All Questions

3,142 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
132 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
0
votes
0answers
142 views

Building a CPA-secure sCTR from a PRF

Let $F$ be a PRF with $n = l_{in}(n) = l_{out}(n)$. For any PPT-encoding $[\;\;]:\mathbb{Z}_{2^n} \to \{0,1\}^n$ and any polynomial $l(n)$, $G_l(x) = F_k([1])\|\ldots\|F_k([l(n)])$ is a PRG ...
0
votes
0answers
384 views

Size of group for Elliptic curves vs RSA for equal security

For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
0
votes
0answers
90 views

Oracle version of the IND-PRG game with q queries

Consider the following oracle-based game: $O_0$: Init: $1^n$; Query: output $y \stackrel{u}{\in} \{0,1\}^{l(n)}$ $O_1$: Init: $1^n$; Query: output $G(x)$ with $x \stackrel{u}{\in} \{0,1\}^{n}...
0
votes
0answers
291 views

Difference between Zero Knowledge Range Proof (ZKRP), Zero Knowledge Set Membership (ZKSM) protocols and ZKP

Like to know the difference between Zero Knowledge Range Proof (ZKRP), Zero Knowledge Set Membership (ZKSM) protocols and ZKP? Nathan Aw
0
votes
1answer
138 views

Zero knowledge proof in smart parking managment systems

I read this paper on protecting user privacy in smart parking management system. It talks about using zero knowledge proofs to protect privacy but I am not certain how they do it. My assumption is ...
0
votes
1answer
115 views

Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
0
votes
0answers
112 views

Differential probability of modular subtraction $xdp^-$

The modular addition has been a main component in block cipher. The use of modular subtraction in block cipher is not common but there are some cipher such as Bel-T cipher which uses both modular ...
0
votes
0answers
2k views

How can a XOR encryption be cracked systematically?

It's given that a string, encoded in hex format, is obtained by XOR encryption of a plain text and a key. The key is unknown (not even the length). What are the ...
0
votes
0answers
162 views

Cryptographic Strength of MDS Matrix

Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
0
votes
0answers
71 views

Proxy Reencryption - semi-trust into proxy required?

As far as I understood, PRE claims to hide the underlying message from being read by the proxy. Why can't the proxy simple use a public key of himself as target?
0
votes
0answers
49 views

Derive anonymous dsa key-pair from two certificate authorities

Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a ...
0
votes
0answers
70 views

Discrete Gaussian Sampling in Authenticated key exchange from ideal lattices

I am implementing the key exchange scheme proposed by zhang et al. on Sage. In the implementation of the scheme, they have used the two distributions $\chi_{\alpha}, \chi_{\beta}$. How to choose $\...
0
votes
0answers
257 views

Compact encoding of an elliptic curve point

I'm working on a project with elliptic curve cryptography (ECC), I'm using the secp256k1 library (the one that's used in bitcoin). My goal is to create the most compact platform-independent ...
0
votes
0answers
60 views

Why Diaspora Federation pod communication protocol shares AES keys over asymmetric encrypted channels?

As I was looking over the diaspora federation Magic Envelope documentation, I noticed something weird: { "aes_key": "...", "encrypted_magic_envelope": "..." } ...
0
votes
0answers
503 views

RSA: Multiple Private keys for single public key and N

I'm working on a problem that gives me two private keys $d_1,d_2$ that work with the same $(N,e)$ pair. The problem gives me the two private keys and $N$. Is it possible to find $p$ and $q$? Or how ...
0
votes
0answers
45 views

How much information of the length of a plaintext can an adversary get from its ciphertext?

Let $\Pi$ be a public-key encryption scheme. For every palintext $x \in \{0,1\}^{*}$, is there a PPT adversary $A$ such that $$\Pr \left[ 1^{|x|} \leftarrow A\left( pk, \mathrm{Enc}_{pk} (x) \right) \...
0
votes
0answers
53 views

Implementation of Post-quantum Authenticated Key Exchange from Ideal Lattices

I am implementing the Authenticated Key Exchange from Ideal Lattices on sage maths. On page number 3 the full key exchange scheme is presented. In this key exchange scheme, they are using the Hash ...
0
votes
0answers
105 views

Manually encrypt using RSA X509 in .NET

I don't want to utilize RSaCryptoProvider available in .NET to encrypt data. I would like to encrypt data using the RSA keys, allowing me to send a message to Alice using his public-signature and ...
0
votes
0answers
262 views

Deriving an encryption private key from signature private key

If I have a cryptosystem in which I require both signing and deriving a shared secret key for encryption, what is the recommended way of achieving that? Is there any vulnerability in generating a ...
0
votes
0answers
78 views

why isnt E a secure block cipher

Let $\pi : \{0,1\}^n \rightarrow \{0,1\}^n$ be a permutation. Let $E(k, x) = \pi(x \oplus k)$ where $x,k \in \{0,1\}^n$. Why isn't $E$ a secure block cipher? My idea: Suppose $E$ is a secure block ...
0
votes
0answers
729 views

secure PRFs and XOR

Let $F(k,x)$ be a secure PRF over $(\mathcal{K},\mathcal{X},\mathcal{Y})$ where $\mathcal{K} = \mathcal{X} = \mathcal{Y} = \{0,1\}^n$. Why is the function $F_1(k, (x_1, x_2)) = F(k, x_1) \oplus F(k, ...
0
votes
0answers
72 views

Information sharing using interactive zero-knowledge system

I am trying to build a system that would allow information sharing in a kind of zero-knowledge way. Here is the set up: Let's say there is a trusted third party that has Alice's sensitive info M (e.g....
0
votes
0answers
46 views

(Side channel) attack on a PIC18 micro controller

I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about: Preset I have physical access and I own/wrote the software, ...
0
votes
2answers
321 views

IKEv2 DH Group on SonicWall

I am developing internal standards for IPsec VPN setup on SonicWall firewalls, and I have been learning about IKEv2. When IKEv2 "mode" is selected, the UI disables the DH Group, Encryption, and ...
0
votes
0answers
96 views

Differences between Single photon QKD system (BB84) and EPR photon-pair QKD system (BBM92) for quantum public key distribution?

What are some differences between Single photon QKD system (BB84) and EPR photon-pair QKD system (BBM92) for quantum public key distribution?
0
votes
0answers
82 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
0answers
89 views

How does Poly1305 use $2^{130}-5$?

How is the number $2^{130}-5$ used in Poly1305? It operates on blocks that are 128 bits long, but the number has 130 bits. I don't understand how it is used. This comment makes me think it uses ...
0
votes
0answers
153 views

Why is the slide attack called a generic attack if it depends on each round being the same?

From reading the answers on this website, a generic attack is one that works on all block ciphers (e.g., brute force). The slide attack does not work if the round functions are different, whether they ...
0
votes
0answers
103 views

Turning an S-box into a keyed S-box

Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it ...
0
votes
0answers
144 views

Random self-reducibility and NP

I was reading the Wikipedia page https://en.m.wikipedia.org/wiki/Random_self-reducibility and it states: "If an NP-complete problem is non-adaptively random self-reducible the polynomial hierarchy ...
0
votes
0answers
187 views

MTI/A0: modular arithmetic or elliptic curves?

In the Handbook of Applied Cryptography (Menezes, A. J.; van Oorschot, P. C. & Vanstone, S. A.) Protocol MTI/A0 key agreement (algorithm 12.53) described as $\mod p$-protocol. The survey Overview ...
0
votes
0answers
80 views

Security of an S-box based on modular multplicative inverse

The construction of Rijndael's S-box starts with the multiplicative inverses of each number over a finite field. It seems like this is the main source of its non-linearity. I figured that modular ...
0
votes
0answers
38 views

Additive masking for encryption inside $\mathbb{Z}$

If I have to obfuscate my value $m$ from someone, then what is wrong with just showing them $m+r$ as an "encryption" of $m$. If someone would try to guess $m$ from it then it would require them to ...
0
votes
0answers
22 views

Minmum Key Length for Block Ciphers Required keeping in view futuristic quantum computers

In an answer to the Question "What are recommended, general strategies to start block-cipher design and/or analysis?", in terms of brute force attack, it is written 256 bits is considered secure ...
0
votes
0answers
42 views

Security of this parallelizable two-pass authentication scheme

This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever). ...
0
votes
0answers
173 views

How does “one-pass” authentication differ from “two-pass”?

The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type;...
0
votes
0answers
95 views

How is the security of a plaintext of Ring-LWE without an error term?

I think until public key $\mathsf{pk}=(b=-[as + e]_q,a) $ is broken, Ring-LWE is secure where $a$ is uniformaly random polynomial, $e$ is an error sampled from gaussian distribution with std=$\sigma$ ...
0
votes
0answers
65 views

Authenticating PBKDF2 params from the server

In my app, I use PBKDF2 to stretch a user inputted password. I split the result in two: the first half is stored locally as an encryption key (and never sent to the server), and the second half is ...
0
votes
0answers
130 views

Protection of Nonce in CCM Block Cipher Mode of Operation?

CCM mode of operation combines CBC (for integrity and authentication) and CTR mode (for data confidentiality) The inputs to the CCM are A Valid Nonce N which is used in CTR mode Valid Payload P ...
0
votes
0answers
57 views

Should a certificate be validated every time it is used?

In contrast to private keys, public keys don't need to be stored on a secure place. But what if somebody changes a certificate with a public key to just another one? To ensure certificate authenticity,...
0
votes
0answers
99 views

How to authenticate indivisual value after applying homomorphic encryption using Paillier homomorphic

Assuming I have three parties in a system: Alice, Bob, and a Server. Alice and Bob needs to aggregate some messages $m1$ for Alice, and $m2$ for Bob. And send the aggregate $m1+m2$ to the Server. I ...
0
votes
0answers
37 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
0
votes
0answers
49 views

Authenticated file encryption scheme

Suppose I want to encrypt and authenticate a large file. The file is so large that it cannot fit entirely in memory, and I will be processing it in a streaming fashion. Truncation of the file and ...
0
votes
0answers
89 views

Interpretation of message space distribution in the definition of perfect secrecy of encryption schemes

I am a beginner to cryptography, and have started reading Katz and Lindell's book titled "Introduction to Modern Cryptography". I'm unable to understand what the probability distribution over the ...
0
votes
0answers
117 views

Given non-interactive zero-knowledge proofs as a primitive, wouldn't signatures be easily implemented with hashes?

Assume a working non-interactive zero-knowledge proof implementation. Would a public key signature scheme implemented as this work: Bob picks a random a, his ...
0
votes
0answers
80 views

Difference between public coin and common coin?

What is the difference between public coin and a common coin? I often see both appearing in the literature, but I cannot explain myself, whether they are the same concept or not.
0
votes
0answers
74 views

Why isn't the maximum security of triple DES 48 * 2 vs 56 * 2?

The security of quadruple or even more encryption isn't much more than that of double encryption. But each round also counts as one encryption. So why isn't triple DES only 96-bits secure?
0
votes
0answers
141 views

Why do we always prove cryptographic protocols via completeness and soundness?

Most of the proofs that I have seen for cryptographic protocol include completeness and soundness. Why do we always prove completeness and soundness? Why do we not also see other propertes such as "...
0
votes
0answers
72 views

Lsb as hard core predicate in a sign-hash scheme

Given a random oracle and a deterministic signature scheme. Is the following $hc(x)$ an hardcore predicate of $H(SIG_k(x))$ ? $$hc(x)=lsb(H(SIG_k(x)))$$ How would I get to think about this? I saw a ...

15 30 50 per page
1
57 58
59
60 61
63