18
votes
2answers
691 views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
0
votes
1answer
24 views

Adding an IV to an AES implemntation

I have an embedded project that requires AES, I seem to have found an AES implemtation that fits the bill here: http://www.literatecode.com/aes256 bit it does not include an IV. Are there any ...
3
votes
1answer
43 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
0
votes
0answers
11 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
2
votes
1answer
228 views

How does rolling code works?

I have general questions regarding rolling codes. Basically there is a sender and a reciever. Both have a sequence generator. The reciever checks if the recieved sequence matches the newly generated. ...
0
votes
0answers
20 views

Universal hashing techniques based on matrix multiplication

The article here says below, about a universal hashing technique based on matrix multiplications. "However, there is a little known method based on using a random matrix. It has lots of advantages - ...
4
votes
1answer
214 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
1
vote
2answers
45 views

Different padding rules for Merkle-Damgard and Keccak/sponge function

We learned that length padding was used in Merkle-Damgard where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
1
vote
2answers
138 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
-1
votes
1answer
31 views

Textbook RSA with exponent e=3 [duplicate]

I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that ...
2
votes
1answer
56 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...
2
votes
1answer
109 views

AES CTR rekeys rapidly, does this produce patterns? [on hold]

I have made an AES CTR based DRBG, the details of which are in a codeproject article The DRBG rekeys/counters at a rate of about 1000 times per Mib. Given that the keys and counters are sufficiently ...
1
vote
1answer
82 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
2
votes
2answers
199 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
5
votes
3answers
538 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
1
vote
1answer
82 views

Cryptography: Oblivious Transfer with at most one transfer?

I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function $\text{F}$ with two parameters. $\text{F}(x,y)$ randomly returns $p$ to alice and $q$ to Bob ...
1
vote
1answer
120 views

MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
-2
votes
0answers
51 views

How can I solve this modular equation? [on hold]

I want to know what's the most efficient way to solve following equation: $5 \times x \mod{13} = 2\\ x = ?$ This is just an example. I am looking for a way to solve any equation of this kind.
4
votes
1answer
575 views

Advantages using Diffie-Hellman or Elgamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of Elgamal, and most important why should we use one or the other? I do not see a clear difference ...
4
votes
2answers
116 views

Spoofing protocol nonce

Amy and Betty have a shared key $k$, and the protocol below is to provide a mutual authentication for both Betty and Amy. A sends B : $n_a$ B sends A : $n_b \;\|\; E(k, n_a)$ A sends B : $E(k, n_b)$ ...
1
vote
4answers
461 views

RSA with composite numbers

It has been said that RSA uses a modulus product of two prime numbers for security reasons. But does RSA even work correctly if we allow composite integers instead? I think that the answer is "NO". ...
5
votes
4answers
171 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
2
votes
1answer
51 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
1
vote
1answer
129 views

Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

My understanding are these steps are necessary for symmetric cryptography to be IND-CPA: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of ...
1
vote
1answer
46 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
3
votes
2answers
301 views

How do we operate IV+1?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
2
votes
0answers
90 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
1
vote
1answer
24 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
0
votes
0answers
35 views

Different Diversify key, every time with AES-CMAC [on hold]

I am using the following code and class to generate a diversify key from AES_CMAC. The doFinal method returns different key every time given the input and masterKey are constants. Any suggestion would ...
4
votes
2answers
95 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
-1
votes
1answer
36 views

PGP message integrity : How can receiver of an email check the integrity using the sender's public key?

PGP message integrity: Basically, only private key can decrypt message encrypted with public key. But in the message integrity service in PGP does the reverse, where the Hash of the message if ...
2
votes
1answer
71 views

Use AES-256 Or AES-CTR-256 For One Block?

I am have one block of data to encrypt that is 32-bytes long. Is it better to use the AES-256 primitive for this single block (not a stream) or AES-256-CTR, and also would there be any cons or pros to ...
4
votes
0answers
54 views

understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
5
votes
4answers
651 views

Encryption algorithm that produces dummy output on incorrect passwords

Background: I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically ...
1
vote
1answer
129 views

Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
2
votes
1answer
98 views

How to calculate complexity of ElGamal cryptosystem?

How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ...
9
votes
0answers
96 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
5
votes
1answer
464 views

Is TripleDES 168bit vulnerable to Differential Cryptanalysis?

I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
2
votes
2answers
37 views

AES multiple devices to server communication

I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on ...
2
votes
1answer
80 views

What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
0
votes
0answers
42 views

How much bit encryption is this DES code using? [on hold]

I am a newbie to cryptography, I got this code from a site and understood how it is working. It is using in built Java's cryptography library to encrypt and decrypt files. I just wanted to know how ...
5
votes
1answer
73 views

How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
-4
votes
0answers
67 views

Cryptolocker 2.0 ransomed #1.23 btc [on hold]

I have just received a screen capture of the malware. It turns out it's ransoming \$ not BTC. The ransom demands \$750 to be payed in full within ~ hours. The English is broken and many of the ...
3
votes
1answer
101 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
2
votes
1answer
48 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
3
votes
1answer
123 views

AES VS PRNG+HASH+XOR

I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as: Alice and Bob share a symmetric key Alice manages to send an (authenticated) IV to Bob ...
0
votes
1answer
72 views

How does the Hashlet work? [on hold]

DISCLAIMER: I don't know a lot about cryptography. I was reading about the Hashlet, and I had a couple questions. The Hashlet is described as: SHA256 hardware device with a hardware RNG, and ...
1
vote
1answer
175 views

Which of following new (2013) ECC curves is the most secure or efficient? [on hold]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
0answers
21 views

How to create new PGP key? [on hold]

I'm using GNU GPG. I want to replace my old keypair with a new one, and I have a couple of specific questions as I haven't done this before! My keyring currently contains both the new and old ...
3
votes
1answer
186 views

Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...

15 30 50 per page