3
votes
1answer
318 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
2
votes
1answer
838 views

Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
1
vote
2answers
667 views

Can md5 be used for encrypting data?

I know that md5 shouldn't be used for password hashing because of collisions and possibility of making dictionary attacks e.g. using rainbow tables. But what about ...
6
votes
1answer
3k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
4
votes
1answer
446 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
6
votes
2answers
994 views

How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
7
votes
8answers
479 views

Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?

I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
3
votes
2answers
189 views

Helper data authentication in PUFs

As I understand, PUFs work by using two procedures: generation and reproduction. Generation reads a value $w$ from a fuzzy source and generates a key $R$ and helper data $P$. Then, in the reproduction ...
2
votes
2answers
146 views

How can I repeatedly prove I have data another has seen without sending the data and without the other storing the data?

I would like to know if this is theoretically possible, or impossible, and if possible, if there is any algorithm/protocol to accomplish this... I want another entity, lets call them the Auditor, to ...
4
votes
4answers
819 views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
3
votes
3answers
493 views

How can I avoid calculating with huge numbers when implementing the RSA algorithm

There is 26-letter English alphabet. There is the plain text: TRYAGAINLATER. I need to encrypt it by RSA algorithm with the public key 53. What is the ciphertext? ...
7
votes
1answer
2k views
3
votes
1answer
1k views

ANSI X9.9 Cryptography Standards

I'm trying to create a ISO8583 Rev93 message. What is the standard way of generating MAC key in ANSI X9.9 DES-CBC encryption algorithm is used to encrypt the ...
2
votes
1answer
6k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
4
votes
2answers
769 views

How to construct encrypted functions (with either public or private data)?

Homomorphic encryption is often touted for its ability to Compute on encrypted data with public functions Compute an encrypted function on public (or private) data I feel I have a good grasp of #1 ...
5
votes
1answer
866 views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
4
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
4
votes
1answer
979 views

Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
3
votes
1answer
248 views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that ? Is there a ...
10
votes
2answers
9k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...
7
votes
2answers
394 views

Pairing-friendly curves in small characteristic fields

There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others. In extension fields GF(p^n), ...
3
votes
2answers
356 views

Key space size when either of two public keys are valid for authentication?

If for authentication a user can own either A OR B public key instead of just one specific key is that equivalent to halving the key space. i.e. it it theoretically twice as easy to brute force and ...
8
votes
3answers
2k views

Is it possible to validate a Public Key in RSA?

If I have a 1024-bit number, and someone is telling me that it is in fact a valid RSA public key, is there any way I can quickly validate that it is indeed so (without cracking RSA)? (I suppose I am ...
8
votes
1answer
480 views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
1
vote
0answers
78 views

Two untrusted party want to exchange data: how to ensure each one gets the data it needs? [duplicate]

Possible Duplicate: Two untrusted party want to exchange data: how to insure each one gets the data it needs? I am trying to come up with what could maybe be a novel algorithm for an ...
6
votes
2answers
206 views

Does the position of the salt improve its effectiveness when hashing?

Seems most documentation I have read suggests the salt should prefix the value to be hashed. Is this just for consistency, or is the salt more effective when prefixed?
2
votes
2answers
480 views

DES Crack simulation

I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For ...
6
votes
2answers
425 views

Is it possible to create an easy to use encryption/decryption method that will never be comprimised?

In the comments of the question "Why programming languages don't provide simple encryption methods?" the following statement was made: A well thought out, tested and understood standard that has ...
5
votes
2answers
585 views

Is ISAAC considered secure as a cryptographic random number generator?

The ISAAC site claims it is secure, but I wasn't aware of any trusted 3rd party sources that verified its security.
8
votes
1answer
1k views

Related-key attacks on AES

According to Wikipedia: Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively. What are the requirements for these attacks (i.e how many ...
2
votes
2answers
237 views

AESManaged Trade Compliance Issue in United States

I am currently using AESManaged encryption for my silverlight application. Does AESManaged encryption have a severe trade compliance issue in Bureau of Industry and Security in terms of shipping the ...
28
votes
3answers
8k views

How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large message. How can I do this?
8
votes
3answers
1k views

ElGamal: Multiplicative cyclic group and key generation

Here on the ElGamal wikipedia page http://en.wikipedia.org/wiki/ElGamal_encryption Alice generates an efficient description of a multiplicative cyclic group G, of order q, with generator g. How ...
6
votes
1answer
1k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
5
votes
5answers
277 views

In storing passwords in a database should I use a per-application salt in addition to a per-secret salt?

Assuming that the salts are sufficiently long (16 random chars) is there any advantage in using a per-application salt in addition to a per-secret salt when storing hashed passwords in a database? ...
10
votes
1answer
864 views

How can I make my cipher show the avalanche effect?

I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix ...
5
votes
1answer
149 views

Including a “purpose” designation in a digital signature

A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a ...
6
votes
1answer
254 views

How does one design a traffic analysis resistant protocol?

I'm curios about protocols which leak considerable personal information, like instant messaging exposing the contacts relation. How does one make an instant messaging protocol which is resistant to ...
2
votes
1answer
157 views

Does an attacker gain an advantage if they have the initialisation vector?

Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
4
votes
2answers
276 views

Does this block cipher mode allow for decryption?

Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown? $$ P_0 = IV $$ $$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$
5
votes
1answer
461 views

How close is homomorphic encryption to handling regular expressions?

Is there any reasonable homomorphic encryption protocol that supports some meaningful fragment of regular languages/expressions and/or edit distance bounds? I'm suspicious that homomorphic encryption ...
1
vote
1answer
134 views

How is the password sent across for verification?

I am familiar with Challenge-Response Authentication scheme. However I would like to know actual message content sent between client and server for 1 way authentication, over an insecure channel. ...
8
votes
4answers
495 views

Can I determine if a user has the wrong symmetric encryption key?

We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
1
vote
1answer
293 views

Verifying the integrity of ciphertext using the cleartext hash?

I want to be able to verify the integrity of a ciphertext by providing the cleartext hash, for this to work it would need to: $$hash(crypt(cleartext)) = f(hash(cleartext))$$ Where $f$ is an ...
5
votes
1answer
841 views

How does GPG verify succesful decryption?

How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)? Is something appended to the clear text so there exist ...
2
votes
2answers
268 views

Is EKE attackable by a brute-force password search?

So I'm trying to properly implement the EKE protocol and I'm using C# with the Windows CNG and ECDH key exchange. I need to use this because it's FIPS certified and all that jazz. So what I'm ...
4
votes
3answers
294 views

What other one-way functions are used in cryptosystems?

For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties ...
1
vote
1answer
490 views

Creating a hash of XOR'd blocks

Suppose a message $m$ is divided into blocks of length $160$ bits: $m > = M_1 || M_2 || ... || M_l$ And define $h(m) = M_1 \oplus M_2 \oplus ... \oplus M_l$ Which of the three desirable ...
3
votes
1answer
272 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
11
votes
1answer
6k views

How to choose a padding mode with AES

Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None. I ...

15 30 50 per page