3
votes
1answer
87 views

Is it safe to derive a password from a signature provided by ssh-agent?

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
2
votes
1answer
39 views

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys ...
0
votes
0answers
16 views

Need help with modular inverse of a solution matrix for the Hill Cipher

I've been trying to teach myself the Hill Cipher (and the bit of modular arithmetic that accompanies it) but I can't seem to make it work. Key matrix: $$ \begin{matrix} 1 & 4 \\ 9 & 16\\ ...
2
votes
0answers
7 views

What is the original SKID3 protocol?

While searching for a mutual authentication protocol I often stumbled upon SKID3. However I encoutered different variations of it. The basic structure is the following: (1) A --> B: rA (2) B --> A: ...
1
vote
1answer
28 views

Extension of a password hashing algorithm

I am right now taking a class named Applied Cryptography and our final project is to create a password hashing method using at least one existing algorithm and then add additional steps to make it ...
0
votes
1answer
54 views

DSA: Authentication and assurance of authorized parties

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private ...
0
votes
0answers
26 views

Can a tree hash with leaf-size of 1 byte support verification of content with elided ranges, at a cost of at most 2 supplied internal-node hashes?

Perhaps someone can confirm my intuition: A tree hash with leaves of size 1 (for example Blake2 in a tree-hash mode) would of course not be very efficient. But it seems that it might be a suitable ...
2
votes
1answer
185 views

Authentication using AES

I need to implement an authentication mechanism in an embedded environment which does not support floating point operations but has an AES accelerator module which allows for encyption/decryption ...
11
votes
1answer
608 views

How to build an electro-mechanical public key cipher machine?

It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ...
0
votes
1answer
25 views

What is ε in differential privacy?

In ε-differential privacy, what does the ε refer to? Is it privacy value or the notation used? Can anyone provide an example of differential privacy?
1
vote
1answer
39 views

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?

In SSL and TLS, why is there a separate Change Cipher Spec Protocol rather than including a change_cipher_spec message in the Handshake Protocol?
1
vote
1answer
18 views

Why is the definition of Special-honest verifier zero-knowledge probabilistic?

Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$. As found in the literature, $P$ can use a ...
0
votes
0answers
24 views

How to reconstruct hash value to the original format? [duplicate]

I would like to know how I can reconstruct a hash value such as 558f68181d2b0c9d57d41ce7aa36b71d9 to its original format (734). I have used a code in matlab, which provided me with an hash output, ...
0
votes
0answers
24 views

Enterprise message bus encryption [migrated]

I'm contemplating using Amazon's Simple Queue System as the basis of an enterprise message bus. According to Amazon, the contents are not encrypted, which means the application(s) will have to handle ...
0
votes
0answers
3 views

How to use /dev/urandom with PHP to get CS random numbers [migrated]

I need to create random integers between the values of 0 and 10,000,000, and I will need several million such numbers. The numbers must be as close to a CSPRNG as possible in that should (for example) ...
2
votes
1answer
24 views

MDC-2 recommended IV values?

I'm currently reading Menezes' "Handbook of Applied Cryptography", and in it, when describing the MDC-2 cryptographic hash function, has the following line: Choose the 64-bit non-secret constants ...
4
votes
1answer
36 views

AES storing the length within the encrypted data versus storing it outside

I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload ...
2
votes
1answer
71 views

LUKS multiple key slots - what's the intuition?

LUKS volumes have the ability to allow multiple independently usable passwords, as explained here: [https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions] The intuition behind basic ...
0
votes
1answer
46 views

Is there a secure source of entropy on a typical microcontroller?

On a device that does not have a hardware RNG, what is the best source for entropy? Some options and pitfalls floating around: Use the ADC to read something analog: can become deterministic if ...
0
votes
1answer
51 views

RSA signature attack check on lowest 16 bytes - Implementation

I am referring to solution given in this question I need help to implement Poncho hint in this comment: As the first question i have an RSA signature of 1024 bit applied on an hash (MD5) of the ...
4
votes
1answer
44 views

More efficient and just as secure to sign message hash using Ed25519?

According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
4
votes
7answers
582 views

A block cipher with independent keys for each round

I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ? Thank you. EDIT Some missing ...
0
votes
0answers
43 views

How does one launch a CPA2/CCA2? [on hold]

There is a (very small) game I play that stores password entries into the local regisry. The entries in the registry form 49-character strings (1 + 32char cipher + 16 constant trailing characters). ...
1
vote
1answer
60 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. Te server performs ...
0
votes
1answer
143 views

security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$. $g$ is a generator of $G_{0}$ and $e$ is a bilinear map, $e : G0 × G0 → G1.$ $𝐶_{1} = 𝑔^{𝛽𝑠_{1}} $, $ 𝐶_{2} = ...
0
votes
1answer
83 views

Key Confirmation Attack [Key Distribution Center (KDC)]

Okay this is how I understood it according to this: Alice $A$ establishes a connection to $KDC$ and prepares for session key Exchange $k_{ses}$ $A$ encrypts the request with her key $k_A(A, B)$ ...
7
votes
1answer
1k views

Why do crypto libs use table lookups when they're vulnerable to timing attacks?

AESEngine.java, from BouncyCastle, uses table lookups as does aes_x86core.c, in OpenSSL. But per Cache-timing attacks on AES table lookups like what OpenSSL and BouncyCastle are doing are vulnerable ...
0
votes
2answers
185 views

Cryptosystems used to generate public key certificate

Where can we find the cryptosystems used to generate public key certificate? Are the cryptosystems under the signature algorithm and signature hash algorithm? Do I need to analyze the packets ...
7
votes
3answers
347 views

Is signing a hash instead of the full data considered secure?

I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to ...
1
vote
0answers
20 views

FFX Encryption over alphabet of arbitrary radix

I understand how standard numeric FPE using a halved string in cycled Feistel networks is constructed and operates. I then read the paper regarding FFX encryption which should allow for any non-binary ...
2
votes
1answer
54 views

Can string lookups be vulnerable to timing attacks like array lookups are?

Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and ...
-3
votes
1answer
37 views

RSA problem - how to find $d$ [duplicate]

For example, let $p = 3$ and $q= 11$, choose $e = 3$. What computation I have to apply in order to find the corresponding $d$? I know it's 7, but I want to know the exact process to be applied to find ...
13
votes
2answers
7k views

Definition of Textbook RSA

What is the definition of Textbook RSA? What are some of the properties of textbook RSA? How does it differ from other RSAs?
2
votes
0answers
25 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
1
vote
1answer
55 views

One time pad ciphers in emails

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? The distribution of the keyword would pose no problems since I would ...
4
votes
2answers
148 views

Customizable Crypto Algorithms in Hardware

Several companies offer customized cryptographic algorithms, for example Crypto AG (www.crypto.ch/en/company): The individually created customer algorithms are unknown to anyone else and are not ...
2
votes
2answers
55 views

Is Checksum to file back decoding possible?

So, I was having this weird thought. If the checksums(MD5 or SHA...) are unique to any file and are modified if any part of the file is edited, why cant the checksums be decoded back to get the ...
7
votes
1answer
98 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
0
votes
0answers
39 views

RSA Encryption: What happens if n is a factor of the message M? [duplicate]

From what I have learned about RSA encryption, the message M and the modulo n must be coprime because Euler's theorem only holds for coprime numbers? for example, what happens if I choose p = 3, q = ...
0
votes
1answer
29 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
1
vote
2answers
90 views

Transforming Gaussian random $[0,1] $ numbers to uniform $[0,255] $

I am not exactly sure if this is for math stackexchange or crypto: A TRNG outputs numbers in $[0,1]$ in a Gaussian distribution. I would like to convert them into uniform random bytes ($[0,255] $) to ...
2
votes
0answers
25 views

Public SRP verifiers or public hash chain “public keys” when secret is low entropy password

I want to set up the following: An untrusted server should host user sessions and authenticate users without knowing their passwords or being capable of creating a fake user session in the user's ...
1
vote
1answer
26 views

ssh-keygen DH Primality Testing

I'm pretty familiar with using ssh-keygen to create groups that go in the /etc/ssh/moduli file for the Diffie-Hellman Group Exchange in openssh. Reading over the man page, it says "By default, each ...
2
votes
1answer
48 views

Extend OTP on random data?

If Alice and Bob both start with a shared OTP $P_0$, which is 256-bytes long, and Alice wants to send a 512-byte message, would it be secure to send the first 256 bytes with standard OTP (...
2
votes
3answers
96 views

Why not put MAC in fixed position and cover padding for MAC-then-encrypt?

The biggest problem with using MtE with a mode where it's known to be secure (CBC) is with the padding, where you can't retrieve the authentication until you know where it is by looking at the padding ...
0
votes
1answer
34 views

can cramer-shoup public key have two difefrent private key?

since I am new to Cramer Shoup algorithm I want to know is it possible to have 2 different private key for a public key due the key pair generation algorithm that Cramer Shoup use? I know that in ...
1
vote
1answer
76 views

Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
1
vote
1answer
37 views

Signature Verification: High level

I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, ...
3
votes
2answers
102 views

Implementing CBC Encryption Using Decryption

I've implemented this algorithm, which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the ...
0
votes
1answer
71 views

The encryption scheme is secure?

I have a scheme and I don't know that this scheme is semantic security or not. -Secret keys $\{s_1,s_2, x_1,x_2\}$ and public parameter $p$ (large prime number) -Encryption E(m): $C_1 = s_1m + x_1k ...

15 30 50 per page