All Questions

Filter by
Sorted by
Tagged with
1
vote
0answers
14 views

Why is this functionality chosen for UC-NIZK?

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
0
votes
0answers
21 views

Signing files with some kind of “inheritance”

I'd like to design a system where the following situation happens: Person 1: I've got some secret key I hand out another secret key to a developer (Person 2) That dev signs several files with his ...
1
vote
0answers
29 views

Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
0
votes
0answers
14 views

message authentication [on hold]

Consider a new security definition (in analogy to CCA security), in which the adversary is provided oracle access to a verification algorithm as well. Then: (a) How to define this security ...
0
votes
0answers
18 views

security of composed scheme [on hold]

This question explores scenarios where one has several available schemes but dubious security guarantees. (i) Let Γ1 = (MAC1, Vrfy1) and be two Γ1 = (MAC1, Vrfy1) message authentication (MAC) schemes....
0
votes
0answers
21 views

incremental CBC [on hold]

If we consider an another variant of CBC encryption called incremental CBC, where the encryption algorithm stores an IV , and increments it every time an encryption is performed (is also stateful like ...
0
votes
0answers
13 views

Is ECB CPA Secure? [duplicate]

I am trying to prove on how ECB may not be CPA secure, i tried to google and also looked at similar links on stack exchange but couldn't find any
0
votes
0answers
18 views

Seeking security feedback for new secure social media tool (open source and federated) [on hold]

I’m writing a pathologically secure social media tool, a federated system where the servers never see any private information of the users, and can only infer a minimum of metadata (such as who knows ...
0
votes
0answers
19 views

RSA modulo 26 in ‘ECB mode’ [on hold]

I have successfully implemented RSA without ECB or padding. I have been told by @SqueamishOssifrage that it is possible to do RSA modulo 26 in ECB mode I would like to continue this conversation in ...
2
votes
0answers
30 views

No freshness protection for single messages, but for the overall protocol

I am given a key exchange protocol between a component $C$ and a key master $K$. During the overall execution 4 messages are transferred between $C$ and $K$. DH keypairs are always chosen randomly for ...
0
votes
0answers
28 views

How to find the KEY knowing the Ciphertext and IV of Encryption type aes-128-cbc [on hold]

I know the following information: Time Stamp "2018-04-17 23:08:49" (within a 2-hour window of generating the encrytption) Encryption type aes-128-cbc Plaintext: 255044462d312e350a25d0d4c5d80a34 ...
-1
votes
0answers
49 views

RSA wont decrypt ciphertext to plaintext [on hold]

Here is my CSharp code for a basic RSA cipher, when the plaintext is encrypted to the ciphertext and the ciphertext decrypted to the plaintext the plaintext does not match the input. I would like to ...
1
vote
1answer
30 views

Problem with Hash-DRBG's seedlen values (and others)

In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888. How are these values derived? How to derive values for other ...
-2
votes
0answers
30 views

RSA given p,q,n,c1,c2,e1,e2 [on hold]

I am given the p,q,n,c1,c2,e1,e2 values for an RSA key, along with an encrypted message. Here are those values: ...
0
votes
0answers
45 views

Why do we hash the random challenge in Fiat-Shamir heuristic? [duplicate]

I had a quick question for all. Why do we hash the random challenge in Fiat-Shamir heuristic? If we hash the public key of Prover it should be enough for the verifier to prove non-repudiation? What ...
-1
votes
1answer
39 views

How do I generate the multiplication table for GF(3^2)?

I understood, how this works for arbitrary n and p = 2, but I am struggling with higher prime numbers as a base. In the following, I wanted to use the irreducible polynomial ...
0
votes
0answers
29 views

One time OTP- hashing [on hold]

I have question hashing the user credentials to prevent the system from unauthorised access. I’m working on internet banking . I have to develop attacks. One attack is that, if attacker get to know ...
0
votes
0answers
21 views

AES-MixColumn layer in the last round

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about AES algorithm the authors say that in the last round of the encryption algorithm the MixColumn ...
0
votes
0answers
32 views

AES - Non-linearity hinders differential cryptoanalysis

Can you explain me, in simple terms if possible (I'm not a mathematician :( ), why the non-linearity introduced by the AES s-boxes hinder the differential cryptoanalysis ?
1
vote
0answers
18 views

Computationally indistinguishably vs Perfect Indistinguishably [duplicate]

I know that perfect security means absolutely no information about the plaintext is leaked to the adversary while computational secrecy is okay with a tiny amount of leak. But, what is the difference ...
-1
votes
0answers
20 views

show how bob can use only one permutation to reverse the process [on hold]

Alice use three consecutive permutations [1 3 2] ,[3 2 1] , [2 1 3] show how bob can use only one permutation to reverse the process use the table below can anyone explain to me
0
votes
0answers
77 views

TLS 1.2 handshake ECDH premaster/master secret generation with C OpenSSL API [on hold]

I am doing a study on the TLS protocol as my degree thesis, but being completely inexperienced on this subject, I have many questions. I have to write C code and program a client that partecipates ...
0
votes
0answers
26 views

Encryption data [migrated]

I have encrypted data. the MBR partition shows but I can't decrypt the data. What's the likelihood that the USB NAND flash experienced bit rot in the sector that stores the hash but still kept the MBR ...
0
votes
1answer
34 views

For CBC, if the initialization vector is corrupted, can we still decrypt the message?

Actually, I think IV (initialization vector) is random number which is same size as the other block of plaintext. But if the IV is corrupted, message cannot be decrypted because original IV used to ...
1
vote
1answer
35 views

Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0? [duplicate]

I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of ...
0
votes
0answers
19 views

X509_verify() with ECDSA public key failure [on hold]

I am developing an ECDSA signed certificate and embedded application using Openssl 1.0.2. The X509_verify(cert, pubkey) is failing with an 'other' error and after some debugging the solution ...
0
votes
0answers
21 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
0
votes
2answers
93 views

Fiat-Shamir transform: reliance on hash input by interactive proof

Peggy would like to prove to Victor that she knows the discrete logarithm of $y$ based $g$; that is, she knows $x$ such that $y = g^x \bmod p$. One round of the interactive proof protocol consists of ...
1
vote
0answers
29 views

Dedekind sum is a product of sawtooth function [on hold]

"The Dedekind sum is a product of a sawtooth function." This sentence does not make sense to me. A sawtooth is a kind of wave for sound generation. But in the realms of cryptography, the Dedekind sum ...
1
vote
0answers
24 views

What to learn in order to understand Weil Divisors

My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
1
vote
2answers
47 views

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
0
votes
0answers
12 views

Is 2FA secure, and can it ever be broken? [migrated]

Having weak passwords are so easily cracked by hackers and quantum computers that people introduced an extra layer of security, called Two Factor Authentication. How it works is it sends a message to ...
2
votes
1answer
88 views

Is SSH over TLS 1.2/1.3 overkill?

I am designing a protocol that will have security in mind as one of its key goals. Currently I have selected SSH with TLS as the underlying transport. I selected SSH because it had a variety of ...
0
votes
1answer
52 views

Would adding more rounds to AES increase security?

As the title states, would increasing the rounds by doubling them to Bruce Schneiers recommendation of 16, 20, and 28 increase security? And how much? As a bit more, would increasing rounds, keys, ...
3
votes
0answers
47 views

Using (EC)DH to generate a signature

Say I have access to a system that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key can e.g. be used to generate a MAC. Is it possible to generate a ...
1
vote
0answers
18 views

Choices of $q$ and $f$ for RLWE-based constructions

I understand that RLWE was introduced to avoid the quadratic overhead in the matrices that appear in plain LWE. However, I have a series of questions about this setting. First, Ring-LWE-based ...
0
votes
1answer
52 views

If multiple hashing algorithms are chained together, is the compound hash function more collision resistant?

The DASH cryptocurrency uses X11, which is a Proof of Work hashing algorithm composed of 11 separate hash functions which are run as a sequence. Example: $Digest = H_{11}...(H_3(H_2(H_1(Input))))$ ...
0
votes
0answers
51 views

Weakness in double encryption [duplicate]

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about DES algorithm the authors say that: "If double encryption is equivalent to single encryption,...
1
vote
1answer
29 views

Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
1
vote
0answers
62 views

Generating a MAC on a Polynomial

In the following, all the operations and polynomials are defined over a finite field of prime order, $\mathbb{F}_p$, where $p$ is a sufficiently large prime number. All polynomials and values below ...
2
votes
0answers
25 views

Do I need verifiable shares?

I'm using Shamir's secret sharing in a 2:3 system. Thus a secret Key is split in 3 subkeys (KeyS:KeyC:KeyT) I've 3 entities at ...
2
votes
2answers
46 views

OFB mode vs LFSR

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about OFB (Output Feedback) mode the authors say that: The OFB mode produces a bit stream and it ...
0
votes
0answers
6 views

Have someone replaced Curve25519 in NaCL library? [migrated]

I am using NaCL library and I like it but I wonder if it is possible to replace Curve25519 with different stronger Curve if stronger encryption is needed. I do understand that new library would be ...
2
votes
1answer
45 views

Why are inputs to boolean functions usually modelled as random variables? [on hold]

I ask this because it might one of those things that "everybody knows/does", but never gets written or explained anywhere... Is it just a matter of aesthetics (in the mathematical sense of the word), ...
2
votes
4answers
210 views

Academic breach revealed too late

Do you know if is has already happened (since 1980), that someone (academic or not) has "broken" (even in a weak sense) some cryptographic assumption, but has chosen to not first publish and directly ...
0
votes
1answer
41 views

Hashing high entropy key into AES format

If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
0
votes
1answer
24 views

XORing a nonce with a ciphertext vs XORing a nonce with plain text and then encrypt

Consider a situation where a symmetric key encryption (such as AES) is used to encrypt the plain text. Moreover, a nonce is used to ensure that old communication cannot be used to perform a replay ...
0
votes
0answers
30 views

What Chaining Mode to use with RSA? (CNG's BCrypt)

I'm trying to make my first RSA encryption/decryption using CNG. In 1 part of the example they add pick a chaining mode, I don't know if this is mandatory and when I tried to google about it I found ...
-4
votes
0answers
31 views

Can someone tell me how to decrypt this code into an email address? [on hold]

How do you decrypt this into an email address ? Njg2MTYzNmI2MTdhNmY2ZTQwNjQ2NTZjNmY2OTc0NzQ2NTJlNjM2ZjZk
0
votes
0answers
35 views

How secure is this scheme? [on hold]

Introduction of the cryptosystem Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with ...

15 30 50 per page