2
votes
1answer
69 views
low-exponent RSA
I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1
Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$.
Suppose further the messages are ...
1
vote
0answers
28 views
Blowfish in CBC mode with multi-use keys. Is the 64-bit blocksize a fatal issue if one were to encrypt TBs of data?
This is a followup to a question I asked on stackoverflow, (should have asked here or on Superuser I know).
...
0
votes
2answers
105 views
Recommended authenticated stream cipher for minimum overhead?
I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet.
This causes quite a bit of space overhead for small packets, so at first I ...
3
votes
2answers
59 views
Difference between “one-way function” and “cryptographic hash function”
What's the difference between a one-way function and a cryptographic hash function?
1
vote
1answer
34 views
What is U2FsdGVkX1?
Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with
U2FsdGVkX1
Why is the first part of the encryption always the same?
What information does this hold and ...
1
vote
0answers
35 views
Is using EAX mode with a 64-bit block cipher a bad idea?
EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize. So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would ...
2
votes
1answer
47 views
Is a small size block cipher usable?
Consider a block cipher with a key of size 128 bits but a small block size, say 32 bits, is this kind of block cipher secure ?
Thank you.
0
votes
2answers
48 views
Is rainbow table attack applicable to any hash?
Typically when rainbow tables are discussed MD5 hash is used as an example. It's not quite clear whether this attack is specific just to MD5 or to a certain subset of hashes or to just any hash ...
0
votes
0answers
38 views
Can two cipher letters per plaintext letter easily defeat character frequency analysis?
For a class 5 years ago I wrote a paper about defeating character frequency analysis by using two cipher letters per plaintext letter. I didn't get much feedback from the professor so I wonder if ...
2
votes
1answer
74 views
Is there a hash function which has no collisions?
To clarify, it would be some function which would produce variable-length output, and never produce the same output for differing input. It would also be computationally hard to derive the input from ...
6
votes
1answer
136 views
+50
How to build an electro-mechanical public key cipher machine?
It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT.
Imagine, if the abstract idea of having a public key and a ...
1
vote
1answer
57 views
How hard is it to generate a partial RSA fingerprint collision?
When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
2
votes
0answers
24 views
Clipper chip (SKIPJACK) key exchange protocol
According to the Wikipedia page for NSA (emphasis mine):
However, NSA's Fortezza hardware-based encryption cards, created for
the Clipper project, are still used within government, and NSA
...
1
vote
2answers
103 views
Is it possible to cryptographically prove when was the last time a ciphertext was decrypted/encrypted?
I want to provide a service that encrypts and decrypts documents and I want to provide the users with proof that I haven't stolen their secret key and read their documents.
I know I can prove when a ...
2
votes
1answer
95 views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
1
vote
0answers
70 views
Hash function with values in a multiplicative group of prime order
I have to implement a cryptographic protocol which involves a cryptographic hash function $H: \{0,1\}^* \to G$. It is viewed as random oracle. $G$ is a multiplicative group of prime order.
I want to ...
0
votes
0answers
25 views
Reverse engineering from known ID inputs and 19/20-digits outputs
I am currently having few samples of a hash encryption function as per following
ID Hash
542591 6896202108404922949
3210 7693203936755907764
2455 14877541378540063734
2275 ...
1
vote
1answer
99 views
Security of authenticated encryption modes gcm & ccm
I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
0
votes
0answers
21 views
public key distribution from a central server [migrated]
I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
3
votes
4answers
162 views
Can cryptography be used to hide routing information from the router?
If Alice wants to talk to Bob and she has to involve a third party system run by Carol to establish, and possibly maintain, communications, then Carol knows that Alice and Bob communicated with each ...
2
votes
1answer
175 views
Anonymity in end-to-end encryption
Considering a scenario of anonymous data transfer between seller and buyer using proxies. If we consider that there are three proxies that are being selected by the buyer to obtain data from different ...
1
vote
1answer
131 views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
-1
votes
0answers
85 views
Factorization wanted [closed]
I am trying to factor
6770389183242962153995229561325734953985709474234543383365326043276409942870153199419967538710900938086776046853
which is a factor of 10*80!+1.
ECM did not find a factor, and ...
1
vote
1answer
92 views
How do I decrypt ciphertext with this cipher?
I have an encryption function
$$E(p) = (ap + b) \mod{26}$$
where the parameters are $a=7$, $b = 10$, and $p$ is the plaintext letter.
I was asked to decrypt the ciphertext
...
1
vote
3answers
66 views
OpenSSL AES 256-bit Key Management
I am using C and OpenSSL to encrypt files. After experimenting with the OpenSSL command line utility, it makes you enter a passphrase that can be any length, but uses that to create a 256-bit key.
...
2
votes
1answer
65 views
Why is H(message||secret_key) not vulnerable to length-extension attack?
Given a Merkle-Damgård hash function $H$, I know that an attacker can forge a message protected by a MAC computed as $H(\textrm{secret_key}||\textrm{message})$.
Why can't he perform the same ...
7
votes
2answers
623 views
understanding a length extension attack
I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
2
votes
1answer
42 views
How do zero knowledge protocol with vertex-3-coloring work?
I'm currently not sure if I understood how the zero knowledge protocol with vertex-3-coloring works. I'll describe what I think I've understood and I'll write my questions in bold.
...
0
votes
0answers
27 views
BAN Logic, Problem to Idealize the protocols
I'm studying the BAN logic.
In the application of it, there is a step,where I have to idealize the protocol
that I'm analyzing.
I have problems to make this.
Anyone that has expertise in BAN logic ...
4
votes
7answers
262 views
Algorithm: How to use x and y mouse movement co-ordinates to generate random data?
Background:
I'm making a program for fun as a learning exercise. I want to generate some actual random key material (not pseudorandom) from a JavaScript program. For my program is just for ...
-2
votes
4answers
285 views
Would this simple encrypted chat program be feasible using One Time Pads?
Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...
1
vote
2answers
70 views
Encrypting and MACing different data with same key
It's a well-known best practice to not use one key to both encrypt and MAC data. In my application, there are instances where I MAC a piece of data without having encrypted it first. Do I still need a ...
1
vote
3answers
140 views
How Scrypt uses Salsa?
Bcrypt use Blowfish to crypt a derived key from the passphrase, Blowfish is a cryptographic algorithm, but here it is said that:
Note that
Salsa20/8 Core is not a cryptographic hash function ...
0
votes
1answer
108 views
Scrypt as a KDF with one-time high-entropy input
I'm looking at using Scrypt as a KDF. Assume the following:
the input will always be high-entropy random bytes generated by a CSPRNG
the length of the input can vary from between 8 to 32 bytes
the ...
1
vote
2answers
85 views
KDF with low-entropy salts
I need to derive a key from a username and a password. These are the only two things I have access to. What I thought is using PBKDF2 with username as the salt and password as the master password.
...
3
votes
2answers
164 views
Reason(s) for using a KDF for encryption keys
Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
0
votes
1answer
99 views
brute force attack on KDF vs KEY
if we believe 256bit keys are secure in AES against any brute force attack, is that possible we use a KDF (convert user's weak entered password in truecrypt into a fixed AES key) with too much round ...
2
votes
1answer
52 views
What information to include is the 'info' input for HKDF?
The RFC states the following:
3.2. The 'info' Input to HKDF
While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main ...
1
vote
1answer
99 views
Why is Bcrypt called a Key Derivation Function?
I am trying to understand why is bcrypt called a Key Derivation Function?
I looked up the details of Ekfblowfish on Usenix article here:
...
3
votes
1answer
100 views
Key collision in scrypt and hkdf
I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
2
votes
1answer
213 views
Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?
I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
2
votes
1answer
126 views
Cracking an RSA with no padding and very small e
I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
0
votes
1answer
64 views
Is there a problem with constructing a CSPRNG using MD5 or SHA1?
Is there any security concerns with building a CSPRNG using a broken hash function like MD5 or SHA1? The design is such that a CRC-like function is used for mixing entropy and MD5 is used as the ...
1
vote
2answers
99 views
CSPRNG in JavaScript using Audio and Video
I ported GnuPG to Javascript using Emscripten (not released yet).
Now I need a good replacement for /dev/random//dev/urandom.
...
3
votes
2answers
128 views
How is de-synchronisation of HOTP solved?
From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
1
vote
0answers
81 views
Storing counter value of HOTP at client side [closed]
How can we store counter value on the client side in HOTP??
3
votes
1answer
1k views
What are the advantages of TOTP over HOTP?
HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
1
vote
1answer
126 views
synchronization of counters in HOTP
How is synchronization of counter values achieved in the HOTP protocol?
As I understand it, the server increments its counter value only if a match (of the OTP value) is found. What happens at ...
2
votes
1answer
122 views
Is it considered insecure in an HOTP implementation to publicly provide the next counter?
I am working on a project that needs to securely authenticating one or more smartphone clients with a server running on a microcontroller so it has very limited resources. I have found plenty of ...
5
votes
2answers
195 views
Why does HOTP use such a complex truncate function?
In the HOTP protocol after calculating a 20 byte hash it is truncated to 4 bytes.
For this first an offset is calculated (low-order 4 bits of the last byte) which determines the four bytes to be ...
