Questions about official cryptographic standards and their implementation.

learn more… | top users | synonyms

3
votes
2answers
270 views

PGP String-to-Key specifiers

I've been reading through the PGP Standard and here I'm a little confused. This section is discussing converting string data to a session key. I'm confused about the paragraph in bold. First off, what ...
14
votes
2answers
1k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
4
votes
1answer
69 views

What is the major difference between FIPS 186-2 and FIPS 186-4?

Can anyone please tell me the major difference between FIPS 186-2 and FIPS 186-4? I know with FIPS 140-2 they want the DSS standard to be FIPS 186-4, but what difference does it make?
1
vote
0answers
57 views

How to normalize data of a generic HTTP request for the purpose of signing

I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the ...
1
vote
0answers
46 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
6
votes
1answer
108 views

What does the TLS 1.2 client finished message contain?

I am implementing TLS 1.2 and I'm stuck on the client finished message. My question is: what is the size and structure of a clients finished message in TLS 1.2 when using the ...
2
votes
0answers
40 views

What is the canonical way of creating merkle tree branches?

I'm currently looking into creating some compact merkle tree branches to prove that a given hash was included in a given merkle root. My initial thought was to list the leaf, the merkle root and all ...
3
votes
0answers
38 views

EC Schnorr signature: multiple standard?

I 'm working on some EC-Schnorr signature code. Reading various papers on that, it's seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main ...
0
votes
0answers
30 views

Key size limitations due to software compatibility?

At the moment, much popular encryption-based software routinely handles up to 4096 bit keys and standard usage is broadly migrating from 1024 to 2048 bit keys. Hashes widely used are MD5/SHA1/SHA256 ...
4
votes
2answers
2k views

Randomness test question from FIPS 140-1 and comparison with 140-2

In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the ...
4
votes
3answers
286 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
2
votes
1answer
38 views

Can one passively load-balance HTTPS traffic based on TLS SNI?

Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the ...
0
votes
0answers
11 views

A standard for multi-key provider encrypted data?

I'm looking for a standard that standardizes data encryption with multiple and diverse key sources to represent a heterogene access structure and culture. The standard must offer the following ...
1
vote
1answer
79 views

Where can I get the correct and precise algorithms for elliptic curve cryptography?

I have been asked to implement cryptographic operations using elliptic curves. I would like to get precise algorithms for various processes like key generation, digital signature and verification. I ...
6
votes
0answers
85 views

Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
1
vote
1answer
44 views

Is there a standard prefix random padding scheme?

Is there a standardized padding scheme which is prefix instead of postfix and that uses random bytes except for the first byte which would be the length of the padding?
4
votes
3answers
292 views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
1
vote
1answer
50 views

Clarification of RFC2246 with regards to Finished Message

I'm working on a client handshake finished message for a TLS client, and I'm reading through the RFC 2246 spec. The spec states (in section 7.4.9): The hash contained in finished messages sent by ...
13
votes
3answers
5k views

Why is the P-521 elliptic curve not in Suite B if AES-256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have ...
10
votes
3answers
919 views

How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
3
votes
1answer
301 views

Standard format to encode AES cipher and random IV

As far as I understood, a secret key (same length as CBC block size) and an initialization vector (IV) are needed to decrypt a AES-256-CBC encrypted string. As the IV should better be random, it has ...
6
votes
2answers
270 views

Is standardizing a modified AES a good idea?

"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
0
votes
1answer
77 views

What does the acronym “CRT” stand for in the PKCS #1 specification?

What does the acronym "CRT" stand for in the PKCS #1 specification? Does it stand for "Chinese Remainder Theorem"? Thanks, Pete
6
votes
1answer
93 views

Would key stretching help mitigate concerns with “verifiably random”?

Daniel J. Bernstein (and others) have expressed concern over how "verifiably random" curve parameters are generated. He points out that hashing a public seed doesn't prevent, say, the US government ...
1
vote
1answer
305 views

How to create a PEM file for storing an RSA key?

I have an RSA private key $\{d,n\}$ and a public key $\{e,n\}$, where $n$ is the modulus, and I also have the prime factors $p$ and $q$ of $n$. I want to create a PEM file containing this ...
2
votes
0answers
107 views

Standards/RFCs for non-Diffie-Hellman perfect forward secrecy?

Some time has passed since PFS introduction and we now have secure&proven asymmetric ciphers that can generate strong keys very efficiently (elliptic RSA variants and/or QD-Mceliece can generate ...
2
votes
0answers
210 views

BER or DER X9.62 ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
3
votes
1answer
471 views

What weaknesses in Hash_DRBG did NIST find and fix?

Matthew Green states in the Practical Kleptography presentation (video, at about 12:15) that Hash_DRBG (from SP800-90A) as originally proposed by NSA had potentially exploitable flaws or bugs and that ...
4
votes
1answer
215 views

How HOTP values are validated according to RFC 4226

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part, The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP ...
8
votes
2answers
419 views

What current authenticated key exchange standards exist?

If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended? Many protocols have ...
4
votes
1answer
161 views

Which version(s) of SRP are in ISO/IEC 11770-4:2006?

I am on the impression that SRP emerges as the least uncommon and best analyzed protocol for authentication and key agreement based on a short password. This states that SRP is part of IEC 11770-4, ...
3
votes
1answer
341 views

RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For ...
2
votes
2answers
309 views

Password-based encrypted key storage?

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
4
votes
2answers
950 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
3
votes
0answers
1k views

Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements? [closed]

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, ...
1
vote
2answers
156 views

Standard or guidance for entropy collection

I need to write some high-level security requirements which include a random number generator suitable for use in cryptography. I don't need something very formal, this isn't a security certification ...
4
votes
2answers
2k views

Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
2
votes
1answer
191 views

How does SSL secure the initial handshake?

I'm reading the SSL specs, and it seems that the initial handshake has no authenticity protection at all. What is to prevent, say, an attacker from overwriting the "available ciphers" list with one ...
4
votes
3answers
1k views

NIST temporarily closed — will that have a negative impact on the future of cryptography?

For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA. The text at their ...
10
votes
1answer
2k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
2
votes
1answer
488 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
6
votes
2answers
1k views

How does one calculate the cryptoperiod?

NIST Special Publication 800-57 defines a cryptoperiod as the time span during which a specific key is authorized for use by legitimate entities, or the keys for a given system will remain in ...
10
votes
1answer
1k views

What changed in PKCS#1 v2.2, and why?

PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA. That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two ...
5
votes
2answers
221 views

How long does it take to extract a key from a FIPS-140 Level 2 device?

How long does it take to extract a key from a FIPS-140 Level 2 device? What records are there of successful extraction? How much did the first extraction from a given device cost? How much would a ...
7
votes
1answer
537 views

Are stream ciphers no longer considered by NIST?

While reading NIST SP 800-90A, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", I noted that no stream cipher was included among the various specified ...
1
vote
1answer
125 views

WebcryptoAPI - secure or not [closed]

This is about the new W3 WebcryptoAPI draft standard. Here is a post by one of it's authors https://plus.google.com/u/0/105761279104103278252/posts/CSwVZ1RUijo It says its in part trying to change ...
7
votes
2answers
5k views

Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures? I understand that ...
4
votes
2answers
4k views

Secure private key storage

I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years). The two most common standards of storing private keys are PKCS12 and JKS ...