3
I advocate for $K-P\to C$ and $K-C\to P$ so that encryption and decryption are identical, as in the binary OTP. Each digit is processed modulo 10.
OTP PAD K: 47757 OTP PAD K: 47757
- PLAINTEXT: 65417 - CIPHERTEXT: 82340
----------------- -----------------
= CIPHERTEXT: 82340 = PLAINTEXT: 65417
Update: ...
3
Yes, it is even possible without interaction (nothing Bob needs to send to Alice). The method is called "ring signature".
Let's say she wants to sign a message like "I am Alice an hereby proof to Bob that I know one of the keys".
She hashes it to get $m$.
Alice now generates a random value $r_i$ for every public key $k_i$ and encrypts ...
3
We don't even have to carefully analyze its variant of CBC mode. The webpage for rsyncrypto says it all:
This modification ensures that two almost identical files, such as the same file before an after a change, when encrypted using rsyncrypto and the same key, will produce almost identical encrypted files
Whatever they are doing (reusing IVs, etc), and ...
2
No, an order preserving public key encryption scheme cannot be secure.
Consider any PKE scheme for plaintext space $\mathbb{Z}_n$ for which there exists a public operation that given two ciphertexts (and possibly the public key) allows to test the relative order of the corresponding plaintexts.
Given a ciphertext $c$, and the public key we can then recover ...
2
There are several compilers that take a CPA-secure PKE and produce a CCA-secure PKE. I am aware of two.
The first (possibly the earliest) is the Naor-Yung transformation [NY], which uses a non-interactive zero-knowledge proof (NIKZ) for this purpose. Since we know how to construct NIZKs from a variety of hardness assumptions (e.g., quadratic residuosity, LWE ...
2
"Straightforward" is a relative term. There are algorithms. The basic outline for one of them is
First factor the polynomial into square-free factors using the Square-Free Factorization Algorithm.
For each square-free factor found in step 1, factor it into a products or factors of the same degree (Distinct Degree Factorization).
Use the Cantor-...
2
Here is a proposal (out of my head). Big picture
Bob draws a random $X$, and sends it deterministically enciphered under each public key
Alice deciphers $X$ with the public key she holds
Alice checks Bob did as expected given that $X$
Alice reveals $X$ to Bob
More precisely:
Define a $8b$-bit hash (say SHA-512) such that $\min(n_i)>2^{16b}$
Define a ...
2
They so that by taking an authenticated message, and applying a carefully crafted difference to the message, you can ensure half the bits of the authentication tag will be preserved.
You can repeat the attack on different authenticated cipher texts you captured(or perhaps caused) or (more relevant) different solutions for the linear problem as it is under-...
1
Most standard algebraic encryption scheme admit such zero-knowledge proof of knowledge of the secret key. For example, if the encryption scheme is ElGamal (over a suitable group, e.g. an elliptic curve) with public key $(G,H)$, proving knowledge of the secret key is just proving knowledge of a value $s$ such that $G^s = H$, which is the standard Schnorr ...
Only top voted, non community-wiki answers of a minimum length are eligible
