5
votes
0answers
57 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
3
votes
0answers
63 views

Majority encryption algorithm?

Assume that I want to leave an encrypted message to a group of $n$ people in a way that they can only decrypt it if they work together in the following sense: For some fixed $k < n$ every ...
1
vote
1answer
54 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
2
votes
1answer
178 views

What is the meaning of IND-CCA secure under standard model? [duplicate]

I notice that in many research papers (viz. "Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption" by Cramer and Shoup) the authors showed that their ...
0
votes
0answers
27 views

Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
1
vote
0answers
32 views

Increase in security with increase in size of salt [duplicate]

Does increasing or doubling the size of salt result in improved security? It will require some extra time to brute force the passwords, but any added advantage?
3
votes
1answer
80 views

Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?
6
votes
2answers
95 views

Confusion about definition of homomorphic encryption

I am trying to better understand homomorphic encryption, but I feel like I keep getting inconsistent information in the papers that I am reading. One of the papers I am reading says the following: ...
0
votes
1answer
72 views

Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $ \in $ $Z^*_{N}$ is a "good" point for 'I', ...
3
votes
1answer
99 views

ElGamal - What if the Decisional Diffie-Hellmann problem could be solved?

I have read that if the DDH problem could be efficiently solved, the IND-CPA would not hold for ElGamal. I don't see why it makes ElGamal less secure if you have $g^a$, $g^b$ and $g^c$
1
vote
1answer
31 views

SHA-1: number of possible inputs, number of possible outputs, how many inputs have the same output,

From Wikipedia I read SHA-1 function produces an output of 160 bits and expects a max message size of $2^{64}-1$ bits. Is that right? If I order all possible inputs I would produce $\approx ...
3
votes
0answers
39 views

Committing to a secret shared value

Suppose I run a multiparty protocol. At the output stage, I have the function output in a secret shared manner among all parties. Now I want all the parties to commit to their value of the secret ...
3
votes
1answer
83 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
0
votes
1answer
19 views

Deriving Minimum Description Length of Substitution Key

Given a plaintext: Now is the time for all good men to come to the aid of their country because the quick brown fox jumped over the lazy dog. and a substitution ciphertext: Mpe od yjr yo,r ...
3
votes
0answers
63 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
1
vote
1answer
51 views

Huffman coding is a prefix code, proof [closed]

How would you prove that Huffman coding $C$ is a prefix code, i.e $$\forall x,y \in C,\ \forall z \in \lbrace 0,1\rbrace^*,\ x\not=y||z$$ Using induction according to the number of items to code? ...
4
votes
1answer
49 views

How does order-preserving encryption work on string?

I have read “How does order-preserving encryption work?”. After that, I completed order-preserving encryption on integer data. Now, I have four questions in this subject: Is it possible to apply ...
-2
votes
3answers
542 views

How to reverse this hash function?

I have a function that takes an $m$ byte inputs $x_i$ and maps it a 32 byte outputs $y_j$. The hash function is defined as: $$y_j = \sum_{i=1}^{m} (x_i)^{i-1} \pmod {127}$$ The input is restricted ...
3
votes
3answers
71 views

Are there any hash functions that use integers of arbitrary bit size (e.g., int63)?

More precisely, I am looking for hash functions where the internal state can be decomposed as a vector of integers of size 63. That is, machine integers where one of the bits is fixed and unusable.
1
vote
0answers
16 views

Sigma protocol: witness hiding

I am working on an assignment and I am stuck with the last part of proving witness hiding for the protocol. I have previously proved it is witness indistinguishable, and it has q (primer number ...
1
vote
2answers
106 views

Understanding Hash function notations

I am implementing a Certificateless Cryptography Algorithm by referencing the paper An Efficient Certificateless Encryption for Secure Data Sharing in Public Clouds. In this paper on page no. 4 during ...
0
votes
1answer
36 views

Calculating characters from the sum of ASCII pairs

I have a series of messages (limited to only a-z and A-Z) that are encoded such that the sum is taken of every two ASCII values and concatenated. For instance, the message ...
5
votes
1answer
217 views

How does Microsoft's BitLocker Recovery Code work?

I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted ...
18
votes
0answers
49 views

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? [duplicate]

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? (regardless of modes like chaining or ctr-cbc)
3
votes
1answer
52 views

Using AES-CTR to generate AES subkeys from a master key and nonce

Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure. Unfortunately, I don't like the 96-bit nonce size, because I want to randomly ...
6
votes
1answer
72 views

Does “double RC4” exhibit the same weaknesses as standard RC4?

I know that RC4 is weak. However, I don't know if two RC4 streams XORed with each other can be attacked in the same way that one can, especially if $n$ bytes are dropped. Assume keys and IVs are ...
0
votes
2answers
102 views

What is the strength and attack vectors of this simple scheme?

Let's say that Alice wants to communicate some secret value $S$ to Bob through a public channel in a way that other people don't know what the value was. To do this, Alice publishes that secret value ...
0
votes
0answers
36 views

How common are non-RSA digital certificates?

Is there a statistic available that shows just how common are DSA or ECC certificates amongst webservers? I know that RSA-based certificates are the most common, however I'd like to know, if there is ...
0
votes
1answer
74 views

Reducing the probability that a password will be guessed

In a file users' password hashes are stored. There are 2 approaches to reduce the probability that the password is guessed. Increase the size of the salt from 12 bits to 24 bits. Increase the length ...
0
votes
0answers
39 views

Non-repudiation in classical cryptosystem

How can we modify classical cryptography system to provide non-repudiation? I want to ensure non-repudiation in symmetric key cryptography so that we can find out who is sender of a particular ...
0
votes
0answers
33 views

Can we use more than one irreducible polynomial in AES?

I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key ...
9
votes
2answers
2k views

Why is the permutation in AES (and other ciphers) not random or key-dependent?

If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for ...
0
votes
0answers
24 views

Are there any holes in my stateless encryption protocol?

I want to create a reasonably secure protocol to allow a bunch of machines within a datacenter to securely communicate to one another. Specifically as a kind of tunnel. I want to avoid building up ...
1
vote
1answer
69 views

A simple client/server authentication protocol

Some days ago I asked for a help to find and correct the problems of an authentication protocol. I closed the post because I was convinced I can correct it but, unfortunately I'm having some troubles. ...
-1
votes
1answer
54 views

Comparison of RSA and DRSA scheme using SageMath

I am trying to compare the encryption and decryption speed of the RSA and the DRSA scheme with same public key $(n, e)$ and private key $d$ (using SageMath). For $1024$ bits long $n$, I got the ...
2
votes
2answers
60 views

What's the appeal of using ChaCha20 instead of AES?

I read about ChaCha20 being used in TLS by Google, SSH, and towards standardization in general. What's the appeal of using something other than AES, what with AES receiving dedicated CPU instructions ...
1
vote
1answer
39 views

security of a block cipher mode of operation

Consider the following block cipher mode of operation: \begin{align} tag_0 &= mac\:key\\ plaintext_0' &= plaintext_0 \oplus iv\\ E(tag_0 | plaintext_0') = C_0 &= tag_1 | ciphertext_0\\ ...
0
votes
1answer
46 views

Secret construction

Given set of random strings $w =\{s_1, s_2, s_3 ... s_n\}$ are there any algorithms to construct single master secret $S$ from them? Subsequently we should be able to deconstruct the $S$ back to ...
3
votes
0answers
27 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
6
votes
2answers
351 views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...
1
vote
1answer
52 views

Calculate if a digital signature is valid

In the book An Introduction to Mathematical Cryptography, it mentions a section on digital signatures and a theoretical example. I am having difficulty understanding the book and I was wondering if ...
0
votes
0answers
40 views

ISIS as a one-way function

The usual formulation of the ISIS problem is the following: Given uniform $A$ and $u$, find a short $e$ such that $Ae = u \bmod q$. A different definition (call it ISIS-OWF) is to let $f_A(e) = Ae ...
5
votes
1answer
56 views

What is the security strength of an n-bit HMAC?

HMACs depend on preimage resistance, or so I have read. The security strength of hash function with an $n$-bit output against collision attacks is $2^{\frac{n}{2}}$. Against preimage attacks, it is ...
1
vote
1answer
27 views

What is the starting point of Hellman's TMTO method?

I understand what is happening and how the endpoint is computed but I'm still a bit unsure of where "SP" (Staring Point) came from. Are the starting points, randomly selected keys from the key-space ...
14
votes
2answers
243 views

Is GCM still recommended?

I stumbled across a forum thread where a security researcher seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard for ...
1
vote
1answer
38 views

Do I need to use null bytes and \x80 in hash length extension attack?

Say I want to perform a hash length extension attack. All the tools I have used use \x00 and \x80 to pad hashes (hlextend and hashpump). But is it necessary to use these bytes? Based on my ...
0
votes
0answers
27 views

Composing hash functions

Suppose there is a cryptographic hash function $H : \{0,1\}^* \to \mathbb G$. Now, we want to define a hash function $H' : \{0,1\}^* \to \mathbb G \times \mathbb G $. My first idea is to define $H'$ ...
3
votes
1answer
74 views

Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
1
vote
1answer
52 views

Disk encryption using AES-CBC: is reliance on previous block data a downside?

I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
0
votes
2answers
79 views

Brute force knowing a part of the password

So here is the problem, my brother forgot about the eight digit numeric part of his password, he is using Ubuntu 15.04 default whole disk encryption To make it clear, this was his password (example) ...

15 30 50 per page