2
votes
3answers
3k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
1answer
3k views

How can I convert a DER ECDSA signature to ASN.1?

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source: ...
1
vote
3answers
760 views

Implementing secret reconstruction in Shamir's Secret Sharing

I am trying to implement Shamir's secret sharing in C++. I have got the generation of shares working. However, I am very confused with the reconstruction of shares. I get the part on how three users ...
1
vote
2answers
288 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
-1
votes
2answers
554 views

Open source implementations of Symmetric Searchable Encryption and Order Preserving Encryption [closed]

Are there open source implementations of SSE and OPE? Can anyone please point to sample codes, if available. EDIT If cryptDB is not an option, what other options are available? (Indeed, these ...
15
votes
2answers
1k views

Is HTTPS secure if someone snoops the initial handshake?

Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
14
votes
2answers
835 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
14
votes
1answer
1k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
14
votes
3answers
909 views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
13
votes
2answers
1k views

Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?

Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
11
votes
3answers
2k views

At the current time, is SHA256 the de facto standard for strong cryptographic hashes?

At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
10
votes
2answers
717 views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
10
votes
2answers
1k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
10
votes
4answers
1k views

Properties of PRNG / Hashes

There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications. So, I was wondering how ...
10
votes
5answers
341 views

Tactics available to help prove security of a new system?

I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
9
votes
4answers
472 views

Authenticated DH, what protocols are secure?

I read about STS + variants being insecure in the SIGMA paper, which then proposes SIGMA as a replacement. Are the SIGMA variants still considered secure or are there some other protocol that's ...
9
votes
1answer
489 views

How to build an electro-mechanical public key cipher machine?

It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ...
9
votes
1answer
497 views

What does “running in polynomial time” really mean?

I'm currently learning private-key cryptography. I've been able to see that perfect secrecy is achievable if no assumption is made about the computational power of the attacker. However, perfect ...
8
votes
1answer
703 views

Homomorphic (encrypted) comparison to an integer

When working with an additive homomorphic encryption scheme (say Pallier's), is there an efficient way to get the encrypted value of a comparison test to an integer value (I realise that an ...
8
votes
1answer
772 views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
8
votes
2answers
1k views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
8
votes
4answers
751 views

Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
8
votes
2answers
672 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
8
votes
1answer
505 views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
8
votes
1answer
892 views

AES and perfect ciphers

I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ...
8
votes
3answers
293 views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
7
votes
2answers
851 views

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
7
votes
1answer
430 views

Why are cryptography algorithms not exported to certain countries?

There have been strict laws about the export of crypto software to certain countries. I can understand the intent, but never gauged the fact that there is nothing stopping these countries from ...
7
votes
2answers
345 views

Testing the Fortuna random number generator?

I have implemented the Fortuna random number generator as described in chapter 10 of "Practical Cryptography" (Ferguson and Schneier, Wiley, 2003), the result can be found at ...
7
votes
2answers
669 views

Is FIPS 140-2's “Continuous random number generator test” practical?

Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test." Here are the relavant bits: If each call to a[n] RNG produces blocks of n bits ...
7
votes
2answers
1k views

RSA and prime difference

It is known that the two prime factors $p$ and $q$ of an RSA modulus $n$ should not be too close to each other, otherwise an attacker may factor the modulus. In other words, $\Delta = \left| p - q ...
7
votes
2answers
4k views

Are there any known collisions for the SHA-2 family of hash functions?

Are there any known collisions for the hash functions SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512? By that, I mean are there known values of $a$ and $b$ where $F(a) = F(b)$ and $a ≠ b$?
7
votes
1answer
2k views

Generating Random Primes

Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version". I'm implementing some homomorphic encryption ...
7
votes
8answers
2k views

Would it be secure to use random numbers from random.org in a cryptographic solution?

Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while ...
7
votes
3answers
2k views

How to attack a classical cipher using known partial plaintext?

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext. What are the cryptanalysis approaches for ...
7
votes
2answers
2k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
6
votes
2answers
173 views

Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
6
votes
3answers
278 views

Deterministically combine more than one source of entropy

What is the proper/canonical way to do this? For example, $0 < r1 < 1$ and $0 < r2 < 1$. Presuming uniformly distributed probabilities for the two, combining/averaging them is going to ...
6
votes
3answers
416 views

Slow one-way pseudo-random permutation?

I'm looking for a slow one-way pseudo-random permutation; or in other words a block cipher $E_K: P\in\{0,1\}^b\mapsto C\in\{0,1\}^b$ with moderate block size $b\approx 64$ bits, wide key $K$, ...
6
votes
4answers
286 views

Is there a proof for showing any cryptogram is crackable?

I commonly hear statements along the lines of "all cryptograms are crackable - it's only a matter of time". Is there a proof to show that any cryptogram is "crackable"? The proof may be of a more ...
6
votes
3answers
380 views

Why the symmetric key layer in PGP?

I've been familiarizing myself with the basics of PGP. If I understand correctly, PGP symmetrically encrypts the data of interest using a random single-use key, then encrypts the encrypted data and ...
6
votes
2answers
1k views

Is there a hash function which has no collisions?

Is there a hash function which has no collisions? To clarify: it would be some function which would produce variable-length output, and never produce the same output for differing input. It would ...
6
votes
1answer
327 views

Why doesn't CTR mode require blocking?

I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
6
votes
1answer
231 views

Finding where I am in a linear recurrence relation

Suppose I have a linear recurrence relation $$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$ where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as ...
6
votes
4answers
2k views

What is the recommended replacement for MD5?

Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
6
votes
3answers
586 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
6
votes
3answers
843 views

Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526?

I was wondering if the prime numbers defined for use with Diffie-Hellman in RFC 3526 are more trustworthy than generating one's own, especially considering the recent Arjen Lenstra paper (Ron was ...
6
votes
3answers
424 views

Is there some way to generate a non-predictable random number in a decentralised network?

Is there a way to generate a random number with given restrictions: It will be used in a decentralised network with a big number of peers (no central authority to generate it) Its generation should ...
6
votes
1answer
349 views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
6
votes
2answers
1k views

New PRG from old

Is the following statement true: If $G: \{0,1\}^k \to \{0,1\}^n$ is a PRG, then so is $G':\{0,1\}^{k+l} \to \{0,1\}^{n+l}$ defined by $$G'(x||x')=G(x)||x'$$ where $x \in \{0,1\}^k$ and $x' \in ...

15 30 50 per page