2
votes
1answer
288 views

Why restrict nonce/IV and counter to specific sizes?

When setting up a nonce/IV and counter (e.g. for AES-GCM-128), why are the nonce/IV and counter restricted to specific sections (e.g. random nonce/IV in first 8 bytes and counter in last 8 bytes)? ...
12
votes
2answers
7k views

Definition of Textbook RSA

What is the definition of Textbook RSA? What are some of the properties of textbook RSA? How does it differ from other RSAs?
1
vote
0answers
59 views

Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done. Are there any Asymmetric Encryption Algorithms where the ...
4
votes
2answers
94 views

Is it possible to insert a key derivation function when using EAX?

I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
1
vote
1answer
447 views

Are there Cryptography certifications variants of CISSP?

Are there Cryptography certifications variants of CISSP ( Certified Information Systems Security Professional)? Like a CISSP exams, but only for cryptography?
1
vote
1answer
305 views

Real world use cases of Multi Party Computation

Most of the research papers give imaginary applications of multi party computation. Either they talk about millionare's problem or two or more corporates willing to compute some Intrustion detection ...
0
votes
1answer
135 views

What kind of adversary is a compromised party?

Imagine multiple parties executing a secure multiparty computation protocol to evaluate a function securely. Let Alice be one of the parties who is intended to get all the partial results and combine ...
0
votes
1answer
177 views

Resources for basics of lattice crypto [closed]

I'm looking to fill in the gaps of my knowledge of lattices. Can anyone point me towards papers or books that introduce lattice crypto assuming a fairly solid math background? Mods: Feel free to ...
1
vote
0answers
95 views

can permutation matrix be found in parallel processing technique?

Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ ...
13
votes
2answers
14k views

What's the fundamental difference between Diffie-Hellman and RSA?

What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
4
votes
1answer
200 views

Questions about the ideal cipher model

I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than ...
6
votes
1answer
5k views

How much stronger is RSA-2048 compared to RSA-1024?

How much stronger is RSA-2048 compared to RSA-1024? It is hard to imagine very big numbers. So what would be your way to explain the difference to someone who doesn't know much about cryptography?
6
votes
3answers
716 views

Why is “mod(n)” so central to most aspects of cryptography?

When I first started learning cryptography, I had my first a-ha moment when I fully appreciated the value of a One Time Pad and XOR and all the functions that attempt to emulate that OTP's randomness ...
3
votes
4answers
594 views

RSA by hand - did I do something wrong? (c = m on encryption)

to understand RSA better I am doing a little calculation by hand, this is what I got: Choosing: $p = 3$ $q = 5$ $n = 15$ $\phi(pq) = 2 \cdot 4 = 8$ $e > \phi(n) => e = 13$ $e \cdot d = 1 ...
6
votes
1answer
415 views

Are stream ciphers no longer considered by NIST?

While reading NIST SP 800-90A, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", I noted that no stream cipher was included among the various specified ...
2
votes
3answers
811 views

Master keys for decrypting?

I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys. Most of the people said that "Master decrypt key" does not exist. This makes sense if you developed ...
10
votes
1answer
1k views

Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?

Background Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
-1
votes
1answer
200 views

Integer factorization via geometric mean problem

presume: we have A and B integers, and C - product of multiplication of A and B, A and B are prime numbers (strong or usual) G - is geometric mean of A and B (square root of C) also, we have: if B > ...
1
vote
1answer
180 views

Tor's integrity verification system?

I am trying to understand the design of Tor(onion router). I am reading the original paper on the 2nd generation onion routing system. Where, under integrity checking on streams, they say, "When Alice ...
4
votes
2answers
582 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
1
vote
1answer
110 views

What type of groups does Microsoft's U-Prove use (Schnorr… etc?)

I'm trying to learn more about the Subgroups implementation of Microsoft UProve. I'm unsure if they are Schnorr Groups or use a different foundation? Can anyone point me to the technical reading ...
3
votes
1answer
643 views

Formal definition of (perfect) forward security/secrecy

In recent weeks the concept of (perfect) forward security/secrecy has been mentioned a lot, primarily in the context of the shocking revelations about NSA eavesdropping. As far as I'm aware, this ...
3
votes
0answers
131 views

Designing a protocol to record attendance to lectures

Scenario: a class that is not mandatory. The teacher wants a protocol that will satisfy the following requirements: It must record each student's attendance. A student X should not be able to say ...
3
votes
1answer
398 views

Advantages/disadvantages of different message numbering schemes

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
3
votes
1answer
104 views

Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
6
votes
1answer
1k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here http://www-cs-students.stanford.edu/~tjw/jsbn/ecdh.html If I generate a private key for alice I can get ...
2
votes
1answer
126 views

Is Triple-DES a group?

I know for a fact that DES is not a group, but are any of the Triple-Des versions a group? Why, or why not?
2
votes
1answer
149 views

Offline app authentication - embedding hashed password inside an encrypted file

I am working on an occasionally connected app. To allow the users to authenticate I created a profile which is encrypted and placed on the users machine. The first byte of the file contains the IV ...
1
vote
1answer
125 views

How to build a secure AE scheme with generic composition?

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed ...
1
vote
0answers
92 views

Rating a steganographic system using Blum Blum Shub to locate hidden bits

Currently I'm building a toy steganography system based in a web browser. Besides all the obvious issues with building a system requiring extreme privacy into a browser (this is a toy!), I was curious ...
1
vote
1answer
155 views

What should the size of the private exponents in Diffie-Hellman key exchange for TLS be? [duplicate]

I'm using TLS with a Diffie-Hellman key exchange to negotiate the symmetric keys. How long should the exponents be?
4
votes
1answer
161 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
3answers
381 views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
5
votes
2answers
4k views

Finding a keylength in a repeating key XOR cipher

In an old cryptography FAQ, I found the following step described for determining a the length of the key a cipher was repeatedly XORed against: Discover the length of the key by counting ...
1
vote
1answer
128 views

What is meant by this notation in the ElGamal key generation process?

Alice chooses i) A large prime $p_A$ (say 200 to 300 digits) ii) A primitive element $\alpha_A$ modulo $p_A$, iii) A (possibly random) integer $d_A$ with $2 \le d_A \le p_A-2$. Alice ...
5
votes
2answers
673 views

uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
8
votes
5answers
1k views

Encrypt a file once with 50 characters password or twice with 25 characters?

What better Encrypt the file once with 50 characters password or encrypt it twice each time with 25 characters password.
1
vote
0answers
390 views

Non-malleable file encryption using AES XTS 256?

I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...
30
votes
2answers
26k views

How does one attack a two-time pad (i.e. one time pad with key reuse)?

My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need. I am new to ...
2
votes
0answers
83 views

Is this any recognizable encoding or cipher? [closed]

I've been watching the Marble Hornets videos on YouTube (basically, an independent film series about a group of kids chased by the "Slender Man"), and in this video I saw something interesting. ...
1
vote
0answers
146 views

Best Asymmetric Encryption Standard for Communications? [closed]

I'm new to the standards of encryption. I understand the math behind RSA really well. I'm wanting to design an application for private peer to peer communications using RSA and wanted to know what ...
5
votes
1answer
311 views

md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
1
vote
2answers
194 views

Digital Signature Scheme Count

My question is How I will be able to count digital signature Scheme that can sign many documents with one private key. There are signature scheme as long as exists private keys in the keys spaces? or ...
2
votes
0answers
122 views

Is it possible to derive the midstate of a sha256 hash?

Let's say I have an unknown string with the known sha256-hash of it. I was wondering if it was possible to now calculate the sha256 of the concatenation of the unknown string and "abc". (In PHP: ...
2
votes
1answer
620 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
3
votes
2answers
338 views

Map Bytes to Number

Using node.js crypto library I can generate cryptographically strong bytes. How can I use this to generate a random number between 0 and 9999 (both inclusive)?
0
votes
1answer
187 views

Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the ...
1
vote
1answer
243 views

Using AES-CBC and providing the IV in file header -> security hole? [duplicate]

currently I audit some code I've written in the past to use KeePass 1.x databases. I stumbled over the following question: The database itself is decrypted with AES-CBC and inside the file header the ...
1
vote
0answers
187 views

How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
1
vote
1answer
572 views

Help with example RSA problem

While learning about RSA, I found this example problem. The answer is supposed to be "a 4-digit number that is a pattern of digits." I have computed it to be 16657 twice. OK, now to see if you ...

15 30 50 per page