3
votes
0answers
33 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
4
votes
1answer
214 views

PBKDF2 PRF: HMAC or just hash?

I understand the way $\textrm{PBKDF2}$ can be used to 'stretch' a password/passphrase that does not provide full entropy. My question: how does one choose the PRF? A common choice is any well-known ...
1
vote
1answer
260 views

Is there a administrator key that can decrypt all ciphertexts encrypted with different keys by different persons in a group?

here is the scenario: $A, B, C, \ldots, Z$ are in a group with a administrator $Admin$, each of the users in the group has his own key $Key_A, Key_B$, and so on... everyone encrypt his own ...
0
votes
0answers
51 views

What are the most appropriate PKI based cryptographic protocols for peer to peer communicaton?

I've been trying to find out which is the most appropriate PKI based cryptographic protocol for peer to peer communication. I do understand that they vary with respect to the peer to peer architecture ...
3
votes
2answers
72 views

Is it possible to securely combine multiple hashes without hashing them?

Let's say we have 1000 files and 1000 already computed cryptographic hashes for those files. Now we want to derive a single hash that authenticates all of them. Is there a more efficient way to do ...
3
votes
1answer
57 views

If I don't use XOR in Davies–Meyer, does it remain collision resistant?

If I don't use XOR in Davies–Meyer construction like in picture 2, does the function remain collision resistant?
1
vote
0answers
39 views

Key Distribution Center Key Protocol Analysis

As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture From my understanding, Notation B in ...
2
votes
2answers
102 views

How does this affine cipher work?

I have a question about how I need to solve the following: A sentence has been changed to ASCII and then encrypted with the formula $E(x) = ax + b \bmod 256256$. All I know is that the first 4 ...
2
votes
1answer
72 views

Where in FIPS documents stated that SHA-1 is not secure?

SHA-1 is not secured for a very long time, but I still can see it here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Where in FIPS documents stated that SHA-1 is not secure?
4
votes
1answer
104 views

Is this a better involution S-Box for the Anubis cipher?

After swapping random indexes of trivial involution $S[x] = ¬x$, I found the following involution S-Box with a non-linearity of $98$ and a differential uniformity of $6$. Is there an upper limit to ...
2
votes
1answer
39 views

Am I correctly understanding TLS 1.2 PRF (Pseudorandom Function)?

According to RFC 5246 Section 5 PRF(secret, label, seed) = P_<hash>(secret, label + seed) and ...
2
votes
1answer
32 views

First preimage resistance check

So I have $H: \{0,1\}^* \rightarrow\{0,1\}^n$ a hash function resistant to the second preimage and to collisions. Let there be a function $H' : \{0,1\}^* \rightarrow \{0,1\}^{n+1}$ with the following ...
7
votes
2answers
390 views

Does AAD make GCM encryption more secure?

Does AAD make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?
1
vote
1answer
66 views

Factorization of RSA modulus using a qubic residue

Suppose that someone uses RSA with $n = pq$, exponent $3$, also $3$ divides $\varphi(n) = (p-1)(q-1)$ and $2$ different roots $y$ and $z$ of the equation: $$x \equiv c \ (mod \ n)$$ are known (for ...
3
votes
0answers
32 views

How feasible is a preimage attack or speedups to brute force a substring of MD5?

Beyond the birthday problem analysis how feasible is a preimage attack or speed up brute force on a substring of MD5. For instance let's say from the 128 bits I decide to strip 24 bits, the first four ...
1
vote
1answer
40 views

Why does OpenPGP encryption produce different ciphertexts from the same plain text?

With the same plain text to be encrypted and the same public key, OpenPGP tends to produce a different ciphertext every time I run the encryption operation. Why is this?
3
votes
1answer
44 views

Is there a difference between $\mathbb{Z}_2^b$, $\text{GF}(2^b)$ and $\text{GF}(2)^b$?

I have read a lot about Galois Fields (GF). They are also presented in The Design of Rinjdael on page 13. In computer memory, the polynomials in $F[x]|_l$ with $F$ a finite field can be stored ...
10
votes
1answer
601 views

Qubit / Qutrit - Is there a theoretical limit on how many orthogonal states a quantum bit has?

Seems like a quantum bit with $3$ orthogonal quantum states is called a qutrit - and they have been demonstrated practically. In comparison with $n$ qubits that have ~$2^{n}$ states, these have ~$3^{n}...
1
vote
0answers
34 views

hash function for elliptic curve co-ordinates

Is there any hash function which takes the co-ordinates of an elliptic curve $E_p(a,b)$ as input and gives an integer value i.e. $h(.) : \{(x,y) \in E_p(a,b)\} \rightarrow \mathbb{Z}$
3
votes
1answer
41 views

Different kind of PGP keys or IDs, how to interpret them?

When people say "Here's my PGP key", they tend to come up with all sorts of different stuff. Sometimes they provide an 8-digit hexadecimal number, which seems to be a key ID (although I'm not sure). ...
4
votes
1answer
47 views

Can you decrypt with 1 round key?

If one has the last round key in an SP or Feistel network (the 16th round key in DES for example), would that someone be able to decrypt the rest of the encryption?
1
vote
0answers
23 views

is Authentication tag always appended at last to ciphertext in AES-GCM 256? [duplicate]

I am using AES GCM 256 to encrypt/decrypt a UUID string,We are using java 7 + bouncy castle library for this,We are getting authentication tag of 128 bit ,i am confused ,whether it's position is ...
6
votes
1answer
972 views

how to prove our algorithm is secure against chosen plaintext attack?

I am working on a topic in cryptography where I have tried to develop an encryption scheme. How could I prove mathematically that my algorithm is secure against chosen plaintext attacks?. Will it ...
1
vote
1answer
40 views

Security Strength of Double Substitution Ciphers

I am wondering why people are using RSA keys when some types of double substitution ciphers seem to be just as secure if not better off. By some types of double substitution ciphers I mean one Which ...
2
votes
1answer
61 views

Why is it that most messages seem to be expanded?

Whenever I have seen a more secure version of a message, the message seems to be expanded by some factor. One example is RSA encryption, but whenever a message does not appear to be expanded it is ...
3
votes
1answer
60 views

Is predictable ciphertext/plaintext bad?

I have a cryptosystem that I'm using for secure chat. It is using AES 256 (with RSA 2048 for key exchange). Would a predictable, and repetitively sent ciphertext plaintext compromise the ...
0
votes
0answers
128 views

Example of Software Security (White Box Cryptography) is not strong as Hardware Security?

I have been reading about White Box Cryptography in the last 2-3 days but I was wondering what are the example of White Box Cryptograhy that are quickly broken by Cracker / Hacker? Would the fact ...
4
votes
0answers
53 views

On a proposition in NTRU original paper: $\gamma_1 |f|_2 |g|_2 \leq |f \circledast g|_\infty \leq \gamma_2 |f|_2 |g|_2$

In the original paper of NTRU cryptosystem, we have the following proposition (that is said to be suggested by Don Coppersmith): For any $\epsilon > 0$, there are constants $\gamma_1,\gamma_2 &...
0
votes
1answer
30 views

El Gamal existential forgery using Pointcheval–Stern signature algorithm

I found that there exists an algorithm that claims to make the El Gamal signature generation more secure. The algorithm can be found here as a pdf. I'm mainly interested in the two-parameter forgery ...
3
votes
0answers
56 views

Calculating probability of finding collisions in an invertible hash function

Assuming we have an invertible hash function H that takes inputs of size 2n and outputs hashes of size n, I use the following algorithm to find collisions: Choose a random M as input. Compute its ...
4
votes
1answer
76 views

Number of Sbox in a Cipher

Camellia has 4 SBOX and so does the TwoFish(key dependent 4 Sboxes). Where as AES uses only one. Would it have made AES more secure if AES had 4 or more SBOX too? Does using more Sbox with similar ...
1
vote
1answer
38 views

Camellia Key Schedule

Camellia is a widely used International standard now. Its Key Schedule seems to be too simple as compared other famous Ciphers like Twofish and CAST-256. What are the per-requisites for the key-...
4
votes
0answers
58 views

Numeric base conversion in cryptosystems?

I have been wondering if numeric base conversion has ever found an application in cryptography. By base conversion, an example that is probably familiar is Base64 encoding. This is an example of ...
1
vote
1answer
42 views

Why Rabin fingerprints assumes data is prefixed with a “1” bit?

(I know that a Rabin fingerprint is not a cryptographic hash, sorry in advance if my question is considered out of topic) In the paper Some applications of Rabin's fingerprinting method, it is ...
0
votes
0answers
16 views

Is normal to take wrong values of the polynomial for given x while applying Horner's rule

I want to evaluate the polynomial $a_0+a_1x+a_2x^2+...a_nx^n$ using Horner's evaluation due to i want to speed up my performance of application written in Java. The problem is that sometimes it gives ...
0
votes
1answer
19 views

How many field operations are needed when you compute kG in elliptic curves with a multiple additions or the double-ans-add-algorithm?

For an assignment, we have to calculate how many field computations are needed to calculate kG in an elliptic curve. They want us to show this for two different ways of calculating kG. The first way: ...
3
votes
1answer
78 views

Combining secure hashes with insecure hashes?

Assuming I'm a bank which seeks for secure hash functions to use in the process of signing on digital contents. I'd like to explain / prove why using each one of the following hash functions might ...
0
votes
0answers
20 views

How to generate an El Gamal signature without knowing the private key x?

Let $x$ be the private key. Let $k$ be a random generated number $< p-1$, with $p$ the large prime. Let $g$ be the generator of $p$ the large prime. Let $r$ be the equality $r=g^k$ Let $m_e$ be an ...
0
votes
0answers
44 views

Message length for aes 256 in ctr, ecb and cbc mode

I want to encrypt a message that have values between 0 and 50. So message have maxim 1 byte. Is possible to encrypt with aes256 in ctr, ecb and cbc mode, messages from 1 byte, not necessary 32 bytes? ...
0
votes
1answer
25 views

X509 Cert exploit CA check

Assumptions Let's theoretically assume that a browser skips the check that a certificate it receives belongs to the stated CA (that's an exercise). How could I exploit this in order to impersonate ...
3
votes
1answer
68 views

Insecure third party connection

My organization processes some PII data and shares it with an outbound connection (outflow only) that is a third party. The data transfer transactions occur without human intervention. That outbound ...
6
votes
1answer
73 views

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$. How would one be able to ...
1
vote
0answers
39 views

Issue Factorization Quadratic Sieve

Good evening, I'm about to write my own quadratic sieve implementation in C using GMP library for large numbers. I'm facing an issue while attempting to do the last factorization step for the number: ...
0
votes
1answer
19 views

Digital signature with collision

Let's assume a digital signature scheme such that there's a probability of 0.2 for two random messages to have the same signature. How can I exploit this sheme? I'm having difficulties in finding an ...
2
votes
0answers
8 views

How to decrypt SSL data on a considered-to-be-compromised host? [closed]

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
0
votes
1answer
55 views

Why is it better to have the private key as the multiplicative inverse mod phi(n) in RSA?

I'm studying the RSA algorithm and the theory says to select $d$ to be the multiplicative inverse of. $$ e \mod \phi(n) $$ If we take this approach I know that it is important that $e$ and $\phi(...
3
votes
2answers
85 views

Chosen-Message-Attack RSA-Signature

I know that because of the multplicative property of RSA $s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$ If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=...
1
vote
1answer
62 views

How to brute force sqlcipher encrypted file with MD5 hash of a 7 bit key?

I have a database file that is encrypted using sqlcipher and MD5 hash. Sqlcipher to my understanding provides 256 bit AES encryption. The key is 7 bits long. How do I brute force it?
-3
votes
1answer
63 views

Is SHA-256 safe and difficult to crack? [duplicate]

I am trying to crack a SHA-256 hash but I am not sure how to approach this in an efficient way. The following is known of the original non-hashed content: 64 characters long only consists 0-9 and a-...
0
votes
1answer
25 views

Is it possible to extract the decryption key from a locked android device

Is it possible to extract the decryption key from a FDE android device while the screen is locked but the phone is powered on. Is the data only safe when the phone is off ?

15 30 50 per page