All Questions

691 views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
24 views

Adding an IV to an AES implemntation

I have an embedded project that requires AES, I seem to have found an AES implemtation that fits the bill here: http://www.literatecode.com/aes256 bit it does not include an IV. Are there any ...
43 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
11 views

228 views

How does rolling code works?

I have general questions regarding rolling codes. Basically there is a sender and a reciever. Both have a sequence generator. The reciever checks if the recieved sequence matches the newly generated. ...
20 views

Universal hashing techniques based on matrix multiplication

The article here says below, about a universal hashing technique based on matrix multiplications. "However, there is a little known method based on using a random matrix. It has lots of advantages - ...
214 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
45 views

Different padding rules for Merkle-Damgard and Keccak/sponge function

We learned that length padding was used in Merkle-Damgard where after padding with zeros another block is added that contains the initial length of the input. This is supposed to prevent same hash ...
138 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
31 views

Textbook RSA with exponent e=3 [duplicate]

I remember $e=3$ is a bad choice for textbook RSA. But I can't really recall why. What happens if I choose $e=3$? Can I retrieve the message by simply calculating $\sqrt[3]{c}$? Why can't I do that ...
56 views

Secure way to store fixed size string of digits

I need to store a string of digits (0-9) of a fixed size in my database securely. I've already performed a rainbow table attack on a plain hash, and it broke it in a matter of seconds. One option I ...
109 views

AES CTR rekeys rapidly, does this produce patterns? [on hold]

I have made an AES CTR based DRBG, the details of which are in a codeproject article The DRBG rekeys/counters at a rate of about 1000 times per Mib. Given that the keys and counters are sufficiently ...
82 views

Which algorithm do you recommend for practical use to generate unique passwords for each website?

So, in my imagination there is this simple algorithm with only one master password, let's say a prime number 'p', which I have to remember. Using only the address of the website and p, the algorithm ...
199 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
538 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
82 views

Cryptography: Oblivious Transfer with at most one transfer?

I am trying find a transfer method for this problem. Suppose Alice and Bob both has access to a function $\text{F}$ with two parameters. $\text{F}(x,y)$ randomly returns $p$ to alice and $q$ to Bob ...
120 views

MAC using a modified CBC mode of operation

I'd like to know whether the following modified CBC-MAC is secure (given a fixed IV). Source: an old course on Network Security Are there some obvious attacks I can't see?
51 views

How can I solve this modular equation? [on hold]

I want to know what's the most efficient way to solve following equation: $5 \times x \mod{13} = 2\\ x = ?$ This is just an example. I am looking for a way to solve any equation of this kind.
575 views

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of Elgamal, and most important why should we use one or the other? I do not see a clear difference ...
116 views

Spoofing protocol nonce

Amy and Betty have a shared key $k$, and the protocol below is to provide a mutual authentication for both Betty and Amy. A sends B : $n_a$ B sends A : $n_b \;\|\; E(k, n_a)$ A sends B : $E(k, n_b)$ ...
461 views

RSA with composite numbers

It has been said that RSA uses a modulus product of two prime numbers for security reasons. But does RSA even work correctly if we allow composite integers instead? I think that the answer is "NO". ...
171 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
51 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
129 views

Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

My understanding are these steps are necessary for symmetric cryptography to be IND-CPA: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of ...
46 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
301 views

How do we operate IV+1?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
90 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
24 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
35 views

Different Diversify key, every time with AES-CMAC [on hold]

I am using the following code and class to generate a diversify key from AES_CMAC. The doFinal method returns different key every time given the input and masterKey are constants. Any suggestion would ...
95 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
36 views

PGP message integrity : How can receiver of an email check the integrity using the sender's public key?

PGP message integrity: Basically, only private key can decrypt message encrypted with public key. But in the message integrity service in PGP does the reverse, where the Hash of the message if ...
71 views

Use AES-256 Or AES-CTR-256 For One Block?

I am have one block of data to encrypt that is 32-bytes long. Is it better to use the AES-256 primitive for this single block (not a stream) or AES-256-CTR, and also would there be any cons or pros to ...
54 views

understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
651 views

Encryption algorithm that produces dummy output on incorrect passwords

Background: I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically ...
129 views

Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
98 views

How to calculate complexity of ElGamal cryptosystem?

How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ...
96 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
464 views

Is TripleDES 168bit vulnerable to Differential Cryptanalysis?

I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
37 views

AES multiple devices to server communication

I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on ...
80 views

What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
42 views

How much bit encryption is this DES code using? [on hold]

I am a newbie to cryptography, I got this code from a site and understood how it is working. It is using in built Java's cryptography library to encrypt and decrypt files. I just wanted to know how ...
73 views

How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
67 views

Cryptolocker 2.0 ransomed #1.23 btc [on hold]

I have just received a screen capture of the malware. It turns out it's ransoming \$not BTC. The ransom demands \$750 to be payed in full within ~ hours. The English is broken and many of the ...
101 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
48 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
123 views

AES VS PRNG+HASH+XOR

I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as: Alice and Bob share a symmetric key Alice manages to send an (authenticated) IV to Bob ...
72 views

How does the Hashlet work? [on hold]

DISCLAIMER: I don't know a lot about cryptography. I was reading about the Hashlet, and I had a couple questions. The Hashlet is described as: SHA256 hardware device with a hardware RNG, and ...
175 views

Which of following new (2013) ECC curves is the most secure or efficient? [on hold]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...