7
votes
1answer
536 views

Why does a broken hash function undermine an HMAC?

For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
11
votes
3answers
2k views

“Weaknesses” in SHA-256d?

According to this answer, "SHA-256d" was proposed in one of the Ferguson/Schneier books like so: SHA-256d(x) = SHA-256(SHA-256(x)) Apparently, the motivation for ...
2
votes
1answer
271 views

Understanding one-way hash functions construction

I understand the needs that lead to the development of cryptography and I am quite familiar with the uses we make of the cryptographic tools. But, as a programmer, I am conditioned to see them as ...
-5
votes
1answer
264 views

Multi layer encryption with ECB mode [closed]

if i use the 2 of the same key with 2 of the same algoritm when encrypting in ECB like when i have 2 blocks of the same color and i encrypt the 2 blocks with the same color the cipher text should not ...
4
votes
1answer
6k views

Does the IV need to be known by AES (CBC mode)?

I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
2
votes
1answer
212 views

Zero-knowledge proof that a group element is a quadratic residue?

In a paper it says: "To convince a verifier that a group element is a quadratic residue, the prover executes the following proof with the verifier": $PK \left\{ (\alpha) : y = \pm g^\alpha \right\}$ ...
1
vote
0answers
421 views

How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code: ...
0
votes
1answer
76 views

PBKDF2 when dkLen and hLen have the same size

I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
2
votes
1answer
773 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
1
vote
2answers
155 views

Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?

If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
380 views

Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
3
votes
2answers
346 views

Case insensitive verification of HMAC / Base64 signature

I am signing a short message using the base64 of an HMAC, like this (python): ...
3
votes
2answers
295 views

DSA signatures with related k and unknown payloads

Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
6
votes
0answers
182 views

Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
1
vote
0answers
147 views

How fast can a wrong decryption key be detected using ECC?

When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that? ...
2
votes
1answer
107 views

Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?

I need your help with a very basic concept in cryptography which I can't understand/prove on my own. I'm trying to prove and understand why, under "indistinguishability in the presence of an ...
2
votes
1answer
421 views

How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
2
votes
1answer
504 views

Attack on DSA with signatures made with k, k+1, k+2

For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
1
vote
1answer
111 views

What's the difference between “HashX-512” and “HashX-1024”?

I need to make a Skein hash's, specifically, Skein-1024; however, I only have access currently to Skein-512. Is there any way to utilize a Skein-512 function to get the result of a Skein-1024 hash? ...
13
votes
3answers
2k views

How practical are side-channel attacks and how much of a concern are they?

I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
7
votes
2answers
3k views

What are advantages of using a HMAC over RSA with SHA-1 hashes?

I am currently studying for an exam and this was a previous question: Give one advantage of using HMACs over using RSA to sign SHA-1 hashes. My thoughts are that it has something to do with the ...
3
votes
2answers
713 views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
4
votes
3answers
657 views

Is there a practical security difference between XXX-bit encryption?

I know I'm treading in dangerous waters asking this - my comprehension of cryptography math is sorely lacking. On the flip side it gives me massive admiration for what many of you are able to do. ...
0
votes
2answers
91 views

Voice Call Safety [closed]

When i was dealing with an assistant of my bank through mobile call, she asked me to insert my bank login code after a beep. I was wondering if this procedure is secure against a Man In the Middle ...
1
vote
1answer
784 views

What's the difference between Trapdoor Functions and Encryption Functions?

From Wikipedia: A trapdoor function is a function that is easy to compute in one direction, yet believed to be difficult to compute in the opposite direction (finding its inverse) without ...
2
votes
0answers
71 views

Predicate Encryption supporting disjunctions

I am not sure if I missed some subtlety in the definition of Attribute Hiding found in this paper on Predicate Encryption, but isn't it possible to construct a scheme for Predicate Encryption ...
5
votes
1answer
137 views

Using encryption schemes for identification

I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
4
votes
1answer
454 views

Client and server using same SSL certificate - any issues?

I'm working on software where multiple components will communicate with each other using SSL. There would be one central component acting as a server, which would also require the clients to present ...
4
votes
2answers
402 views

How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring? The private key is an ...
4
votes
1answer
741 views

Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia. Edit: ok, can it be at least ...
4
votes
1answer
166 views

Which MAC scheme is quantum resistant?

will HMAC survive Grover algorithm ? if not then which MAC scheme provide post-quantum security ?
7
votes
1answer
2k views

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
2
votes
2answers
268 views

It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?

I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
3
votes
2answers
697 views

one-time pad key related attack [duplicate]

In one-time pads we always say do not use same key twice to encrypt ASCII messages, but if we use a random key to XOR a random ...
6
votes
1answer
401 views

Is SpookyHash vulnerable to HashDoS?

Aumasson, Bernstein and Bosslet did an excellent job demonstrating fatal weaknesses in MurmurHash and CityHash, but what about SpookyHash? My first uneducated guess is that it would be much harder to ...
8
votes
1answer
319 views

Alice trusts Bob only when Bob trusts Alice

some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
4
votes
1answer
198 views

How to design a practical and secure MAC scheme?

I am sorry, but I need to introduce some concepts which are not directly related to cryptography to make myself clear, I hope I won't stun you with this ... (I'd rather explain it here than redirect ...
3
votes
1answer
117 views

Potential vulnerability in DH key selection - am I understanding this right?

I'm reading through a DH implementation, and I think I found a potential hole. Public $p$ and $g$ values are properly selected. A candidate secret value $\bar a$ is pseudo-randomly selected such ...
2
votes
1answer
531 views

Is it feasible to break Diffie-Hellman key exchange when the implementation uses a poor-quality PRNG?

I've come across an implementation of DH in Java that uses the Random class to generate the secret integer value $a$, as shown in in Wikipedia's description of the ...
8
votes
1answer
179 views

Solving hard problems in $\mathbb Z_{p}^{*}$ when $\mathbb p$ is close to $\mathbb 2^{n}$

Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes ...
0
votes
1answer
541 views

SSTP MSCHAP-V2 Authentication before SSL or after SSL Session

So with the recent news that there's a lovely new tool to crack MSChapV2 packets. So the question I have is on a SSTP Connection is the MSChapv2 handshake encrypted pre SSL setup or post. Obviously ...
-7
votes
1answer
90 views

AES ENCRYPTION ALGORITHM [closed]

What is the amount of decrease in the probability of decrypting a data encrypted using an AES algorithm? (That is by introducing each round out of ten whole rounds, how the probability of decryption ...
1
vote
1answer
153 views

which asymmetric cipher provide highest performance?

to get highest performance Which asymmetric cipher provide fastest encryption/decryption ? ECC or DH ? what key size is recommended today ?
3
votes
1answer
195 views

How to use HMAC for large ciphertexts over TLS

HMAC used to secure chosen cipher-text attacks. if we are encrypting a large file (video) and sending it over TLS for decryption, how server can check MAC for ciphertext when we didn't sent whole of ...
3
votes
2answers
575 views

RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
13
votes
2answers
427 views

Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?

I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime. Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
2
votes
2answers
720 views

Security of Deterministic Encryption Scheme

A deterministic encryption scheme is a cryptosystem which always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm. Although we ...
4
votes
3answers
2k views

Export from US of crypto software with key-size > 56 bits still needs permission?

Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several ...
2
votes
2answers
1k views

Even passwords are vulnerable to hash collision attacks?

As stated in this page large documents hashed using md5 maybe vulnerable to collision attacks. My question is even passwords of 6-30 character are vulnerable to such hash collision attacks? If yes, is ...
1
vote
1answer
190 views

Sensible usecase for restricting special characters in passwords? [closed]

Please See Why Not Allow Special Characters In a Password on Security. Several websites I've come across limit the allowed special characters for a password. My thought was, it should all be ...

15 30 50 per page