usually secret information used as input to various kinds of cryptographic algorithms, like encryption, signature, MAC, to select the concrete transformation done by the algorithm.

learn more… | top users | synonyms

3
votes
2answers
776 views

Determine the Key given ciphertexts and plaintexts?

Given two sets of plaintexts and their corresponding ciphertexts, how does one determine the key $K$? The ciphertexts are: $$C_1= (P_1 \oplus K_0) + K_1$$ and $$C_2= (P_2 \oplus K_0) + K_1$$ $K = ...
1
vote
3answers
423 views

Does it make sense to block RSA keys under 1024 bits?

A paper I found (http://eprint.iacr.org/2012/064.pdf, which was submitted to a cryptography conference about two years ago), is based on the analysis of some 7.1 million 1024-bit RSA keys published ...
2
votes
2answers
109 views

Could someone reuse client certificates?

To my understanding, if a server “cert+key” (RSA) is compromised, than the SSL/TLS network traffic can be decrypted. What about a client “cert+key” (RSA)? Could someone reuse client certificates? ...
1
vote
1answer
166 views

What is “serial concatenation”? [closed]

I have a third-party point-of-sale API (Speedflow Pay-N-Get) that I am trying to communicate with over HTTP, but I have a problem with it. In a nutshell, a request is encrypted using RSA, and the ...
7
votes
2answers
1k views

Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
3
votes
2answers
124 views

What is the function of the secret key “r” in Poly1305?

Poly1305-AES uses two per-connection keys $k$ (for AES) and $r$ (for Poly1305's compression function) and a per-message nonce n to execute. I've read the original paper on the implementation, and I ...
3
votes
1answer
216 views

What is 'key agility' in relation to symmetric-key encryption?

I sometimes see, in discussions of symmetric ciphers, reference to the 'key agility' of a particular algorithm. It seems to be related to the difficulty of switching encryption keys, but I don't ...
1
vote
1answer
74 views

Decimal point in keyspace notations? (eg 2^54.15)?

I was reading up on CryptoCat's (pretty ridiculous) programming issues and how is dramatically reduced the key search space (link to bug synopsis) One thing that caught my eye was So 2^54.15 ...
1
vote
2answers
125 views

Encoding multiple fields with same AES key and vector?

I'd like some advice on cryptography best practices. I need to store on my web app the users' credentials (login & password) for 3rd-party sites. I'm using AES-256 with random key and ...
8
votes
2answers
602 views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ...
1
vote
2answers
238 views

Why can we always assume that $Gen$ algorithm choose key uniformly?

Talking about a (symmetric) encryption scheme $\Pi=(Gen,Enc,Dec)$ where $Gen$ take the security parameter $n$ as input and generates a key $k$ of length $n$. Generally speaking we say that $Gen$ ...
6
votes
1answer
944 views

Is a private RSA key vulnerable to a chosen plaintext encrypted with that private key?

I grasp that having known plaintext encrypted with the public key doesn't provide a means of discovering the private key (that being the whole point...). But if one were in a situation where they ...
1
vote
0answers
84 views

Perfect Forward Secrecy in MTI/A0

Would the property of perfect forward secrecy still be achieved in MTI/A0 for a session key that was established between C and D when one LL-key aD is revealed so that both LL-keys aC and aD are ...
0
votes
2answers
1k views

If I have the unencrypted text and the encrypted text, can I calculate the key?

If I have the unencrypted text and the encrypted text, can I calculate the key? It seems logical based on my limited knowledge of encryption that I should be able to... but it also seems like too ...
1
vote
2answers
103 views

Password as it relates to various encryption schemes

Suppose you have 2 drives you want to encrypt using different encryption algorithms, as an example: AES256 and Twofish. I am aware that using the same password for both could potentially weaken ...
0
votes
2answers
116 views

The weak link is the password?

Consider a secure modern block cipher like AES/Serpent/Twofish. I hear everyone say that the complexity is $2^{128}$ for a 128 block cipher. But isn't the weak link the actual hashed and salted ...
1
vote
1answer
546 views

What's the difference between the long term key and the session keys?

I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key". What's the difference between these two kinds of keys?
2
votes
2answers
545 views

Is there an effective way for public key generation in homomorphic encryption schemes?

Is there any way to effectively generate valid distributed public key in schemes like ElGamal or Benaloh for a number of participants? There's no need in private keys since there's no intent to ...
2
votes
1answer
180 views

Having 4096 bit keys and short (< 256 byte) messages, can I simply use the key as OTP?

Assumptions: Alice and Bob use (cryptographically secure, hardware-rng generated) 4096 bit keys. Each message is encrypted using a new key; meaning: once a key is used, it's destroyed. Alice and Bob ...
3
votes
1answer
304 views

Which PRNG security requirements do I need for key generation

Do I need to worry about "predictability" an an allegedly secure CSPRNG if I am just using it to generate key material from time to time? Suppose that for some odd reason, I am less trustful today ...
5
votes
3answers
525 views

Order of cascaded ciphers

Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys? For example: ...
2
votes
1answer
95 views

What is the security risk if an encryption key is not random?

Ok, I just jumped into crypto and now struggling with some points… I read lots of resources, most of them mention how important the strength of the encryption key is. However, I could not find much ...
2
votes
1answer
382 views

Since it gives negative power, how is rcon(0) calculated in AES?

I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation ...
2
votes
1answer
1k views

Two different approaches for Key Expansion using the AES-256 algorithm?

I am implementing AES 256-bit Algorithm from the Theory given in the book, "Cryptography and Network Security" by Behrouz A. Forouzan. The Algorithm described in the Book in relation to ...
0
votes
1answer
236 views

Key space: Dense and sparse

I'm taking a cryptography class and I come across these terms dense and sparse key space allt he time. What do they mean? As far as I can I understand, dense key space means that there are more ...
1
vote
1answer
158 views

Intuition for random variables in cryptography

I have a simple question about the use of random variables for encryption schemes, to make sure my intuition is correct. We say $P(K = k)$ to represent the probability that a particular key $k$ is ...
1
vote
1answer
401 views

Key-size of encryption method

Is there a definied keysize to be used with the "AES_256-CBC" method in PHP, and what is the size? Some background: I want to store encrypted text into a PostgreSQL database. The user who posts the ...
3
votes
1answer
255 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
1
vote
2answers
226 views

Is there a theoretical maximum useful keysize given the block-size?

Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then: ...
2
votes
1answer
737 views

Self-expiring symmetric keys, or: cryptography in absence of secure deletion

I can encrypt some data D using a random symmetric key K, obtaining a ciphertext C, and then encrypt K with my public key Pub and obtain H. So far so good: I can only decrypt C if I have H and my ...
0
votes
2answers
469 views

One Time Pad Question

I have a ciphertext encoded with One Time Pad. I do not know the key. How can I find the possible keys which when decoded, will result in a meaningful plain text?
6
votes
2answers
2k views

AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ? (The obvious answer would be ...
6
votes
2answers
2k views
4
votes
1answer
195 views

Swapping Key and IV in AES? Safe?

I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, ...
5
votes
3answers
8k views

AES 256 Encryption - Is it really easy to decrypt if you have the key?

So this might sound like a crazy question but bear with me for a minute. I can't find any info on the internet and so am here, although this might have been a good place to start. I've recently ...
3
votes
1answer
71 views

Modes for encrypting small binary blobs?

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a ...
1
vote
0answers
193 views

IV and Headers inside cipher text

I am a bit confused about the use of IV, and key hash. Is the key hash and IV stored inside the headers of the cipher text? Isn't it a security risk to store this header information? By key hash I ...
1
vote
0answers
95 views

can permutation matrix be found in parallel processing technique?

Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ ...
4
votes
1answer
149 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
8
votes
5answers
980 views

Encrypt a file once with 50 characters password or twice with 25 characters?

What better Encrypt the file once with 50 characters password or encrypt it twice each time with 25 characters password.
1
vote
0answers
167 views

How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
2
votes
2answers
269 views

Encrypting and MACing different data with same key

It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
1
vote
1answer
200 views

Scrypt as a KDF with one-time high-entropy input

I'm looking at using Scrypt as a KDF. Assume the following: the input will always be high-entropy random bytes generated by a CSPRNG the length of the input can vary from between 8 to 32 bytes the ...
3
votes
2answers
605 views

Reason(s) for using a KDF for encryption keys

Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
1
vote
1answer
278 views

brute force attack on KDF vs KEY

if we believe 256bit keys are secure in AES against any brute force attack, is that possible we use a KDF (convert user's weak entered password in truecrypt into a fixed AES key) with too much round ...
3
votes
1answer
511 views

Difference entity authentication and implicit key authentication

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions: Implicit key authentication is when one party is assured that no other aside from a ...
1
vote
1answer
474 views

How is text converted to a number for RSA? [duplicate]

According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ...
2
votes
1answer
1k views

AES encryption with multiple keys

I would like to encrypt some data using a combination of multiple keys. There would be two keys: a client keys that would be generated for each client and a single server/application key used by ...
2
votes
3answers
300 views

Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages

I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system. So we have Bob -- The person who sends the message (and knows it's recipients) ...
0
votes
1answer
79 views

Encrypting a broadcast channel

We're building a data service that is expected to go out through a single "fat pipe" channel. The design requirement says that the data in the channel must be protected by authentication and ...