2
votes
3answers
2k views

Is 512-bit RSA still safe for signature generation?

The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the ...
0
votes
2answers
445 views

Properties of Ideal Straight P-Boxes

What properties should an ideal straight P-Box exhibit?
2
votes
0answers
176 views

Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]

Possible Duplicate: Using CBC with fixed IV Forgive me if this has been asked before, I looked but haven't seen any answers that suit. Is there any danger in using CBC, encrypting a ...
2
votes
2answers
145 views

High Power Computing for Crypto Research

Obviously, much of cryptography requires the assumption that adversaries have bounded computing power. So, I was wondering, are there any fields in cryptographic research for which high power ...
5
votes
6answers
660 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
4
votes
1answer
251 views

Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...
2
votes
0answers
40 views

Will length-extension work if secret is not prefixed but appended to the data? [duplicate]

Possible Duplicate: Why is h(m||k) insecure? Length-extension allows to append any data to the message while not knowing the secret. Any length-extension explaination one the web considers ...
2
votes
2answers
892 views

Do known-plaintext attacks exist for public key encryption?

In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of ...
5
votes
1answer
426 views

HMAC for short messages

I am using HMAC (hmac-sha256 to be precise) message authentication without encryption. My question is, is having a short message make it easy to determine what my secret key is? My C# code is as ...
1
vote
1answer
129 views

Needing to encrypt plain sight information

Okay here are my requirements. I need a solution that can do the following. Lets say I have an encrypted piece of text with the value "20". and I have UserA and UserB I give UserA the Keys (/5 and ...
2
votes
1answer
135 views

What's the strategy for future directions in cryptography? Bigger numbers/faster searching, or new methods, say, of factoring?

I'm taking a course in cryptography, and I would value any comments. This is not too technical a question, but more about directions or strategy in cryptography. My question is, is public key ...
11
votes
2answers
3k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
5
votes
1answer
378 views

DES key expansion: why are these two descriptions different?

I would like someone to explain me how to generate DES subkeys, because in the documentation that I saw, sometimes they say: "We rotate the initial key according to the number of iterations given ...
8
votes
2answers
2k views

Should I salt an AES password at each encryption?

I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message. I don't understand ...
2
votes
0answers
475 views

Determining the algorithm used to generate a digital signature

I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature. From the signed string, is it possible to find out what ...
4
votes
2answers
2k views

Difference between symmetric and asymmetric hash function?

The Linux kernel supports symmetric and asymmetric hash functions. E.g. sha1, sha256, ... See tcrypt.c and search for test_hash_speed and ...
2
votes
1answer
288 views

Choosing good parameter for Lenstra's elliptic curve factorization

In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
2
votes
3answers
149 views

Public keys and their protocols

I'm having difficulties understanding exactly what this protocol means: $S \to D : \{N_S , S\}K_D$ $D \to S : \{N_S , N_D \}K_S$ $S \to D : \{N_D \}K_D$ "where $S$ represents the supervisor’s ...
4
votes
1answer
192 views

Future-Proof Versioning and Validation

I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password. The encrypted ...
2
votes
1answer
9k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
2
votes
2answers
176 views

What are the cryptographic assumptions in the Dolev Yao model?

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox. Does blackbox here mean that the primitive is to be considered CPA ...
1
vote
1answer
289 views

Can Add and Multiply On Cipher Text achieve all operations?

A Fully homomorphic encryption scheme needs to support an evaluate function that can do add and multiply operations on cipher text. Can we do all kinds of complex operations on cipher text like ...
4
votes
1answer
555 views

Blind quantum computing and fully homomorphic encryption

I am somewhat familiar with current research on fully homomorphic enryption schemes and their possible application to Cloud computing. I've just noticed (somewhat late) that a marketing-savvy group ...
24
votes
4answers
19k views

Best way to reduce chance of hash collisions: Multiple hashes, or larger hash?

I would like to maintain a list of unique data blocks (up to 1MiB in size), using the SHA-256 hash of the block as the key in the index. Obviously there is a chance of hash collisions, so what is the ...
3
votes
2answers
178 views

Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
2
votes
3answers
3k views

AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same. In the CBC mode the person who performs the encryption is the one who provides the ...
7
votes
4answers
3k views
1
vote
1answer
172 views

What would the Internet be like without public-key cryptography?

The functioning of the Internet as we know it nowadays depends very heavily on public-key cryptography, including several key root systems that depend on its asymmetric properties. But what would it ...
0
votes
1answer
842 views

True 128bit secured password length?

assume we say 128bit keys are secure so a 16 character long password is safe, but if i even use lower case and upper case letters with numbers and special characters on my keyboard its about 80 ...
0
votes
1answer
115 views

AES 128bit round level recommendation

we don't want change standard just after every attack, now for AES 128bit blocks i think 16 round is secure, but what is best round amount ? we had attack for 7 round then 10 round and it going so on ...
0
votes
1answer
1k views

Why the following attack in common modulus RSA works?

Suppose that i share a common modulus $N$ with two users $u_1$ and $u_2$ with public, secret keys ($e_a,d_a$), ($e_b,d_b$). Why then $gcd(V,e_b)=1$ where $V=d_a*e_a-1/$W and $W=gcd(e_b,d_a*e_a-1)$ ...
3
votes
1answer
183 views

Does zero-padding the secret in Shamir's sharing scheme increase security?

When performed in binary Galois fields $GF_{2^n}$, Shamir's threshold secret sharing scheme produces shares that are each the same bit-size as the secret. Though the scheme is "perfectly secure" in ...
1
vote
2answers
2k views

Double Encrypting with two different keys

In terms of security, would it be MORE or LESS secure to take, say, an RC4 output (or Serpent) or other, that is encrypted with one key, and to encrypt that output with AES (using a different key)? ...
1
vote
2answers
149 views

What is an easy method of proving that a cryptographic oracle attack is possible?

Lets say an application is using CBC mode without authentication. The application is generating cipher text. This cipher text can be manipulated by the attacker and then transmitted back to the ...
-1
votes
1answer
67 views

construct an election protocol for the following election problem..? [closed]

I am something new to election protocols and I am trying to construct an election protocol for the following problem: Let $A= \lbrace a_{1} , . . . , a_{n} \rbrace $ and $B = \lbrace b_{1} , . . . , ...
2
votes
1answer
666 views

Proving that a scheme is not IND-CPA-secure

Suppose I want to prove that a given symmetric encryption scheme is not IND-CPA secure. The first thing I do is to define a specific adversary that attacks the scheme. How can I proof neatly, (using ...
1
vote
0answers
56 views

P-Complete hashes, hashing to a larger set

Historically hashes have been from a large set (say 256 characters) to a smaller set (256 bits). Also, hash functions that are P-complete have no known parallel algorithm; they must be computed ...
3
votes
1answer
277 views

Is there a field guide to ECC for the IT Security layman?

I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
2
votes
1answer
9k views

AES vs Blowfish taking key-length into account

I understand that Blowfish is getting old, but is still a secure algorithm, and that AES is very popular, and is recommended by most people. My question is, how do the two compare when a 256-bit key ...
2
votes
1answer
3k views

AES key length greater than 256 bits - is it dangerous to do an implementation outside of the standard?

I'm making a digital-asset manager written in ActionScript 3, it will be used to manage highly sensitive information. I'm using the AS3Crypto library (which has quite a good reputation) to implement ...
1
vote
1answer
90 views

tower of extension field

while working on tate pairing, i have to implement towering technique. like i have point p on F(q) and point Q(F(q^k)) (here embedding degree k=12 for BN curve). instead of taking a point Q on ...
3
votes
1answer
796 views

How to generate a public key from a private ECDSA key?

Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it.
1
vote
1answer
86 views

Tweaking textbook RSA to make the encryption a Pseudorandom function

Lets say I want to tweak/alter the textbook RSA encryption function to create a pseudorandom function by pre-processing the input. Suppose I do something simple like add 2 to the input before ...
4
votes
1answer
234 views

Using chi square for distinguishing between compressed and random data

I am trying to find some measurement for identifying and distinguishing between compressed and random data. I tried this first by computing the entropy of such data, the entropy value is extremely ...
1
vote
0answers
55 views

Generating Polynomials for the MPQS

I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS. I'm a bit confused as to how the MPQS works, which is ...
8
votes
2answers
829 views

Why is h(m||k) insecure?

Here is the post that explains the failure for doing h(k||m) and I understand it. But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
3
votes
2answers
221 views

Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ ...
2
votes
1answer
91 views

Individual bits of Textbook RSA

This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem. Does RSA hide all ...
3
votes
1answer
255 views

A question regarding relevance of vulnerability of MD5 when linking multiple records together

I have been studying a Supreme Court case "IMS Health vs Sorrel". In this case a Friend of Court brief filled by "Electronic Privacy Information Center" states that use of MD5 hash function to link ...
3
votes
3answers
196 views

Can the encryption exponent e be greater than ϕ(N)?

So I was just wondering in RSA, can the encryption exponent e be greater than ϕ(N)?? For an examples sake, lets just say N = 707, so p = 101 & q = 7. So, we have ϕ(707) = 600. Can I have e = ...

15 30 50 per page