1
vote
2answers
256 views

How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?

I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars. ...
3
votes
1answer
951 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
2answers
338 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
5
votes
1answer
375 views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
2
votes
1answer
303 views

What's the probable usage of Interlock Protocol

I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir. I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
9
votes
1answer
5k views

Why exactly is Blowfish faster than AES?

I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
0
votes
1answer
573 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
4
votes
1answer
213 views

Is it safe to assume Salsa20 to be a PRP?

Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20. If limit ourselves ...
2
votes
2answers
2k views

Keys required for cryptography

I am reading an article on cryptography at following location: http://www.entrust.com/resources/pdf/cryptointro.pdf Historically, encryption systems used what is known as symmetric cryptography. ...
1
vote
2answers
495 views

Does key authentication in SSH protect from MitM?

How do cryptography in SSH(2) work (secure channel establishment, authentication)? Does key authentication in SSH(2) protect from MitM by providing authentication and integrity and why?
1
vote
0answers
149 views

Perfect secrecy and change of plaintext probability distributions

How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions? Do ...
6
votes
1answer
728 views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
2
votes
0answers
139 views

Correct way to truncate data to a range [duplicate]

2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm. I want to take a stream of k trusted random ...
1
vote
1answer
2k views

decryption many time pad [duplicate]

I have eleven ciphertexts that were encrypted with the same key (which I don't know). I want to decrypt the last ciphertext. I read similar question like Many time pad attack but I can't solve my ...
2
votes
0answers
163 views

How can I prove that this encryption scheme from a random oracle is secure?

I am reading this example: A random oracle is an ideal object. What makes a random oracle convenient for proofs is the part about knowing nothing on the output for a given input if you do not ...
2
votes
1answer
69 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
3
votes
1answer
229 views

How to use salt if I am sending hashed password?

If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
1
vote
2answers
329 views

ElGamal: Generation of “g” value?

I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures: $p$ = safe prime $q = (p-1)/2$ $g$ = an ...
5
votes
1answer
232 views

Is there an existing AEAD scheme with minimal IV requirements?

Is there an existing AEAD scheme such that, for inputs with the same AD and IV ciphertexts are allowed to leak whether or not their plaintexts are equal, if the scheme can process the plaintext in a ...
1
vote
1answer
123 views

Pseudo Random Generator (PRG) from Rabin function

I'm trying to make a PRG using the Rabin function. The code (in Java) I wrote to implement the function is: ...
1
vote
1answer
645 views

Proper uses for CTR and CBC AES block cipher modes

Assuming the following: Key is randomly generated is being used (32 bytes+) IV is also randomly generated Crypto random key generator is used Data being encrypted contains common bytes like ...
2
votes
1answer
97 views

Why unit vectors should be encrypted bit per bit in that case?

At this work at section $2.2$ concerning a possible application for the BGN cryposystem the author points out that if you want to encrypt a unit vector $\overrightarrow{u_l}$ of size $l$ then the ...
2
votes
0answers
86 views

Relaxed trust criterion for mental poker server?

I've read a lot about protocols for mental poker without a trusted server, but I'm interested in the possibility of a faster, more practical protocol that relaxes that criterion a bit and "trusts" a ...
3
votes
1answer
115 views

What does “adaptively secure” mean?

In a paper it says "In the generic group model, the PRF is adaptively secure for inputs of $\mathbb{Z}_q^n$". Maybe a stupid question, but what does "adaptively secure" mean exactly?
2
votes
3answers
201 views

EC equivalent for RSA-OAEP

I have some questions regarding aforementioned subject: Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ? Is ECIES-KEM sufficient ?
1
vote
1answer
143 views

AES Message Authentication Vulnerability

My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out. Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
1
vote
1answer
250 views

ECKS-PS algorithm: searching in encrypted data; bilinear maps

I have found an encryption algorithm named ECKS-PS (published in the paper Efficient conjunctive keyword search on encrypted data storage system) that allows an user to search in encrypted data. All ...
6
votes
1answer
331 views

Any point in waiting for the SHA-3 standard?

The Wikipedia article on SHA-3 says that Keccak has been chosen but the standard hasn't been issued. Does this matter? That is, can we just assume it's going to be as specified by the submitters ...
6
votes
1answer
160 views

What's the state of the attack to get the first pre-image on MD4?

What's the state of the attack to get the first pre-image on MD4? Is it still $2^{102}$ as described by Gaëtan Leurent in "MD4 is Not One-Way" ?
2
votes
2answers
4k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
1
vote
2answers
461 views

Using salted hash as password for easy memorization without reuse?

I had an idea earlier: Secure passwords are a) long, and b) unpredictable. A hash is both of these. Would it be safe to reuse a key between sites, and include the site's name as a salt? For example: ...
3
votes
3answers
260 views

Ciphers in CBC mode reveal place of change in plaintext

Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, ...
4
votes
2answers
578 views

Signature schemes for underpowered devices (8bit microcontroller)

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently ...
3
votes
2answers
1k views

Known-plaintext attack on Blowfish in ECB mode

The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
1
vote
1answer
158 views

Given a certain entrophy per character, how long should a passphrase be to guarantee key strength?

Given an entrophy of 1.5 bits per character, how long does a passphrase have the be to guarantee a key strength of a 128 bit random key? Assuming an alphabet of 26, one character takes log2(26)=4.7 ...
-1
votes
2answers
488 views

May the problem with DES using OFB mode be generalized for all feistel ciphers

There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used ...
4
votes
1answer
7k views

Does the IV need to be known by AES (CBC mode)?

I was thinking about this today and thought I should ask. I think I understand IV's enough to say that they are basically the same thing as Salts when talking about hashes. They are there to improve ...
1
vote
0answers
471 views

How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code: ...
1
vote
1answer
87 views

PBKDF2 when dkLen and hLen have the same size

I was reading RFC 2898 and something is not clear to me. When I use PBKDF2 with SHA-256 and I want a derived key with length 32 bytes (the same length as my hash function output), your derived key ...
2
votes
1answer
876 views

Question about the definition of a secure PRF

I'm taking a cryptography introduction course, and we're covering the definition of a secure PRF. I understand the test goes as follows: A challenger picks a function $f$ such that $f \leftarrow ...
1
vote
2answers
159 views

Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?

If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
438 views

Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
3
votes
2answers
419 views

Case insensitive verification of HMAC / Base64 signature

I am signing a short message using the base64 of an HMAC, like this (python): ...
1
vote
0answers
153 views

How fast can a wrong decryption key be detected using ECC?

When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that? ...
2
votes
1answer
110 views

Why constrain the message lengths in indistinguishability in the presence of an eavesdropper?

I need your help with a very basic concept in cryptography which I can't understand/prove on my own. I'm trying to prove and understand why, under "indistinguishability in the presence of an ...
2
votes
1answer
468 views

How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
3
votes
1answer
194 views

Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
7
votes
0answers
209 views

Efficient decoding of irreducible binary Goppa codes and the role of matrix P in McEliece cryptosystem

If we assume that the support for an irreducible binary Goppa code $\gamma_1, ..., \gamma_n$ is publicly known, when is it possible to efficiently decode the code? I know it's possible if one knows ...
3
votes
2answers
328 views

DSA signatures with related k and unknown payloads

Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...
2
votes
1answer
568 views

Attack on DSA with signatures made with k, k+1, k+2

For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...

15 30 50 per page