6
votes
2answers
6k views

What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
0
votes
2answers
184 views

Is solving a modular linear equation a hard problem when the coefficient is not an invertible element?

Assume that we have a linear equation like this: $$ax=b \pmod n$$ when $x$ is the unknown, and $a$ is not an invertible element in $n$. is finding $x$ a hard problem? (by solving I mean finding an ...
1
vote
3answers
698 views

What goals is homomorphic encryption aiming to solve?

As I understand from this article about homomorphic encryption, it mainly aims to enhance the security of cloud computing. We should be able to encrypt data and send it to the cloud. After it is send, ...
0
votes
1answer
276 views

How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
3
votes
2answers
574 views

Simple RC4 key generation scheme

I would like to ask you about your opinion on the following scheme of combining a master key and a nonce and stretching the result to the full 256-bytes RC4 key. Master key $K_m$ is a pre-shared ...
3
votes
3answers
338 views

Why do we assume un-security of communication channel on every cryptography system

While reading about a few cryptographic systems, I noticed that we always assume the communication channel is not secured. Why is this assumption made? And, why the effort is being put into designing ...
3
votes
2answers
362 views

While generating a random Elliptic curve what are the conditions i have to considerd?

I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy? For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
1
vote
1answer
163 views

How to solve the reverse of an equation that uses MOD?

I've been tasked with reverse engineering an unknown crypto function. The function uses the following constants: $a=380951$: I noticed that this is a prime number $b=3182$: I noted that this is a ...
5
votes
1answer
137 views

In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?

See this question. The comment by Brett Hale stated: On the other hand, ensuring $(p - 1)$ has a large prime factor requires very little extra effort. What's actually the 'little extra effort'?
1
vote
2answers
217 views

Is it safe for the ChaCha8 nonce to be deterministic?

ChaCha8 takes a 8 byte nonce (or IV) that should not be the same twice for the same key. Generating this nonce randomly makes me very very nervous for collisions. Is it safe to generate this nonce ...
0
votes
1answer
70 views

Is it possible to create a Bilinear Function with Already Assigned “Multiplicative” Input Groups?

Assume that we have an already assigned Multiplicative Cyclic Group $\mathbb Z_p^*$ with order $q=p-1$, and $p$ is a prime number, is it possible to create a bilinear function $\hat{e}: \mathbb Z_p^* ...
4
votes
0answers
137 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
2
votes
1answer
432 views

Are RSA signatures deterministic?

If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature? A Java example always return ...
3
votes
0answers
86 views

Is SHA-1 collision free on data up to 20 bytes long? [duplicate]

Is SHA-1 collision free on data up to 20 bytes long (lenght of hash / internal state)? That means that every input produce unique output, but you surely know that, i just write it in order my question ...
5
votes
2answers
343 views

Is SHA-1 still practical secure under specific scenarios?

It is conjectured that SHA-1 has been broken from the "research" perspective but no in real world. That is that there is an algebraic attack that explores weaknesses on its algrebraic construction. ...
4
votes
1answer
332 views

Question about why RSA is hard to attack

I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
2
votes
1answer
385 views

Generate an insecure public / private key pair

I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods. As far as I know PGP ...
1
vote
1answer
401 views

Why are RSA keys encoded with ASN.1 for TLS?

Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security ...
3
votes
3answers
1k views

Why is RSA encryption significantly faster than decryption?

I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
2
votes
1answer
282 views

Questions about proof of correct encryption in the Paillier cryptosystem

In the Paillier cryptosystem [1] the encryption of $m \in \mathbb{Z}_N$ with randomness $r \in \mathbb{Z}_n^*$ is $c = g^m r^n \bmod{n^2}$. A proof of correct encryption could look like presented in ...
1
vote
0answers
168 views

Why do we need to hash both the message and the $h$ value in ElGamal signature?

The professor left us a question on ElGamal signatures: Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of ...
7
votes
1answer
1k views

Can I find two specific words with the same md5 hash?

I want to find two strings containing special words like "yes" or "no", mixed with random characters, for which the MD5 hash is equal. An example of what I'm looking for: ...
2
votes
3answers
618 views

What is the difference between a HMAC and a hash of data?

On a recent question it became apparent that there's a significant difference between an HMAC of input data and a hash of input data. What exactly is the difference between an HMAC and a hash of a ...
2
votes
1answer
129 views

Padding always the same, problem or not?

I need to transmit long encrypted messages to a smartcard over a limited capacity link so I need to fragment the messages somewhere before sending thzm. My problem is that I split the message into ...
2
votes
1answer
155 views

What information to include when calculating the HMAC of ciphertext

I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is? Furthermore, assume that there is ...
1
vote
4answers
324 views

Bad/Crackable Encryption Example?

I've been tasked with building up some security exercises (basic CTF training kind of stuff) for work. This should contain a bit of crypto, but my knowledge in this space has been limited to using the ...
1
vote
1answer
298 views

How to generate a random polynomial of degree $m$?

I am trying to do a homework in which implement a variation of this paper and I don't know how to generate a polynomial of degree $m-1$. This polynomial is used to generate the $y_0$ and $y_1$ values. ...
2
votes
1answer
1k views

Which one is fastest? Karatsuba or Montgomery multiplication?

Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does ...
0
votes
2answers
741 views

Deriving HMAC key and cipher key from passphrase? [duplicate]

I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
2
votes
1answer
313 views

Nonce role on stream ciphers

Modern stream ciphers usually predicts the usage of a nonce (also termed as IV) in the cryptosystem. The cost of initializing the cipher with the nonce varies from algorithm to algorithm (for ...
1
vote
0answers
83 views

Strong RSA problem in $\mathbb Z^*_{n^2}$

Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
3
votes
1answer
112 views

How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
2
votes
1answer
164 views

Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?

First of all, the Guillou-Quisquater digital signature scheme is: Note everything is $\bmod n$. Message is denoted by $m$. Private key: $s$ Public key: Hash function $H$, $e$, ...
1
vote
2answers
949 views

Fastest multiplication algorithm for efficient exponentiation in C++?

First I apologize if this question is better tailored for SO, but since I'm using the method for crypto stuff, I thought I'd ask anybody that might know here. Karatsuba algorithm does a pretty good ...
2
votes
1answer
400 views

Digital signatures in SSL/TLS-like protocols

The TLS protocol includes an optional Server Key Exchange message that is signed by the server. It seems to me that this message is digitally signed only to prove to the client that the message ...
8
votes
1answer
2k views

From hash to Cryptographic hash

After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
1
vote
1answer
205 views

Is the following key stretching algorithm as memory hard as I think it is?

I'm having some fun designing a key stretching algorithm that can be implemented in pure Python. It's built entirely out of the standard library's hash functions in an attempt to at least wrest some ...
0
votes
2answers
292 views

Computational indistinguishability and example of non polynomial algorithm

The wikipedia page on computational indistinguishability says that two ensembles are not distinguishable if "any non-uniform probabilistic polynomial time algorithm A" cannot tell them apart. To help ...
1
vote
2answers
249 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
1
vote
2answers
638 views

Is storing original file size in an encrypted file header a bad idea?

I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
3
votes
2answers
1k views

Validating successful decryption in AES

I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
1
vote
0answers
48 views

Is there a way to analyse xxHash and tell, either by human analysis, or with an automated tool, that this hash function is or is not cryptographic? [duplicate]

After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for Internet usage, due to a certain type of DDos attack ...
1
vote
1answer
1k views

AES key/ciphertext space sizes

This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
1
vote
1answer
182 views

Why is Blum-Goldwasser not IND-CCA-2 secure?

Consider the Blum-Goldwasser encryption scheme as described on Wikipedia. I was told that it was not IND-CCA-2 secure. I heard there was malleabilty, probably it has to do with XOR-ing. But I do not ...
1
vote
1answer
77 views

Could use an explanation of the notation for an oracle adversary

In the definition below, what exactly does it mean for the adversary (not even sure that's the correct term?) to equal one? $$ \underset{K}{Pr} \left [A^{F_k(\cdot)} = 1 \right ] $$ Source (Page ...
1
vote
0answers
78 views

How can I validate generated session keys in SRP-6a protocol

I have genereted two equal session keys on client and server successfully. But I couldn't understand how each other should validate that they have same session keys. On the client I generated a SHA1 ...
2
votes
1answer
831 views

How does Output Feedback mode use the initialization vector?

How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key? Will I encrypt the Initialization Vector like a block of plaintext? So ...
1
vote
1answer
1k views

Use of CBC-AES-256 to encrypt usernames

I came across some code in our project that encrypts usernames (limited to 50 chars, most are less than 10) using the following parameters: IV size is 16 bytes Key size is 32 bytes Algorithm is ...
1
vote
2answers
335 views

AES encryption with shared IV

Sorry about the horrible title, didn't now what to say. I'm trying to avoid having to send an IV with every message purely to keep packet sizes down, so I thought of a method to establish a "IV ...
3
votes
2answers
402 views

Number of states in a LFSR

Do all $2^{\ell}$ (where $\ell$ is the bit length of the shift register) states always occur in a LFSR or can I choose my taps badly so some states are skipped and the period is shortened? If so is ...

15 30 50 per page