All Questions

71 views

Using a hash with a constant key to create easily verifiable codes

I'll keep my question short. If I keep handing out different codes generated by this function, will it be trivial to figure out the secret key? ...
91 views

Does “use of SHA-256 in cryptography” imply use of SHA-256 both in HMAC and DH key exchange, assuming these are the only uses of hash in system? [closed]

I am beginner to Cryptography. And recently I came across the requirement like "use of SHA-256 in cryptography". Does "use of SHA-256 in cryptography" imply use of SHA-256 both in HMAC and DH key ...
173 views

Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
152 views

Which hardware-accelerated AES-GCM implementations support encryption in-place? [closed]

By encrypt in place I mean the following. Suppose I have an input plaintext of length L and I have also allocated an extra E bytes at the start and/or end of the buffer, with E << L. So the ...
93 views

Is MITM possible after key exchange phase done successfully in RSA?

Is MITM attack theoretically possible after public/private key pair exchange is done successfully. Say Alice and Bob have genuine public keys of each other. Is MITM possible further during ...
70 views

Random numbers for Master Key and Key_block

Exploration through RFCs concludes that random numbers used in the creation of Master Key and Key Block(Key material for Encryption Key and Mac Secret) are from ServerHello.random and ...
267 views

Tweakable encryption algorithms vs Key wrapping

I have read many articles about Key wrapping and tweakable cipher modes. However, I don't understand the main difference between them? What you recommend for Key storage and Key Archive.
70 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
116 views

Should layered use of crypto always have a cryptographic binding between the layers?

Reading the latest TLS weakness, it seems that multiple weaknesses have been found over the years caused by not ensuring that messages are sent over the same channel, and in general a lack of ...
409 views

Using RSA key pair for file encryption

I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server. A form of PK encryption seems ideal for this, as I can store the ...
87 views

Determine the iteration times using Pollard's rho Method for factoring

Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ...
86 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
43 views

Retrieve cryptographic key knowing cyphertext and plaintext [duplicate]

I was curious about cryptography so I started to learn about symmetric encryption. From what I understand a symmetric encryption works as follow: PlainText -> (Encrypt)K -> Cipher text -> ...
161 views

What RC4 key value will completely invert $S$ after initial permutation?

What RC4 key value will completely invert $S$ after the initial permutation, so that $S[0] = 255, S[1] = 254, …, S[254] = 1, S[255] = 0$?
110 views

Attacking hashed password by timing attack and other means

This question is inspired by this recent one, which raises a point that need to be made quantitative to be meaningfully discussed. I chose an unusual approach: a new question worded as homework that ...
1k views

AES CBC Security

I am building an Apache webserver with TLS 1.2 and OpenSSL 1.0.1. So far, I have enabled 2 encryption algorithms - ECDHE AES256 GCM and ECHDE AES128 GCM. Firefox and Chrome(ium) use NSS which ...
185 views

How does converting character set affect hash entropy?

Does mapping a large character-set hash onto a small character-set hash lower entropy for a fixed size substring? I'm writing a python app that involves generating passwords for websites. During the ...
385 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
142 views

Safe and computationally efficient way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. Is there a safe and computationally efficient way of doing so? Which ...
144 views

Hash function that is efficient on GPU and poorly suited to ASIC

I have such requirements to the hash function in my project: operating on 32-bit data, not mathematically breakable (built on existing hashes known to be secure), free of branching, as much as ...
59 views

What does the notation $1^n$ stand for? [duplicate]

I'm seeing this all over my Katz and Lindell book and I don't see where they introduced it.
81 views

Why do authors execute a leakage resilient election protocol inside a leak-free phase?

In the paper "Multiparty Computation Secure Against Continual Memory Leakage", on page 1241 (that's page 7 of the PDF) under section 2.3, the authors discuss "The Election Protocol" that they use to ...
46 views

ElGamal Homomorphic Encryption Formula Question [duplicate]

With Pubic Key $(G, q, g, h)$ where $G$ is a group, $q$ prime, $g$ a generator of $G$, Am I right in thinking that: $$\mathrm{Enc}(m;r) := (g^r, h^r \cdot g^m)$$
59 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
65 views

Is it feasible to break an encrypted and later encoded message?

A message is sent from a person to another. The plain message is first encrypted, even with a weak algorithm - say, DES. Then, the encrypted message is encoded with a simple substitution, which is ...
59 views

I am trying to implement Efficient Robust Private Set Intersection using additive ElGamal. I am trying to run the full protocol mentioned in Section 3.4 on the following inputs: $p = 17$ (prime) $g ... 0answers 92 views Factorization or discrete logarithm is difficult for an attacker? I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ... 1answer 58 views byte length and offset for k3d3/ed25519 byte[] variables? I've discovered for myself that java's BigInteger is very slow, so I'm trying to weakly optimize this java implementation of ed25519 which I will fork and post if ... 0answers 166 views inverse of scalar multiplier in ECC I am learning to use ECC. i got into situation where i have$Q=abG$, where$G$is the generator of the finite field formed on EC using a prime$p$modulus and$a$,$b$are random numbers. now suppose ... 0answers 174 views Rabin code same message sent with different$N$I use Rabin code with modulus$N$. Now assume that Alice sends me a message$m(1\le m\le N)$encoded by Rabin code. Unfortunately after Alice sent me the text I lose the information about the ... 0answers 65 views Looking for alternative key stretching I am by no means a security expert, but I am curious whether functions that don't produce different outputs when raised to the power of N (without any psuedo-randomness) exist, that are as strong as ... 0answers 128 views Distributed integer factorization? I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier ... 1answer 236 views Recovery of RC4 key when S-box 0 stage or 1st stage known I've been exploring around, trying to understand if such thing is even possible. I have some RC4 ciphertext which I know it's plaintext and I would like to extract the key just from cipher and ... 0answers 125 views Can you show how that RSA does/doesn't provide anonymity? Considering a CPA-secure version of RSA where the ciphertext is just a rundom element from$Z^*_N$. Does that meet the anonymity requirement in which an cpa adversary cannot distinguish between a ... 0answers 352 views Random Number Generation with a Entropy pool versus Seed To give a little background I'm currently implementing a crypto library in JavaScript. I have started porting across Linux's random number generator because its both publicly scrutinized, it is ... 0answers 202 views Pohlig-Hellman exponentiation block cipher Let$G$be a group of order$n$and let$e,d$be integers such that$ed\equiv 1 \pmod{n}$. Then the exponentiation maps$x \mapsto x^e$and$y \mapsto y^d$are inverse maps on$G$. These maps give us ... 0answers 94 views Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake? I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ... 0answers 182 views Where can I find examples of ECC implemented in VHDL? I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives ... 0answers 91 views Can you provide an example in relation to Hidden Field Equations Multivariate? I'm reading about Hidden Field Equations Multivariate scheme. My lecture states that the central map is a univariate polynomial $$P(X)=\sum_{i=0}^{r-1}\sum_{j=0}^{r-1}p_{ij}x^{q^i+q^j} \in K[X]$$ ... 0answers 306 views Is there any analysis of freebsd's “geli” encrypted geometry provider? I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ... 0answers 416 views What is the chance of a collision when using SHA-3? I currently am writing a web app and am using two random hashes that are before and after the string and are both 50 char long (alphabet, numbers, and special chars). ... 0answers 106 views $\phi$function in Dual_EC_DRBG I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the$\phi$function used throughout the definition ... 0answers 51 views Can you clarify the proof that secure LR-two party protocols do not exist? In the paper “Multiparty Computation Secure Against Continual Memory Leakage” on pg. 1237, the footnote #1 discuss why it is not possible to construct a leakage resilient two-party protocol. But I'm ... 0answers 76 views How can user privacy be preserved in certificateless cryptography? In certificateless cryptography, how can a user preserve his privacy from Key Generation Center? If the KGC becomes malicious, how can the user's privacy be preserved? I read "Privacy-Preserving ... 0answers 186 views What would make it impossible to deny that decryption of a package has taken place? I'm part of a team designing a system where a user have to be able to read a certain package, if he has preformed an action or series of actions that makes it legal for him to do so. The tricky part ... 0answers 60 views TCR hash functions from MD5 I'm reading Collision-Resistant Hashing: Towards Making UOWHFs Practical (pag. 10 and 11) and here say The most direct way to construct a TCR hash function is to key a function like MD5 or SHA-1. ... 0answers 26 views Why does a joint leakage MPC protocol not directly apply to a disjoint leakage requirement? In the paper "Multiparty Computation Secure Against Continual Memory Leakage" on pg. 1239 the footnote at the bottom points out the difference between$joint$leakage and$disjoint$leakage. The ... 0answers 201 views Best group if one wants the discrete log problem to be hard? Suppose one is implementing a cryptographic scheme over a group where one needs the discrete logarithm to be hard - what is the recommended group to use? I'm looking for a group where calculations are ... 0answers 54 views AES and Known-plaintext attack [duplicate] Can you help me to finding some papers that shows AES is secure against known-plaintext attack? 1answer 119 views Creating a secure key Imagine that your lecturer and the undergraduate office have conducted a key exchange protocol after which both of them hold the string$X\$. Yet, it is possible that a curious student sitting next to ...

15 30 50 per page