All Questions

43 views

Generating a 30-32-bit PRP

I want to generate a small 30 or 32 bit PRP. I am going to use that PRP in an open web service and anyone will be able to get any number of plaintext-cyphertext pairs. I've found an algorithm called ...
92 views

Are there any algorithms/protocols that let you produce a specific length of random tokens/bits in such a way that you can cryptographically determine which 2 or more tokens/bitstrings where produced ...
119 views

What are the practical limitations of Asymmetric encryption vs Symmetric encryption? [duplicate]

I hear it commonly said that the advantages of Symmetric encryption are speed and no limit to the amount of data that can be symmetrically encrypted. I also hear it commonly said that the advantages ...
333 views

Precisely how does CBC mode use the initialization vector? [duplicate]

As I understand it, AES in CBC mode does an XOR of the 128-bit initialization vector and the first 128 bits of plain text. Is this correct? I am using the PHP 5.3 openssl extension in aes-256-cbc ...
26 views

Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
84 views

Perfect secrecy with n-time key

How can you encrypt $n$ messages with the same key, and have the same theoretical security you'd have encrypting a single message with a one time pad? For example, how can you encrypt two messages ...
88 views

Padding size with a CBC Block cipher in TLS

I'm currently looking at an encrypted Client Finished message in Wireshark from a TLS session. The cipher suite that was agreed on in previous messages was ...
116 views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
87 views

Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?

I know there already is a very similar question. However, I can't understand why $G'(s)$ is not a PRG. If $G(s)$ is a PRG, then why $G(s||0)$ can't also be a PRG? How can the distribution over ...
47 views

Certificate for the public key

I am new to Network Security and learning about various security features like Diffie-Helmann and others. I understand that the Public key send by the server to the client needs to certified that it ...
107 views

Is one-time-pad still secure if the number of 1's in the key is revealed to the attacker?

For example, if $m = 10011$, $k = 11001$, $n=3$ (which is the number of 1's in k), $c = m \oplus k = 01010$. If $c$ and $n$ are revealed to the attacker, is this scheme still secure?
118 views

Reversing Rotation + XOR

I have this cypher which is as follows : Take 2 numbers : A=1011 and B=1010 if the ith bit of A is 1 then shift B i times to the left. So in the end you will get ...
366 views

Suggestion : CRC vs SHA1

I need some suggestions about the use of the CRC in my application. I need to be sure about the BIOS run by the CPU. I have a FPGA between the BIOS flash and the CPU that sniff every read performed by ...
145 views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication ...
205 views

Why is the public/private key length used in libsodium so much shorter than needed for RSA [duplicate]

Reading the libsodium source I see that is uses a key length of 32 bytes (256 bit) for private/public key encryption. For RSA private/public key encryption a key length of 2048 (or 4095) bit is ...
255 views

Discrete Logarithm (512 bits numbers) - Find exponent parameter

I'm trying to resolve a discrete logarithm equation: $$y = g^x \bmod p$$ Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know ...
55 views

How to determine the exponent when using RSA

Can someone please explain to me how, when using RSA, to determine the exponent to be used in encryption and decryption? I have attempted a worked example on using RSA (shown below) but I can't ever ...
51 views

Definition of indistinguishable schemes

Let $\mathsf{Exp}_{A,\Pi}(\lambda)$ be some indistinguishability experiment that finally outputs 1 if A outputs $b'$ that satisfies $b' = b$, otherwise 0. Then the textbooks often define the security ...
143 views

Is it OK to encode data using key equal to data

For some project, I need to store some short string in encrypted form. It would be ideal for the current purposes to encrypt it using itself. ...
96 views

Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says，given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
46 views

Winternitz Signature Scheme Verfication

I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is ...
44 views

Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and ...
333 views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
61 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
135 views

Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
127 views

Clefia Vs AES 128 bit

I am running a comparison between Clefia (Lightweight cipher from Sony Corporation which is a standard now http://www.sony.net/Products/cryptography/clefia/standard/index.html) and AES 128 bit. The ...
165 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
77 views

Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?

I read something about the padding oracle attack when analysing the use of an AES-encryption of data in a database and was "scared" it could be a serious issue. But after investigating a bit further, ...
150 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
74 views

Can a cryptographic hash be used as a cryptographic RNG?

Say I roll a six sided die 200 times (6^200 = ~2^517) and string all the results together into a long string of numbers and hash then result with SHA-512. Can I use that result for cryptographic ...
359 views

Common Modulus Attack in RSA

Consider the following scenario: The Information Security Department (ISD) of an organization issues each of the organization's employees, domestic and abroad, with an individual RSA key. To simplify ...
123 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
703 views

How does the Blowfish algorithm key initialization work

I'm having some trouble understanding the Blowfish encryption algorithm. From the Wikipedia article... The secret key is then, byte by byte, cycling the key if necessary, XORed with all the ...
86 views

Why do we get the following equation in case of a One Time Pad?

If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that $E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$ My first question is, is the ...
108 views

algebraic attacks for mixed operations (mod 2 and mod 256) [closed]

If a cipher has mixed operations, e.g $\oplus$ (addition mod $2$), and addition modulo $2^8$. How we we going to express them mathematically? Thanks in advance!
275 views

Creating a random password based off of a prime number

So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a ...
82 views

Are there any valid, and person readable, checksums possible?

We've been trying to produce a valid, and pretty, MD5. Something that has repeating digits, or spells a word, or something. It's probably more difficult than spelling out the dictionary on a ...
3k views

Is it safe to use PBEWithMD5AndDES?

I'm encrypting some of my (not so much important) files with PBEWithMD5AndDES. Is it a strong method or it can be de-crypt easily without knowing my selected ...
75 views

What does invertibility of the cryptographic primitive mean?

source: http://www.cosic.esat.kuleuven.be/publications/thesis-152.pdf ,page 32 Note that key recovery implies invertibility of the cryptographic primitive (because due to the Kerckhoffs’ ...
79 views

CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.
126 views

What does variable-base point/scalar multiplication mean in ECC?

I am a bit confuse about the term, variable-base point/scalar multiplication, in Elliptic Curve Cryptography. What I have understood so far. It means that the base or point on EC is variable/unknown. ...
167 views

DH and PKI for KeyExchange

My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. ...
141 views

Equivalent key size between HMAC and AES?

I have seem comparison between AES and RSA, e.g., AES 128 bit key is equivalent to RSA modulus 3072 bits. Is there such comparison between AES key size and HMAC?
111 views

Is the idea of a known plaintext attack really that new?

As you can probably guess, I just watched The Imitation Game, which hasn't really gotten points for historical accuracy... During World War II, Turing and his team fret that they can't know the ...
117 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
126 views

Is it a variant of Strong RSA assumption?

Informally, the hardness of RSA/Strong RSA assumption lies in the hardness of factoring a large composite number $N$ having two large primes as its factors. If RSA modulus $N$ is a prime number, then ...
41 views

Combined message separation

I have two ciphertexts, I suppose that its RC4 with reused key. I have XORed both ciphertexts and obtained message containing combined cleartexts. I suppose that the underlaying messages are written ...
64 views

Verifying identity using a sha-1 hash

I was reading http://blog.zorinaq.com/?e=74 which is about a Windows kernel developer. The developer proves that he is an actual developer by posting the SHA1 hash of a particular revision of a file. ...
A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with \$r \in ...