All Questions
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
27
votes
5answers
2k views
Guarding against cryptanalytic breakthroughs: combining multiple hash functions
Assume I want to design a protocol (or data format or similar) including some cryptographic hash, and want it to be as future-proof as possible, i.e. I want to avoid that breakthroughs in cryptography ...
26
votes
2answers
1k views
What makes a hash function good for password hashing?
Using a cryptographic hash to store e.g. passwords in a database is considered good practice (as opposed to storing them plaintext), but is subject to attacks on said cryptographic hash, assuming the ...
8
votes
2answers
6k views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
45
votes
14answers
3k views
Time Capsule cryptography?
Does there exist any cryptographic algorithm which encrypts data in such a way that it can only be decrypted after a certain period of time?
The only idea that I can think of, is something like this: ...
16
votes
5answers
7k views
Taking advantage of one-time pad key reuse?
Suppose Alice wants to send encryptions (under a one-time pad) of $m_1$ and $m_2$ to Bob over a public channel. Alice and Bob have a shared key $k$; however, both messages are the same length as the ...
7
votes
3answers
2k views
Can one generalize the Diffie-Hellman key exchange to three or more parties?
Does anyone know how to do a Diffie-Hellman or ECDH key exchange with more than two parties?
I know how to do a key exchange between 2 parties, but I need to be able to have a key agreement between 3 ...
16
votes
6answers
896 views
Is there a secure cryptosystem that can be performed mentally?
I, myself, do not plan on getting into a situation where I would be unable to use a computer in order to communicate securely. However, I can think of many practical situations in which mental ...
20
votes
1answer
1k views
What is the “Random Oracle Model” and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
11
votes
2answers
541 views
Is SHA-512 bijective when hashing a single 512-bit block?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for SHA-2?
6
votes
2answers
1k views
Definition of Textbook RSA
What is the definition of Textbook RSA?
What are some of the properties of textbook RSA?
How does it differ from other RSAs?
16
votes
4answers
648 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
3
votes
3answers
4k views
RSA encryption with private key and decryption with a public key
Does the encryption with a private key and decryption with a public key works in RSA? Is it done when we use RSA for sender authentication ?
Thanks.
4
votes
5answers
318 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
20
votes
3answers
3k views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large message.
How can I do this?
10
votes
2answers
839 views
Why is H(k||x) not a secure MAC construction?
If H(m) is a secure hash function, can't we implement a MAC using H(k||m)?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
5
votes
2answers
306 views
creating a small number from a cryptographically secure random string
i'm trying to figure out the best way to generate a cryptographically secure random number between 0 and 200 from a cryptographically random string of bytes (ie. read from /dev/urandom or some such)
...
4
votes
3answers
542 views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
10
votes
3answers
540 views
How practical are side-channel attacks and how much of a concern are they?
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
10
votes
3answers
708 views
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?
Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
2
votes
2answers
152 views
Algorithm Design for only Mutual Information Sharing
Bob and Alice each have a bit string they want to keep private. They each want to know what the bitwise AND of their two strings would be without telling the other or anyone else listening to their ...
5
votes
2answers
797 views
What is the most secure hand cipher?
By "hand cipher", I mean a symmetric cipher for which encryption and decryption can can both be performed with a pencil on graph paper, consuming about 10-20 seconds per character by a proficient ...
2
votes
3answers
327 views
Verify product without revealing multipliers
Situation:
Several participants contribute encrypted random numbers. These numbers will be used to generate community-agreed random (by simple multiplication).
Question:
Is there any way to detect ...
20
votes
5answers
6k views
Is Convergent Encryption really secure?
Recently a company called Bitcasa demonstrated a product of cloud storage. they indicated that they would use "Convergent Encryption" to secure your data and de-duplicate, essentially one copy of the ...
16
votes
3answers
1k views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
10
votes
2answers
343 views
Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?
Does the answer change if ...
5
votes
3answers
919 views
In the SHA hash algorithm, why is the message always padded?
In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s.
Why is it ...
13
votes
2answers
532 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
5
votes
2answers
203 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
4
votes
1answer
315 views
From hash to Cryptographic hash
After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
11
votes
1answer
2k views
Why can't one implement bcrypt in Cuda?
I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there.
bcrypt is ...
7
votes
3answers
509 views
Using a Non-Random IV with modes other than CBC
The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
7
votes
7answers
3k views
Is Diffie-Hellman mathematically the same as RSA?
Is the Diffie-Hellman key exchange the same as RSA?
Diffie Hellman allows key exchange on a observed wire – but so can RSA.
Alice and Bob want to exchange a key – Big brother is watching everything.
...
6
votes
3answers
1k views
Why RSA encryption key is based on modulo(phi(n)) rather than modulo n
While calculating RSA encryption key we take modulo(phi(n)) rather that modulo(n). I couldn't understand why its so?
5
votes
1answer
819 views
Chinese Remainder Theorem and RSA
Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
6
votes
3answers
434 views
Would the ability to efficiently find Discrete Logs have any impact on the security of RSA?
This answer makes the claim that the Discrete Log problem and RSA are independent from a security perspective.
RSA labs makes a similar statement:
The discrete logarithm problem bears the same ...
3
votes
2answers
432 views
How to construct encrypted functions (with either public or private data)?
Homomorphic encryption is often touted for its ability to
Compute on encrypted data with public functions
Compute an encrypted function on public (or private) data
I feel I have a good grasp of #1 ...
2
votes
1answer
109 views
Why does key generation take an input $1^k$, and how do I represent it in practice?
In my lecture, the lecturer said:
Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
2
votes
0answers
190 views
How do I encrypt with the private key? [duplicate]
Possible Duplicate:
RSA encryption with private key and decryption with a public key
This wording is creeping everywhere (e.g. there): "I encrypt with the private key" and even sometimes, ...
1
vote
2answers
361 views
Why can't the IV be predictable when its said it doesn't need to be a secret?
I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
45
votes
7answers
15k views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
21
votes
4answers
6k views
How can I generate large prime numbers for RSA?
What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption?
I'm aware that I can find any number of articles on the Internet that explain how ...
25
votes
5answers
3k views
How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this it technically true. However, I think that there is probably a ...
19
votes
4answers
5k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
15
votes
3answers
672 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
13
votes
1answer
386 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
20
votes
1answer
1k views
Does the generator size matter in Diffie-Hellman?
For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
9
votes
3answers
2k views
What is the relation between RSA & Fermat's little theorem?
I came across this while refreshing my cryptography brain cells.
From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
15
votes
4answers
5k views
Google is using RC4, but isn't RC4 considered unsafe?
Why is Google using RC4 for their HTTPS/SSL?
$ openssl s_client -connect www.google.com:443 | grep "Cipher is"
New, TLSv1/SSLv3, Cipher is RC4-SHA
Isn't RC4 ...
