Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its ...

learn more… | top users | synonyms (1)

2
votes
1answer
80 views

Variants of AES? [closed]

Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
3
votes
2answers
132 views

Is this a plausible PBKDF?

Background: Hello, I'm working on a hobby project in which I might want to implement a key derivation function within a somewhat resource limited embedded system. For standard crypto functions, I ...
3
votes
2answers
268 views

Security issues of a MAC-then-Encrypt-then-MAC approach?

Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ...
7
votes
1answer
166 views

Implementation and Testing of SRP-6a

I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...
9
votes
2answers
524 views

How exactly does key whitening manage to increase security?

Wikipedia states that key whitening increases security: In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that ...
7
votes
1answer
188 views

How many degrees of freedom up my sleeve?

Now that we know how the MD2 S-box was constructed, I find myself wondering how good a nothing up my sleeve number it really is. It is derived from $\pi$, but not in a very obvious way, even in ...
4
votes
0answers
65 views

Homogenous and heterogeneous Unbalanced Feistel Networks

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round). The advantage of heterogeneous UFNs ...
2
votes
1answer
104 views

How to only encrypt a subset of the plaintext

I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext. I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a ...
0
votes
1answer
92 views

About S-box in AES

I am working on AES. Can we expand $s(a \oplus b)$ in terms of $s(a)$ and $s(b)$ where $a$ and $b$ are two eight bit inputs and $s(a)$ is the S-box value of $a$?
3
votes
2answers
606 views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
1
vote
1answer
134 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
1
vote
1answer
117 views

Rate my idea: is that a stronger GPG-like algorithm?

I came up with a simple idea but I don't know if it is really secure or not. I know that you shouldn't create any algorithm on your own. I'm just curious, that's all. Algorithm explanation: First ...
4
votes
2answers
97 views

Advantages of making streamcipher stream depend on plaintext?

Most descriptions that explain how streamciphers work (like the one on Wikipedia), tend to describe a model that boils down to a simple “$ciphertext = plaintext \oplus stream$”, where the stream is ...
3
votes
3answers
214 views

Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
2
votes
3answers
286 views

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
2
votes
1answer
154 views

How does Web Cryptography API produce secure PRNG?

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Specifications: https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#RandomSource-interface ...
3
votes
1answer
147 views

Math to replace s-boxes - Good or bad idea?

The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie ...
3
votes
1answer
136 views

Is it a good idea to use Lagrange/Newtonian interpolation for encryption?

I see that Lagrange interpolation is commonly used for secret sharing, but could it be used for encryption? The goal is to reduce database I/O and compute new values on the fly. Suppose the use case ...
1
vote
0answers
66 views

A question or few about Mental Poker

I have spent some time studying the "Mental Poker" protocol (sometimes called SRA), initially proposed by Shamir, Rivest, and Adleman -- ...
1
vote
1answer
82 views

How to adjust scrypt parameters for Moore's Law?

I have been examining the scrypt paper, and I noted the claims in table 1. For 10 random ASCII characters, the cost at that time for scrypt set to $(2^{14}, 8, 1)$ is estimated to be $175T/yr. ...
1
vote
1answer
156 views

Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA-256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the number of bits in $W(i)$ keep ...
4
votes
1answer
84 views

Length-preserving all-or-nothing transform

Is there any known way to construct a length-preserving all-or-nothing transform? In other words, a secure all-or-nothing transform where the length of the output is the same as the length of the ...
8
votes
5answers
356 views

Choose a random number that is different from a bunch of other secret numbers

I'm looking for an algorithm where n participants each have a different secret number between $[0..x]$ (and where $x$ is known) and where the participants then select randomly another, non-secret, ...
3
votes
1answer
392 views

How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as: $$ \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ...
1
vote
1answer
77 views

Algorithm accepting every passphrase to fool unlegit user [closed]

I'm looking for specific names and literature on crypto algorithms that accept every passphrase input by the user, in order to 'decrypt' - even with false passphrase - and present the unlegit user ...
2
votes
1answer
416 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
1
vote
1answer
187 views

Building a stream-cipher out of a hash function?

I've already read this: Is it feasible to build a stream cipher from a cryptographic hash function? However, my proposed construction differs… Suppose the hash generates N bits. These bits are split ...
0
votes
1answer
187 views

Is this EdDSA modification secure?

I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...
3
votes
0answers
191 views

Pseudo-Hadamard transform, most significant bit

For clarification: The Pseudo-Hadamard transformation is a reversible transformation of a bit string that provides cryptographic diffusion. Splitting a bit string (with bit length of $2n$) into two ...
2
votes
1answer
97 views

Is it possible to combine two operations rotation and xor?

I can see many xor and rotation operations in cryptography. I just want to make some algorithms fast. So, I'm looking for a way to combine between xor rotation operations. I don't know if it is ...
1
vote
0answers
57 views

Special random distribution algorithm

I am implementing ring signatures as a part of an authorization system. Since the number of users could get high enough to make computation on end-user devices infeasible, I am thinking of ...
3
votes
1answer
128 views

Skein state size advantages

Skein is defined for three different internal state sizes: 256 bits, 512 bits, and 1024 bits – with Skein-512 as the “primary proposal”. Is there any advantage – other than potential memory or speed ...
8
votes
1answer
348 views

Understanding how SHA-512 achieves its design goals

The Wikipedia entry on SHA-2 contains a usable pseudocode recipe. In the hope of some deeper understanding, I implemented SHA-256 and SHA-512 from it. This was helpful, but I still don't think I have ...
2
votes
2answers
369 views

DES with actual 7 byte key

Do we have any library or any mechanism where we can use true 7 byte key for DES instead of 8 byte key. I need it for keys analysis in DES and 8 byte key requirement for associated library is creating ...
1
vote
0answers
18 views

Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
1
vote
1answer
179 views

ECDSA Public Key generation

Referring to both Wikipedia page and ECDSA-cert paper I can understand that, given $\mathcal{E} = \mathcal{E}(a,\,b,\,\mathbb{F}_{2^m})$ as our elliptic curve on $\mathbb{F}_{2^m}$ group $G \in ...
1
vote
1answer
66 views

Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
2
votes
0answers
179 views

implementing a cryptographic hash with a block cipher [duplicate]

How can a cryptographic hash function be implemented/created using the block cipher? I was wondering if we can use AES in cipher block chaining mode to implement it.