1
vote
1answer
10 views

Size of Pre-Master Secret?

I am implementing TLS 1.2 and using cipher ECDHE_RSA_WITH_AES_128_GCM_SHA256 According to RFC 5346 Section 8.1 length of premaster secret will vary depending on key exchange method. So, what is the ...
1
vote
3answers
27 views

Why the exponent is a power of 2 in Ring-LWE?

I was reading some papers on Ring-LWE. I found almost all of them talk to choose the polynomial modulo $x^n+1$ where $n$ is a power of $2$. I did not understand why this condition is necessary?
-2
votes
0answers
18 views

Login page in Asp.Net -IMPROVEMENT [on hold]

I recently did a registration and login page in ASP.NET and I hashed the password using SCRYPT and saved it to the database. I feel like my project is not complete, I would like to add something ...
0
votes
0answers
15 views

What is the right strategy for me to develop a paid public wifi? [migrated]

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
1
vote
1answer
24 views

multi key encryption

Is there an algorithm which allows using multiple keys for decryption? I had this scenario in mind: think about being a boss of a corperation which has an encrypted data base with loads of secret ...
5
votes
1answer
35 views

In the Quadratic Sieve, why restrict the factor base to quadratic residues?

In the Quadratic Sieve, when factoring a number $N$, many descriptions and most implementations select as the factor base the set of small primes $p$ less than some bound $B$ restricted to having ...
2
votes
2answers
15 views

X509 certificate

I am studying the X509 certificate structure and here is an OpenSSL configuration file for generating the certificate. ("sth" just mean the actual string is removed) ...
-2
votes
1answer
33 views

Range of a number notation

If a number is chosen from $[-n,n]$ is that the same as being chosen from $\mathbb{Z}_n$? Since the operations are modular, what meaning does the negative part of the range have?
2
votes
2answers
55 views

Is this approach able to protect against padding oracle attacks?

I know that a protection against the padding oracle attack is to encrypt-then-mac. This is to avoid trying to decrypt a modified ciphertext, and leak information about padding errors. Suppose that we ...
0
votes
0answers
33 views

RC4 using a key without nonce's or IV's [duplicate]

I'm researching RC4 and I am trying to recreate a condition where RC4 is crackable. However I can't quite find the article/resource I need to find the weakness for an implementation like this ...
2
votes
2answers
27 views

How do I pick variable length passwords uniformly at random?

How do I pick passwords uniformly at random when given a min and max length? It seems that if I first pick a random length, then choose random characters, this procedure will choose shorter length ...
1
vote
1answer
31 views

Sieving the sequence $x^2-n$ to recognize b-smooth numbers

I am currently programming the quadratic sieve and have several literature books / papers and will take an example out of [1] for my question: [1] An Introduction to Mathemtaical Cryptography by J. ...
0
votes
0answers
21 views

Why $p-1$ needs large factors in discrete logarithm?

In discrete logarithm over cyclic group $\Bbb Z_p$ where $p$ is a prime or $p=q^n$ a prime power it is desired that $p-1$ needs to have large factors except for $2$. What is the consequence even if ...
0
votes
0answers
13 views

Why is a-symmetric so much harder to compute and why does it need such big keys? [duplicate]

I read that a symmetric encryption requires a way bigger key size to have the same security as symmetric encryption with smaller keys. But why is this, and why is it so much harder to compute?
11
votes
5answers
3k views

In RSA, how does the CPU deal with this huge modulus (8196)?

Whilst I understand how the RSA algorithm works, I don't understand how the CPU operates when it needs to use the mod function with a huge number $n$, for example. ...
0
votes
1answer
40 views

Fully Homomorphic Encryption over the Integers with Shorter Public Keys

I want to implement Homomorphic scheme from the paper Fully Homomorphic Encryption over the Integers with Shorter Public Keys. I successfully implemented key generation by taking $\lambda = 2, \beta ...
1
vote
1answer
53 views

Scalar Multiplication for Elliptic Curve

Let $\mathbb{E}$ be the elliptic curve $y^2 = x^3 + 6x \text{ mod } 11$ and consider the point $P = (2, 3)$ on it. How do I compute $3P$? I have been able to figure out what $2P$ is, $2P = (5,10)$. ...
2
votes
1answer
57 views

Do I need to use a CSPRNG when creating salts for user accounts?

I'm not sure about the need of using CSPRNG to create salts for each user account. I found “Cryptographically Secure Pseudo-Random Number Generator in Qt/C++ (Cross platform)” (at StackOverflow) with ...
2
votes
0answers
41 views

How does the Number Field Sieve find the target number for Diffie-Hellman?

I have read some papers relating to the Number Field Sieve, but I could not figure out how this algorithm helps in Logjam, or even what is meant by the number field. What is this? What is meant by ...
3
votes
1answer
56 views

Can I change an encryption key used without decrypting first

I'm looking to solve for a little challenge I have in regards to changing the encryption on a message with asymmetric keys. I'd love to be able to swap the encryption to a different key in memory and ...
4
votes
1answer
47 views

Is this a good choice of a digital signature scheme?

This is a concrete instantiation of Rabin-Williams signatures. Specifically: The private key is 2 primes $p, q$. The public key is their product $N = pq$ and is approximately 3072 bits long. the ...
2
votes
1answer
32 views

Is this hash function almost XOR universal?

Consider this hash function: The key $K$ is $2^n$ bits. The message $M$ is divided into $2^n$ bit blocks. Arithmetic is performed modulo $2^{n+1}$. The hash is defined by: $ H_0 = 1 $. $H_{i+1} = ...
3
votes
1answer
20 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
3
votes
2answers
238 views

CBC mode with same plaintext

I'm working on a file encryption system where multiple versions of the same file might exist. The filenames are encrypted using AES in CBC mode with a random IV and stored in metadata. Since versions ...
1
vote
1answer
19 views

Montgomery multiplication without final subtraction

I am looking for methods to avoid the final subtraction in Montgomery multiplication. I found this paper "A Cryptographic Library for the Motorola DSP56000 " (http://goo.gl/DHePEx) In this paper they ...
0
votes
0answers
21 views

Combining Elgamal encryption with the Elgamal signature scheme - Security issues?

For didactic (not real-world) purposes, I would like to teach other students the Elgamal encryption system and the Elgamal signature scheme. Are there known security issues when combining them? (i.e. ...
2
votes
1answer
46 views

DTLS 1.2 Key Expansion

I am using DTLS 1.2 and my cipher is TLS_ECDHE_WITH_AES_128_GCM_SHA256 According to RFC 5246(RFC 5246 key calculation) i am calculating keys but i can not find the size of these keys in this RFC. ...
0
votes
0answers
20 views

OpenSSL ECDSA verification [migrated]

Using ECDSA, how do you verify integrity of Data (D), Given the value for the following: Random number (r) Signature (s) ECpublic Key (K) In other words, Using OpenSSL command line, can I decrypt ...
4
votes
1answer
45 views

How to distributively compute a secret of that form $\mathsf{s=sk\cdot g^a}$?

Is there a standard way to distributively compute secrets shares such that any $t+1$ combination out of $n$ of them constructs the secret $\mathsf{s=sk\cdot g^a}$, for a generator $\mathsf{g} \in ...
6
votes
2answers
285 views

How can a poor RNG impact security?

I have read this article and I do somehow "understand" that the reduction of entropy makes it easier to guess. But how exactly can the security be reduced by that? Can you give a concrete scenario, ...
0
votes
1answer
82 views

Derive $x$ when given $g,g^x$ and $g^{(1/x)}$?

If an adversary has access to the generator g of a group G and is given access to $g^{x}$ and $g^{(1/x)}$, will it make it any easier to derive the value of $x$ compared to when he had access to only ...
11
votes
1answer
1k views

Why can an elliptic curve private key be 1?

I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
1
vote
2answers
43 views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
3
votes
1answer
39 views

Master keys' strengh

If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key? Like should not be distributing 128-bit AES keys derived from a 56-bit DES ...
1
vote
1answer
20 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an MDC (“Manipulation Detection Code”, as also handled in this Q&A) to provide origin authentication when using public-key encryption?
5
votes
1answer
225 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
9
votes
1answer
68 views

Collisions in the cyclotomic knapsack function

I've been working my way through the paper “Efficient Collision-Resistant Hashing from Worst-Case Assumptions on Cyclic Lattices” by Peikert and Rosen, and I've come across something that doesn't seem ...
1
vote
2answers
82 views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
0
votes
1answer
24 views

ECDH Man-in-the-middle active attack

We have Alice and Bob. The man in the middle can manipulate(remove, add something etc.) A sent from Alice and B sent from Bob, how can he figure out what the common key K(A,B) is, without knowing ...
4
votes
1answer
48 views

Can you still decrypt XTS if half of the cipher text is deleted?

If a part of my data is damaged, corrupted, or deleted, is it then still possible to decrypt the rest of the data if you still have the key? The situation: a piece of data (something like a document ...
2
votes
2answers
529 views

Using bcrypt for MAC - is it correct and secure?

Suppose there is a hashing function: $$ph = bcrypt(sha256(m + k), salt)$$ Here $ph$ is a password hash obtaining by applying $bcrypt$ on $sha256$ result of concatenating a message $m$ with a secret ...
3
votes
2answers
174 views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
1
vote
1answer
20 views

Use $e$ in GGH as shared secret?

I was wondering if we could construct a symmetric encryption scheme by assuming that the secret key itself in GGH is public and the shared "key" is the error vector $e$. To encrypt we would take the ...
-3
votes
0answers
28 views

What is this encryption type? [on hold]

I just get the encryption from some website. Here the encryption output: 1) ZFRSA00013GDU and this is the key before encrypted PKR003 2) YHZSA00100PE9 and this is the key before encrypted PJR011 ...
8
votes
1answer
60 views

About random self-reducibility of DDH

In Section 8 of this, Lindell presents a construction of an oblivious transfer protocol which is secure in the malicious model under the following variant of the DDH assumption (page 53): [F]or ...
4
votes
1answer
423 views

How to sign a large file for random-access reading?

I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key. The consuming ...
7
votes
1answer
57 views

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys?

Do I need to worry about timing attacks in Base64 encoding/decoding of private keys? This is a common operation (ex. PEM keys) and is variable time in typical implementations.
0
votes
0answers
15 views

NORX parallel speedup?

How much of a speedup can be expected going from serial NORX (6441) to 4-way parallel NORX (6444) assuming the latter is implemented as 4 word-sliced instances of the former?
2
votes
0answers
75 views

Designing a secure protocol to avoid MITM?

Imagine that you are designing an online game, the framework consists of a player A, a game host H and a trusted central server S. The player A has a symmetric key KAS and id A that is known ...
4
votes
1answer
47 views

Padding schemes for asymmetric encryption with provable security in the standard model

Most padding schemes for asymmetric encryption (OAEP, OAEP+) are only proven secure in the random oracle model. Although no attacks are known, it would be nice to find a padding scheme with provable ...

15 30 50 per page