures extracted from the ...
1
vote
0answers
15 views

Can I use a Friedman test when decrypting a playfair cipher

I have a playfair cipher I’d like to decrypt however I need to find the key word first. Is it possible to use the Friedman test here to find the length of the key word? My cipher has no J’s in it ...
1
vote
1answer
57 views

Post-quantum asymmetric encryption algorithms

One could use Falcon-512 for establishing a private and public key for an asymmetric context. Whereas in a symmetric context, we could use firesaber/saber/variants in order to obtain a shared secret ...
0
votes
1answer
51 views

How to show Hash-Then-Encrypt is not AE-secure

(E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions. E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject. ps:the question is from the ...
4
votes
2answers
199 views

Encrypting messages without revealing length?

In various messengers, we have end-to-end encryption, making it hard to know what the message said. But do these messengers have to pad the message to some maximum length every time, in order to hide ...
3
votes
1answer
166 views

CMAC - how is ambiguity resolved?

To avoid the dummy padding block, CMAC uses 2 separate keys K1 & K2. If padding is required, the final block is padded & then XORed with K1. If no padding is required, then it's XORed with K2. ...
0
votes
0answers
28 views

Known Plain Text Attack DES-OFB on Crack.sh

I am trying to do a known plaintext attack on DES-OFB through crack.sh. I have been having trouble lately. I keep getting blank text file back with no keys returned. Does anybody know if DES-OFB is ...
2
votes
1answer
143 views

Which block ciphers are considered staples for constructing hash functions?

I've been looking all over the internet for an answer, and I must not know how to search because I've been really surprised that I haven't been able to find one. I'd also love to know what makes a ...
0
votes
0answers
43 views

Key storage management of session keys and long term keys

In key management, one of the topics is key storage, I want to know where and how these keys(long-term and short-term) are stored? For example I read that android password apps use KeyStore api to ...
2
votes
1answer
61 views

Truth table for the Boolean function $f(x,y) = x \oplus xy$ - Conflict with answer computed by sagemath

By hand, I computed $f(x,y) = x \oplus xy = (0, 0, 1, 0)$ since, in ascending (lexicographical) order, $f(0,0) = 0 \\ f(0,1) = 0 \\f(1,0) = 1 \\ f(1,1) = 0$ However, using the following code on ...
1
vote
2answers
106 views

Are there any formal tests to estimate encryption strength?

So I'm trying to design/make my own encryption algorithm and I believe it to be ok. I'm not saying it's extra secure but I know it's not useless so, what I was wondering is if there are any specific ...
1
vote
1answer
21 views

Encryption in SET protocol

I have a rough idea of what is symmetric and asymmetric encryption, but I can't apply the idea to the SET protocol (Secure Electronic Transaction Specification), so how the symmetric and asymmetric ...
1
vote
1answer
53 views

CBC mode works well for input greater than “b” bits. What is that “b” bits?

This post on geeksforgeeks.org about block cipher modes of operation, says that one of the advantages of the CBC is that it works well for input greater than b bits. I also saw that in the book "...
1
vote
0answers
29 views

Simply message authentication [duplicate]

Securing and authenticating messages is easy thanks to computers. Lately I've been thinking about something like Vigenère cipher with a OTP, how secure it is, and how easy it is to implement without ...
0
votes
1answer
53 views

Breaking Elgamal private key

I have been given a task to explain if - given a public key and a portion of a private key (over 300bits) with a remain unknown of 80 bits - the private key can be broken with an algorithm faster than ...
0
votes
2answers
43 views

Bits of security vs collision resistance?

I have been doing some research on security, and I am confused on the bits of security vs collision resistance, and I was wondering if someone could clarify my understanding. For instance, if you have ...
0
votes
0answers
18 views

What is an Intuitive Explanation for the Sha-2 Hash algorithms? [duplicate]

I know the needs of a basic cryptographic hash function (one way, collision unlikely, and minor changes in input are likely to produce major changes in output) and I can read the code for Sha-2 (it is ...
3
votes
2answers
85 views

Why is the nonlinearity of this Boolean function evaluating to $\frac12$?

I am using the method presented in this paper to find the nonlinearity of the function $$ f: \mathbb{F}^1_2 \to \mathbb{F}^1_2 \\ f(x) = x$$ The truth table is $f = [0 \space \space 1]$. Now, I read ...

15 30 50 per page
1
3 4
5
6 7
473