Design of cryptographic primitives (algorithms), like block ciphers, stream ciphers, random-number generators, hash functions, MACs, key exchanges, public-key encryption or signature schemes. Also tag with the relevant type of primitive. If you ask about a known existing algorithm, also tag with its ...

learn more… | top users | synonyms (1)

29
votes
1answer
2k views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
27
votes
2answers
15k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
23
votes
4answers
3k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
21
votes
6answers
3k views

Why should I make my cipher public?

As I understand it, the less people know about the internals of my protocol or cipher, the more secure the protocol is. However Kerckhoffs's principle states that A cryptosystem should be secure ...
21
votes
5answers
12k views

What is the lowest level of mathematics required in order to understand how encryption algorithms work?

What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ...
19
votes
4answers
4k views

How do we know a cryptographic primitive won't fail suddenly?

It took more than a decade from when MD5 looked like it was going to break to the point when it was actually broken. That's more than a decade of warning. How can we be sure that when our ...
18
votes
9answers
4k views

Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
17
votes
2answers
8k views

Differences Between White-Box Cryptography and Code Obfuscation

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
16
votes
2answers
2k views

Why is Pearson hash not used as a cryptographic hash?

The original algorithm produces 1 byte long hash and is (of course) not suitable for cryptography use. But according to wikipedia, it is possible and easy to produce Pearson hash of any length, ...
15
votes
3answers
7k views

Can one generalize the Diffie-Hellman key exchange to three or more parties?

Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties? I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
13
votes
2answers
4k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
12
votes
3answers
809 views

What is the best way to put a backdoor in an encryption system?

How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key? I am looking for practical examples encryption schemes ...
12
votes
2answers
16k views

Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509

What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"? Edit: I'm creating the ...
11
votes
2answers
879 views

Why is CRC said to be linear?

It is commonly understood that CRC satisfies the linear identity with respect to the $\oplus$ (XOR) operation: $\operatorname{CRC}(a) \oplus \operatorname{CRC}(b) = \operatorname{CRC}(a \oplus b)$ ...
11
votes
1answer
571 views

How to choose constants in a cryptographic function?

A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ...
11
votes
1answer
191 views

When did Kerckhoffs's principle become fully accepted in design and practice of modern ciphers?

Kerckhoffs's principle is named after a publication over 130 years old. Yet it is still something that is commonly misunderstood and challenged by newcomers to cryptography. This question from Open ...
10
votes
8answers
2k views

Are there any advantages in using proprietary encryption?

Proprietary software generally relies on the fact that in keeping the encryption algorithm private, it gets an extra layer of security implying "Security through Obscurity." Obviously this phrase has ...
10
votes
5answers
7k views

Are there hash algorithms with variable length output?

I understand that for example MD5 produces a 128 bit hash value from a given text of variable size. My question is if there is a hash-like algorithm that will produce a hash value where one can ...
10
votes
5answers
501 views

Choose a random number that is different from a bunch of other secret numbers

I'm looking for an algorithm where n participants each have a different secret number between $[0..x]$ (and where $x$ is known) and where the participants then select randomly another, non-secret, ...
10
votes
2answers
4k views

How can I calculate the SHA-256 “midstate”?

Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here. The general concept is that Bitcoin ...
10
votes
3answers
640 views

Counter mode secure hash algorithm

Ever since the SHA-3 competition, I've been wondering if it is possible to create a hash algorithm that is easier to parallelize. The current algorithms all seem to require building a tree of hashes. ...
9
votes
5answers
6k views

Are there any simple and yet secure encryption algorithms?

Being very new to C++ and cryptography, I finally managed to implement a version of the Vinegere algorithm. I would like to try something a bit more complicated. I have looked at AES and DES and ...
9
votes
7answers
4k views

Where can I begin to study the math behind modern cryptography?

Why do I start the word buffers in MD5 with those values specifically? What in the world motivated the decision to use the numbers 1, 1, 2, 3 for the mix columns stagein AES? And what kind of ...
9
votes
1answer
333 views

Why isn't outputting only a portion of the hash state a simple defense against length extension attacks?

As I understand length extension attacks, they depend on the coincidental property of most cryptographic hash functions that the hash value is exactly the hash function state after hashing the last ...
9
votes
2answers
1k views

How exactly does key whitening manage to increase security?

Wikipedia states that key whitening increases security: In cryptography, key whitening is a technique intended to increase the security of an iterated block cipher. It consists of steps that ...
9
votes
1answer
2k views

Are there any specific requirements for the function $F$ in a Feistel cipher?

In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is ...
8
votes
7answers
2k views

Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
8
votes
2answers
1k views

Why is the permutation in AES (and other ciphers) not random?

If the permutation in AES (or other ciphers) were random, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for the same level of security?
8
votes
1answer
927 views

What's wrong with MARS?

Why did the MARS cipher receive such a high number of negative votes in the AES competition? As I understand only MARS and Serpent implement measures to counter future cryptoanalytic attacks, so it ...
8
votes
1answer
151 views

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick F1(B, C, D) = (B ...
8
votes
4answers
634 views

Hashing a password before using for online accounts

I don't actually know what I'm talking about, so apologies if I get anything wrong. At the moment I have a password naming system for most of my online accounts that looks something like this: ...
8
votes
3answers
880 views

Is there a string that's hash is equal to itself?

I was wondering if there's any string that has a hash equal to itself, so that – when using any (none specific) hash function – the hash would be equal to that string? so that: ...
8
votes
1answer
279 views

Quantum on hash

Perhaps this has been answered before. Grover's algorithm should result in a 256 bit hash being complexity 128 bits to crack. I was wondering, what if you had a 512 bit hash , and xor'd the lower 256 ...
8
votes
4answers
211 views

Is deniable error-correction possible?

This question came up as I tried to answer an earlier question I asked: cryptographic data structure wanted: sparse array without membership test. I still have not resolved that question to my ...
8
votes
1answer
582 views

Understanding how SHA-512 achieves its design goals

The Wikipedia entry on SHA-2 contains a usable pseudocode recipe. In the hope of some deeper understanding, I implemented SHA-256 and SHA-512 from it. This was helpful, but I still don't think I have ...
8
votes
1answer
163 views

Proof of Communication

I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received. Ideally this would take the form of a public-key signature of the block $X$ ...
8
votes
0answers
973 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
7
votes
3answers
734 views

Is this encryption algorithm build from MD5 secure?

I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
7
votes
1answer
221 views

Are more complex algorithms easier to break with timing attacks?

Is there a point where increasing the complexity of an encryption algorithm will make it easier to break using a timing attack? Or is there no connection here at all?
7
votes
1answer
1k views

Why Addition Mod 32?

I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
7
votes
2answers
248 views

Customizable Crypto Algorithms in Hardware

Several companies offer customized cryptographic algorithms, for example Crypto AG (www.crypto.ch/en/company): The individually created customer algorithms are unknown to anyone else and are not ...
7
votes
1answer
513 views

Dancing confusion with Daniel J. Bernstein's stream ciphers

I know of Salsa20 which won the ESTREAM competition. This is dated of 25 Dec 2007. There is also the ChaCha20 stream cipher (cr.yp.to/chacha.html). This claims to increase the amount of diffusion ...
7
votes
1answer
234 views

How many degrees of freedom up my sleeve?

Now that we know how the MD2 S-box was constructed, I find myself wondering how good a nothing up my sleeve number it really is. It is derived from $\pi$, but not in a very obvious way, even in ...
7
votes
3answers
1k views

Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...
7
votes
1answer
303 views

Implementation and Testing of SRP-6a

I have been wracking my brain trying to develop a functioning implementation of SRP-6a in Python to use with a 3rd-party API that claims to use SRP-6a with $N=$ 2048-bit prime and generator of $2$. ...
7
votes
0answers
77 views

Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : ...
6
votes
3answers
1k views

Can I safely replace XOR with ADD in a stream cipher?

In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding ...
6
votes
3answers
116 views

Homomorphic OR operations

Is there an encryption scheme that provides efficient homomorphic OR operations at the ciphertext space? Of course any fully homomorphic encryption can be used but I do not require or want additional ...
6
votes
3answers
318 views

Can nesting different ciphers with different keys ever decrease security?

Very related to this question but not addressed there. Does the following construction risk introducing any vulnerabilities that render it less secure than using either of its individual components ...
6
votes
2answers
551 views

Is it possible to create an easy to use encryption/decryption method that will never be comprimised?

In the comments of the question "Why programming languages don't provide simple encryption methods?" the following statement was made: A well thought out, tested and understood standard that has ...