2
votes
1answer
237 views

Illustrate NTRU using lattices

I studied some papers related to NTRU. All these papers describe NTRU as a lattice based cryptosystem but I could not find any paper which illustrates NTRU algorithm from lattice point of view. It ...
0
votes
0answers
86 views

Looking for crypto with derived keys?

I am looking for cryptographic algorithm or combination of them. Basically I need an algorithm, which can generate private key and for this key can be computed multiple keys based on some seed. So a ...
1
vote
0answers
72 views

Want to use ECC but am clueless [closed]

First off, I'm not an experienced cryptography or computer person, please bear with me. I have some basic experiences with PGP software though (not much of a redemption huh?). I have some data that ...
2
votes
1answer
338 views

What's the advantage of using OFB/CFB/CTR modes over a stream cipher

As far as I understand: The primary disadvantage associated with stream ciphers is the need for a random and unique key for each run in order to protect against reused-key attacks. OFB/CFB/CTR block ...
2
votes
2answers
155 views

how much trust can we place in protocol verifiers? [closed]

I read many papers on authenticated key exchange protocols, and most security proofs are done by the authors. In this method, you can imagine that the efficiency is low. Moreover, even if you have ...
3
votes
1answer
118 views

Need to generate new DH keys for every message in OTR

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it ...
-2
votes
1answer
520 views

Uniform distribution/randomness of characters in the sha256 hash?

I'm using the sha256 algorithm to generate a number in one of my programming projects. A sha256 hash is calculated from three strings: one the user can edit, one the user can view but not edit and one ...
4
votes
1answer
175 views

How to handle the GCD(V,P) != 1 case when doing point addition or point doubling in elliptic curve cryptography

The equation for a finite field Elliptic Curve is of this form: $$y^2 \equiv x^3 + a * x + b \pmod{P}$$ When we do common EC operations like point doubling or point addition we need to calculate the ...
3
votes
1answer
545 views

Analyzing ECB's and CBC's resistence to a known-plaintext attack

I'm trying to analyze the strength of a block cipher with CBC mode or with ECB mode on the scenario of an exhaustive search attack with knowledge of pairs of plaintext – ciphertext (known plaintext ...
3
votes
1answer
213 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
3
votes
0answers
53 views

Common pitfalls of session key activation?

Assume that initiator $I$ and responder $R$ of a key agreement protocol have agreed on new symmetric session keys $K'_{auth}$ and $K'_{enc}$, e.g. by way of Diffie-Hellman and key derivation, possibly ...
1
vote
0answers
231 views

Most frequently used digital signature schemes in the recent years

I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today. I'm only really interested in what is employed recently (ie. last couple ...
-4
votes
3answers
525 views

IV's from Crypto++ AutoSeededRNG always ends the same: Problem with the PRNG? [closed]

I am using a AutoSeededRNG from Crypto++ to generate IVs for use in CBC encryption. I am encoding the IVs using Base64 for future use (decryption). I notice that ...
-4
votes
2answers
217 views

Any techniques for evading frequency based crypt analysis without encrypting?

Are there any general techniques for evading frequency based crypt analysis without using any encryption techniques?
4
votes
0answers
308 views

Is there a “brainwallet” for GPG keys? [closed]

“Brainwallet” is a program that takes a passphrase (hopefully a good one) and deterministically creates a Bitcoin wallet. This wallet can be used for transactions, then deleted from the computer. To ...
3
votes
3answers
269 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
2
votes
1answer
702 views

Some questions about encrypting (AES) a file with password

I'm relatively new to encrypting, and I have some questions. I intend to write a standalone C# program that will write and read an encrypted file with sensitive data using a password entered by the ...
10
votes
4answers
1k views

Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key?

I have just learned about using PGP/GPG for email encryption and one thing has always bugged me: How is it possible that a message encrypted with somebody's public key can be decrypted only with that ...
6
votes
2answers
526 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
7
votes
3answers
3k views

Is sharing the modulus for multiple RSA key pairs secure?

In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$. Suppose that Bob's private exponent is learned by other users. ...
1
vote
0answers
59 views

For enciphering messages with AES in CTR mode, do I need a different key for each message?

I have written a program to run AES in CTR mode with keys of 128,192 or 256 bits and checked it gives correct results with the data given in section F.5 at ...
1
vote
0answers
96 views

(n,n) Shamir secret sharing [duplicate]

In (n,n) Shamir secret sharing if n shareholders do not have the public values (X values) can they still obtain the secret with only Y values?
0
votes
1answer
226 views

Error propogation in CBC mode

Going through the wiki for modes of operation I see that the section error propogation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
7
votes
2answers
1k views

Generating Encryption Keys from Biometric Fingerprint Templates

How would one go about generating Encryption Keys from Biometric Fingerprint Templates extracted from a fingerprint using either Griaule SDK or DigitalPersona SDK or any other SDK that will return the ...
1
vote
1answer
70 views

Problem with anonymously merging information from distributed sources

Some Background: There is an entity with an identifier and some information. The identifier of this entity is a string with a known scheme/pattern(Which means the total number of such possible ...
2
votes
1answer
90 views

Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite ...
1
vote
1answer
83 views

Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some ...
4
votes
2answers
313 views

Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?
1
vote
1answer
86 views

order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?
2
votes
1answer
94 views

Why would splitting a password output be better than separate HMACs for encryption/authentication key derivation?

In a recent question I asked here on crypto.se, an answer was given that surprised me a bit. As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from ...
2
votes
2answers
213 views

How can I perform matching on an “encrypted- fingerprint feature matrix” using Fully Homomorphic Encryption?

I am doing a finger-print authentication process. The feature-extraction using minutiae has been done and I get an N x 6 matrix, where the 6 columns are {$x_i$ ...
1
vote
1answer
114 views

How does this SSL-related flaw work?

I just saw a video at CNN in which it is claimed that, if the server isn't generating a random public key, the server can be hacked. First how HTTPS works… to be sure I’m on the same page: Server ...
2
votes
1answer
403 views

ECC Complexity order of point addition, scalar point multiplication and selecting random point

I am facing this problem in calculating the order of a process which involves ECC point addition: $P+Q$ , scalar multiplication: $aP$, and selecting random points in the group. The group is of prime ...
-1
votes
2answers
121 views

Journals to read in order to keep up to date with interesting research [closed]

I'd love suggestions from crypto.stack as to academic journals to read. They can range from introductory to advanced, as long as it's free (requires no access fees). Feel free to edit this question ...
2
votes
1answer
97 views

Efficiency of chaining AES “groups” of blocks

From ISO/IEC 23001-7:2012/Amd 1:2012 10.2.2 Creation of Initialization Vector (Informative) Decryption efficiency may be improved if subsequent initialization vectors use the value of the last ...
1
vote
1answer
1k views

The use of cribs [closed]

I'm looking to incorporate more crib usage in breaking ciphers in unknown enciphering schemes, or at least to gleam what information I may. This seems to be a big hurdle to me, and I'm looking for ...
4
votes
1answer
124 views

Cryptographic pseudo-random generation of address subsets

Suppose I have devices which broadcast, on an insecure channel, 32-bit addresses. I want to make these devices untraceable - one way to do so is to allocate for each device a distinct subset of ...
1
vote
2answers
201 views

What are the major flaws and limitations of this hash-based stream cipher design?

K is a 224-bit key. C is a 32-bit counter; it is publicly known. the same value is never used twice. ...
2
votes
1answer
122 views

How does CBC work with read-write volumes?

I have read an article about an attack on LUKS in CBC mode and had a look at the WP article about CBC and now I am confused. If I have understood that correctly then changing the plaintext of a block ...
-1
votes
1answer
483 views

Reverse engineering a single checksum byte [closed]

I am working to understand a system which saves a few bytes of data together with what appears to be a single checksum byte that provides a very naive guarantee that the data has not been tampered ...
3
votes
1answer
507 views

Calculating amount of time for brute forcing ciphertext depending on the size of the key

I am a graphic design student and for my information graphic project I have chosen the topic of the history of encryption and how the security level developed over the centuries. It’s basically an ...
2
votes
1answer
1k views

Complement property of DES

I'm supposed to show the complement property of DES ($c=DES(p,k) => \bar c = DES(\bar p, \bar k)$). My idea was to just start the algorithm with $\bar p$ and see what happens (ignoring the initial ...
2
votes
1answer
474 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
1
vote
2answers
156 views

Understanding math behind RSA key derivation [duplicate]

I was reading through the key derivation for RSA. Here are the steps per wiki - Select strong primes $p$ and $q$ such that $pq = n$ $\phi(n)$ = $(p-1)(q-1)$ select $e$ such that $e$ and $\phi(n)$ ...
1
vote
1answer
109 views

Prefix property for variable length pseudo-random generators

I'm currently working through Katz & Lindell's Introduction to Modern Cryptography. In section 3.4.2, they introduce the definition of a variable output-length pseudorandom generator $G$. The ...
3
votes
4answers
776 views

Which tamper-protection algorithm provides the shortest output?

Background When making web applications you sometimes need to pass data along with the form which isn't visible to the user. Database IDs are the most common, but texts and IDs are sometimes ...
2
votes
1answer
220 views

How do P2P clients like uTorrent maintain authenticity of files?

I am very new to concepts of cryptography so bear with me and feel free to fill in any information that may seem obvious but something you think someone may not know. At first I was under impression ...
0
votes
0answers
77 views

Can you determine an unknown value when it is combined with a known value and you are given the resulting hash? [duplicate]

Say I have a string that I want to keep hidden. You can then enter a known string which is added to the end of the hidden string and you are given the sha256 hash of the combined string. If you were ...
0
votes
1answer
285 views

Is C25519/Ed25519 “twist secure”?

This recent new curve mentions something that's new to me: twist security. http://safecurves.cr.yp.to/bada55.html Are the existing C25519/Ed25519 curves secure against this form of attack?
1
vote
1answer
131 views

Common password derivation function for different encryption methods

I'm writing a simple encryption/decryption library which has the following requirements: For key derivation functions, support: $SHA256 \rightarrow bcrypt$ (since $bcrypt$ limits input passphrase ...

15 30 50 per page