0
votes
2answers
678 views

Is the AES encryption scheme CPA secure?

Give a 256 bit key space and 128 message space would AES block cipher as the encryption scheme be CPA secure?
3
votes
2answers
163 views

Is there an advantage to storing keys split between several hashes?

I have a question about the way to store a key or password that was used for encryption, so that the application can check if the user put in the right key for decryption. If I make a mistake, please ...
0
votes
1answer
653 views

Learning cryptography using a FPGA

I have a FPGA and am curious what cryptographic applications I can use with it. I'm just a hobbyist / security researcher and not a professional cryptographer. Since I'm creating my own curriculum, ...
3
votes
2answers
566 views

Proofs of collision resistance by reduction

I'm looking for examples of a proof by reduction. For example: Let $A=(Gen, H)$ be a hash function. We define a new Hash function $A'=(Gen',H')$ with $Gen=Gen'$ by $H'_s(x)=H_s(H_s(x))$. It ...
1
vote
2answers
207 views

Pseudorandom generator and AE-secure encryption

How would you answer the following question (I have to translate it from German): The existence of a pseudorandom generator implies the existence of a AE-Secure encryption scheme (AE = ...
8
votes
4answers
621 views

Cracking WWII-era codes - code found on a pigeon's leg in Surrey

A recent BBC article entitled WWII code 'may never be cracked' posted a code: AOAKN HVPKD FNFJW YIDDC RQXSR DJHFP GOVFN MIAPX PABUZ WYYNP CMPNW HJRZH NLXKG MEMKK ONOIB AKEEQ WAOTA RBQRH DJOFM TPZEH ...
-2
votes
1answer
521 views

Encrypting with private key in Public Key InfraStructure [closed]

In Public key infrastructure, the MD5 of a piece of data is encrypted with the private key of a sender and this encrypted MD5 – along with the data – is again encrypted using an algorithm like AES or ...
25
votes
4answers
12k views

Should we sign-then-encrypt, or encrypt-then-sign?

We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
3
votes
2answers
1k views

Cracking the Beaufort cipher

Is there any easy way to crack a Beaufort cipher? We have a Vigenère table, and are trying to guess the keyword. Any easier way?
6
votes
2answers
903 views

Does a trace of SSL packets provide a proof of data authenticity?

I'm wondering if it would make sense to record a whole HTTPS session, publish its encryption keys and present it to third parties as a proof that this particular data was sent by a given server ...
3
votes
0answers
170 views

Does Keccak have an eTCR mode?

On page 7 of NIST's views on SHA-3's security requirements and Evaluation of attacks, I see that, at least at this point, NIST planned on offering SHA-3 having eTCR security (defined on page 3): ...
4
votes
1answer
270 views

Questions about William's p+1

First off, if you're doing William's p+1 test, then also doing Pollard's p-1 is redundant, since the p+1 test covers both cases, right? Second, why is the recurrence $V_{n+1} = aV_n - V_{n-1}$ used? ...
10
votes
3answers
610 views

How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
5
votes
2answers
332 views

Is storing the hash of a key together with ciphertext encrypted with that key secure?

Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
4
votes
1answer
615 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
1
vote
2answers
117 views

What can a master password also be called?

When having a company computer that is full disk encrypted, it is common that the boss have a master password / backdoor, so the data always can be decrypted. I have heard some call this for "scrow" ...
0
votes
0answers
44 views

NIST Standard for Advanced Encryption Standard Algorithm [duplicate]

Possible Duplicate: Advantage of AES(Rijndael) over Twofish and Serpent What is the reason of NIST why Rijndael choose as the Advanced Encryption Standard
0
votes
1answer
625 views

detecting ROT13/base64 encryption

Is there anyway to detect that a cipher is encrypted with ROT13 Or Base64 without decrypting it using the algorithm and check that the result means (works)? I mean does an algorithm exists that test ...
2
votes
0answers
103 views

Is this a valid real-time authentication scheme?

The scenario in Alice/Bob/Cindy terms: Alice approaches someone she doesn't know, but thinks is Bob, and asks for some secret information. Bob doesn't know and doesn't trust Alice, but Alice says she ...
1
vote
1answer
170 views

Does a break in a collision resistance property of a hash function by definition implies an attack at the first pre-image attack?

Is there a formal security proof in the shape of reduction that states that if an attacker manages to break the collision resistance property of a cryptographic hash function (a random oracle) he will ...
7
votes
2answers
265 views

Will varying plaintext compensate for a fixed initialisation vector?

This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest. I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
12
votes
5answers
2k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
5
votes
6answers
661 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
4
votes
2answers
2k views

Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
0
votes
2answers
234 views

Is this how padding can work?

So for block ciphers you need a fixed size block. If the plaintext length is not a multiple of the block length then you need to pad it. One way you could do this is that for the last block you just ...
2
votes
2answers
7k views

Decrypt digital signature using RSA public key with openssl

I have a digital signature that was created using the following algorithm: a SHA-256 hash of the body of the message is calculated. It is then signed using an RSA private key and the result is ...
7
votes
3answers
2k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
3
votes
2answers
263 views

Proof that a function constructed from a PRP is, or is not a PRF?

Let $E$ be a family of Pseudo-Random Permutations of $b$ bits, with $E_K$ indistinguishable from random permutation with effort less than $O(2^b)$, easily computable as well as the inverse ...
1
vote
1answer
68 views

Secure MAC implies that probability of same tags on different messages is negligible

So let any secure MAC (message authentication code) be given. Intuitively, I think it is clear that the probability of getting the same tag on two different messages is very small, i.e. negligible. I ...
3
votes
2answers
159 views

iterated discrete log problem

Consider the following problem: given $g_1 \ldots g_i,h_1 \ldots h_i \in G$, $\forall i$ find $x_i$ such that $g_i^{x_i}=h_i$ For $i=1$ this is the discrete log problem and is assumed to to have ...
3
votes
2answers
733 views

Implementing AES in C++: 4x4 Array of unint8_t, or 4x1 array of uint32_t?

I'm implementing AES in C++, and, inspired by the way words are handled in SHA, I decided this time to handle the state as a one dimensional array of 4byte unsigned integers as opposed to a two ...
1
vote
2answers
735 views

AES key padding

Is the initial AES key (expanded to the key schedule) byte padded if less than e.g. 16 bytes? Is there a safe way of determining if decryption was successful (i.e. used the correct key)?
4
votes
0answers
184 views

Ring Signature - paper/code difference in trying to solve inverse trap door function?

there is a paper on ring signatures and a python implementation of it here. The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
5
votes
2answers
228 views

Why does OAEP have 2 rounds with 2 random oracles?

I strive into understanding why OAEP has two rounds of computations and not just one. I.e: Wouldn't it be safe to hash the random number r and XOR it with the original message?What security risks if ...
2
votes
3answers
2k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
6
votes
3answers
349 views

Word-based stream ciphers vs “regular” stream ciphers?

Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. ...
3
votes
1answer
2k views

How to prove that the concatenation of two secure PRG is secure?

Given $G:\{0,1\}^s \rightarrow \{0, 1\}^n$ a secure PRG, how can one prove that $G'(k_1, k_2) = G(k_1) \cdot G(k_2)$ is secure ($\cdot$ means concatenation)? In other words, I'd like to show that if ...
5
votes
1answer
754 views

What does Maj and Ch mean in SHA-256 algorithm?

I'm guessing they're some kind of standard function but what do they do and what do the names mean? A little explaination or link me to an article would be great.
-2
votes
0answers
597 views

Fiat-Shamir signature [closed]

I have a question about Fiat-Shamir signature: A hash function is h(w)=w mod 2011 and w1=2623, w2=3269, w3=1938. What is h=? and how to determine k.t bits?
3
votes
1answer
413 views

Efficient setup for a Montgomery multiplication

Montgomery described an efficient method to compute a modular multiplication. This works by using a special constant $R$ and assumes the inputs $a$ and $b$ have been made into a special representation ...
6
votes
2answers
540 views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
1
vote
1answer
2k views

What is a trapdoor permutation?

Can anyone explain to me what a trapdoor one-way permutation is? Is RSA a trapdoor one-way permutation? Context: I was reading about ring signatures. On page 560, it describes steps to ...
1
vote
0answers
130 views

Quadratic Sieve Bottleneck, Multiple Polynomials an option?

After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base. The way I implemented it ...
1
vote
2answers
209 views

Breaking RSA, given a special kind of oracle that decrypts related ciphertexts for us

Let $c=E^{RSA}_{e}(w)$ be the ciphertext belonging to the plaintext $w$ if an $RSA$ system is used. Assume that the public exponent $e$ satisfies $e \le 10$. Furthermore, assume there is an oracle ...
1
vote
1answer
384 views

Montgomery Exponentiation - selecting input value R for a given BigInteger

I have Montgomery exponentiation working, but it's working quite slow. I suspect there are two reasons for this - I implemented it bit size instead of word size (I didn't realize at the time that ...
1
vote
1answer
446 views

How do unkeyed hash functions (for MDCs) provide security?

Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
2
votes
1answer
570 views

Why are these specific values used to initialise the hash buffer in SHA-512?

I'm reading the book Network Security Essentials written by William Stallings. To create a message digest with SHA-512, we have to go through some steps: append padding bits. append length ...
1
vote
0answers
87 views

Why do we always append padding bits in SHA-512? [duplicate]

Possible Duplicate: In the SHA hash algorithm, why is the message always padded? I'm reading the book Network Security Essentials written by William Stallings. To create a message digest ...
9
votes
3answers
22k views

Difference between stream cipher and block cipher

A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. A block cipher ...
1
vote
1answer
2k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...

15 30 50 per page