All Questions

2,882 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
464 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
4
votes
0answers
82 views

Are there any real-world E-voting systems in use with the Paillier cryptosystem?

There are a lot of theories of Paillier cryptosystem with references to e-voting. Are there any real-world E-voting systems in use with the Paillier cryptosystem?
4
votes
0answers
94 views

Can cryptographically useful pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
4
votes
0answers
285 views

How did G.H. Hardy's work contribute to today's public-key cryptography?

I know that Hardy's work in number theory was used by Clifford Cocks in 1973 to develop the basis for public-key cryptography. What specifically was this work, and how is it used today in ...
4
votes
0answers
445 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
4
votes
0answers
234 views

Explanation of part of a visual cryptography algorithm

I have been working on a project involving visual cryptography and I am stuck with the following problem. My question is related to this paper, AN IMPROVED VISUAL CRYPTOGRAPHY SCHEME FOR SECRET ...
4
votes
0answers
236 views

IES: What security has the asymmetric primitive to provide?

I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash ...
4
votes
0answers
131 views

Anonymisation resilient to key leak

Problem statement Elbonian citizens have been issued a card holding a random $B_j\in\{0,1\}^b$, $0\le j<2^n$, $b\ge n+20$ (representative example $b=64$, $n=28$). The habit has grown to use this ...
4
votes
0answers
157 views

Using machine-learning techniques for data-dependent operations in ciphers

From 'Methods of Symmetric Cryptanalysis' by Dmitry Khovratovich, The data-dependent operations are one of the most controversial design concepts. We say that an operation is data-dependent, if it ...
4
votes
0answers
206 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
4
votes
0answers
164 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
4
votes
0answers
60 views

What is the restriction on $k$, for the $k$th composite residuosity problem to be hard?

The paper “Residuosity Problem and Its Applications to Cryptography” considers the exponent to be an odd integer. When $k = 2$, it is called the quadratic residuosity problem (mod $n$, where $n$ is ...
4
votes
0answers
129 views

Implementation Attacks on Hashes

So I am familiar with attacking implementations of block ciphers via side channel attacks, cache-timing attacks, etc. What implementation attacks are there against hashes or hashed based functions (...
4
votes
0answers
200 views

understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
4
votes
0answers
198 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
4
votes
0answers
284 views

Secure Secret sharing

I'm trying to come up with a new way to do oblivious transfer that is faster and requires less computation than existing methods. The basis of my method is shamir secret sharing. Below is an example ...
4
votes
0answers
491 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
4
votes
0answers
255 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
4
votes
0answers
703 views

Key expiration policy for 3DES / TDES / Triple DES

I have a system that signs plain text messages using a message authentication code (MAC) encrypted with 3-key Triple DES. The short message is used on connection to establish a session key, so it ...
4
votes
0answers
160 views

Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ...
4
votes
0answers
405 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
4
votes
0answers
121 views

A confusion about linear span of modified de Bruijn sequence

Recently i'm reading "Cryptographically Strong de Bruijn Sequences with Large Periods" . In the section 2 2.1 Basic Definitions and Properties , property 1 says ...
4
votes
0answers
361 views

How hard is a known prefix hash preimage attack on SHA-2?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
4
votes
0answers
433 views

How can Alice and Bob safeguard their message exchanges against replay attacks?

Assume Alice and Bob communicate over an insecure channel using one-time perfectly-secret encryption together with one-time secure message authentication code. Say Eve has the ability to eavesdrop and ...
4
votes
1answer
183 views

Lattice-based cryptography prone to side channel attack?

Is lattice-based cryptography still prone to side channel attacks? What are some mitigation strategies, if any?
4
votes
1answer
477 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...
4
votes
1answer
190 views

Generating random vector for Full Homomorphic Cryptography

The site below explains that part of doing homomorphic encryption, you need to generate a vector of random numbers that have the property that its dot product against a randomly generated bit vector ...
4
votes
1answer
2k views

Effective key length of Two-Key Triple-DES

What's the effective key length of Two-Key Triple-DES, for some (possibly several) reasonably well-defined and sensible definitions of effective key length, say assuming attack using ample chosen ...
3
votes
0answers
110 views

Solving LPN using algorithm for syndrome decoding

Given an algorithm $A_D$ which solves an instance of the decoding problem $e \in \mathbb{F}_2^n$ in time $T_D$ given a parity check matrix $H \in \mathbb{F}_2^{(n-k)\times n}$ and a syndrome $s \in \...
3
votes
0answers
50 views

Multi-users RSA problem

Rivest and Kalisky's RSA problem considers various notions on security of the RSA One-Way Trapdoor Permutation. They do it only from the perspective of a single user. What's the state of the art in ...
3
votes
0answers
83 views

Security limits of password-based encryption

A reasonable way to do password-based encryption is: put the passphrase¹ and nonce in a well-parametrized memory-hard iterated hash function like Argon2, to derive a key 128-bit or larger. output the ...
3
votes
1answer
39 views

Update non-member witness in RSA accumulator

According to study of "Universal Accumulators with Efficient Nonmembership Proofs", I don't understand exactly how to update non-member witness in construction 4.2. In the addition step, I understood ...
3
votes
0answers
117 views

Why Kerberos isn't using Diffie-Hellman key exchange?

Kerberos transforms the user password to obtain a secret key, which is also stored in the kerberos database. That way what travels through the network is the derived key, not the password itself, ...
3
votes
0answers
63 views

Are there only two ways to prove a cryptographic protocol is secure?

If I want to prove my protocol is secure, can I just use a game based approach and/or a simulator approach? Or are there other common approaches?
3
votes
0answers
36 views

Markov ciphers - generalized group operation

I’m reading this paper of Lai and Massey where they give a very nice perspective on differential attacks in general http://www.isiweb.ee.ethz.ch/papers/arch/xlai-mass-inspec-1991-3.pdf They do their ...
3
votes
0answers
96 views

How do I recover RSA primes from the modulus and the coefficient?

The RSA private key contains 2 primes (of about 4096 bits each), and I only know their product (called modulus) and the modular inverse (called coefficient). How do I recover the RSA primes from the ...
3
votes
0answers
58 views

How to decide which diffusion scheme is better for a block cipher design

There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
3
votes
0answers
71 views

RSA calculate $d$ using Chinese Remainder Theorem with $d_p$, $d_q$ and $e$

Suppose for a RSA system I have the following variables given: modulus $n$, expononent $e$, $d_p$ and $d_q$Where, $d_p = d\bmod(p-1)$ and $d_q = d\bmod(q-1)$, Is it possible to find the private ...
3
votes
0answers
34 views

parameter choosing for SIS based scheme in lattice based cryptography

In SIS based scheme, there is a matrix $A \stackrel{\$}{\leftarrow} \mathbb{Z}^{n\times m}_{q}$, and $n$ is the security parameter. I want to ask that why $n=1$ is also okay for the scheme (in "A ...
3
votes
0answers
93 views

Attack on Weierstrass Elliptic Curve

I have a naive question(as non specialist in this field). While reading Weierstrass Curve description,I found that it turns into 2 periodic tori on 2D complex plane. Is is it possible to create ...
3
votes
1answer
82 views

Error-Correction capabilities of encryption?

This is motivated by this question about the recovery of (corrupted) encrypted files, and in particular the statement (in the answer): But If I know the algorithm and the key and I make a custom ...
3
votes
0answers
53 views

Provably secure way of expanding permutations

Gimli is a 384-bit permutation which makes use of an internal 96-bit permutation which works on columns. Every 4 rounds starting from the 1st a "small swap" is performed and every 4 rounds starting ...
3
votes
0answers
88 views

How do byte-sliced AES implementations work?

While I understand the principle of bit-slicing, several papers mention byte-sliced AES implementations (see e.g. Homomorphic Evaluation of the AES Circuit and Fast Implementations of AES on Various ...
3
votes
0answers
139 views

Security of ECC over finite fields of characteristic $p\approx2^{50\pm10}$?

What's the security of Elliptic Curve Cryptography over finite fields of word-sized characteristic $p\approx2^{50\pm10}$? We are talking about $\Bbb F_q$ where $q=p^k$ for some suitable $k$. ...
3
votes
1answer
155 views

Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
3
votes
0answers
38 views

Difference between group key agreement, group key sharing, group key distribution and group key establishement

I am currently doing a survey on group key, and throughout my readings, I stumbled on these different terms: Group Key agreement, Group key Sharing, Group key distribution, and Group key establishment....
3
votes
0answers
43 views

Bitslice DES decryption

I would like to implement fast DES decryption using Bitslice technique. Without bitslice DES technique, I have already done decrpytion in this source code by changing the for loop from 15 to 0. In ...
3
votes
0answers
101 views

Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security test. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
3
votes
0answers
65 views

Homomorphic Encryption Roadmap

I'm looking for some suggestions on what to read (papers, notes, book chapters?) on homomorphic encryption in order to understand the most recent (more optimal) schemes, as well as optimized use cases ...
3
votes
0answers
53 views

ECC: Lightweight proof of correct exponentiation

In the context of ECC. There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is: $P = [k]G$ (in additive notation) This should be verified on an ...

15 30 50 per page
1
3 4
5
6 7
58