34
votes
1answer
8k views

No SHA-1 collision? Yet SHA-1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA-1(A) == SHA-1(B)? If the answer is no than how can SHA-1 be considered broken?
4
votes
2answers
154 views

Why verify padding at all?

Whenever a ciphertext is decrypted using a block-cypher, we need to remove the padding. There are different ways to add padding, but they usually set the last byte of the last block to the number of ...
2
votes
0answers
110 views

Does the initial exchange of random tokens in SKID3 authentication assure against replay attacks?

As the question suggests, I wanted to get a sanity-check on this issue... is it the case that the use of a random token exchange during SKID3 authentication itself constitute a prevention of a replay ...
2
votes
2answers
490 views

Breaking Double Encryption

I am trying to understand how an attacker knows when he has successfully decrypted a ciphertext for an assignment. As such, some pointers/hints for the following questions would be greatly appreciated....
4
votes
1answer
1k views

What are options to compute DES retail MAC (aka ISO 9797-1 mode 3) under PKCS#11?

The DES retail MAC, also known as ISO 9797-1 mode 3 with DES, computes the MAC of a block of data using a 16-byte (112 bit) key. It can be seen as CBC-MAC using simple DES with the first half of the ...
20
votes
7answers
7k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
2
votes
1answer
131 views

Generating S boxes that satisfy Coppersmith's criteria?

I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts: How many such S-Boxes are possible? Is there any ...
2
votes
1answer
338 views

Is this correct way to generate stream cipher using AES CTR mode?

We are implementing searchable encryption techniques proposed by Song et al in Java for a paper[1]. The schemes need a Stream Cipher for achieving search over encrypted data. The stream of random bits ...
3
votes
1answer
198 views

Which public key encryption scheme is re-randomizable? How can I re-randomize an encryption scheme?

Which public key encryption scheme is re-randomizable? Is there any library for re-randomizable encryption scheme? If not, how can I re-randomize a given public key encryption scheme? I cannot find ...
1
vote
0answers
445 views

DES S-Box properties

Two of the properties that lead to the design of DES S-Boxes are: 1)For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result ...
5
votes
4answers
8k views

How does one calculate the scalar multiplication on elliptic curves?

I found this example online: In the elliptic curve group defined by $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$ what is the discrete logarithm $k$ of $Q = (4,5)$ to the base $...
3
votes
1answer
692 views

Why does FIPS 186-4 require specific sizes for keys?

In FIPS 186-4, page 32, about FFC crypto it is required that the length of $p$ will be exactly 1024 bit and the length of $q$ will be exactly 160 bit. Why is the requirement not stated in terms of ...
0
votes
1answer
89 views

What does $\to$ mean in the following definition of a block cipher?

In the following picture $\kappa$ is the key length and $n$ is the block size. I understand that $\{0,1\}^\kappa$ means all possible combination of keys and $\{0,1\}^n$ means all possible combination ...
2
votes
1answer
164 views

Bit padding instead of PKCS#5 padding

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
3
votes
1answer
121 views

What's causing the poor randomness in this program: the LCG, or the program logic itself?

(Crypto Gods, I should begin by stressing that I haven't lost my mind: I'm not doing this in real life, I'm just trying to understand the theory behind what's happening. With your help, hopefully I ...
2
votes
2answers
790 views

Can I crack an AES string if I have all these parameters?

This is for a challenge at followthewhiterabbit.trustpilot.com: Knowns: The algorithm is AES (Rijndael) Blocksize: 128 Keysize: 256 You only need to find the first 6 bytes of the ...
1
vote
1answer
152 views

What is the most secure key expansion routine?

I am looking at G now, but is there a better, (in terms of security and speed), means by which a byte array can be expanded that doesn't involve another cipher, just a simple algorithm? I need to ...
1
vote
1answer
140 views

Privacy-Preserving relational databases: checking the existence of a record (or multiple records)

I would like to know if there exists a protocol which performs the following operation in a privacy-preserving fashion: User $U$ wants to know whether a record is stored in the database. The primary ...
-1
votes
1answer
163 views

Base64 for a hash algorithm [closed]

May be a silly question, but I am really curious. If a hash algorithm uses Base64 in the process of hashing a string for example, it is still considered a hash algorithm, even though it uses an ...
2
votes
0answers
77 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
1answer
176 views

Hill Cipher question

Recently, I was given three ciphers to crack for my cryptography class. At this point, I have guessed that one of them is likely a Hill cipher (probably 3x3, as that is the most complex we have done ...
2
votes
1answer
184 views

Can Bitcoin HD public keys be used for symmetric encryption?

I asked this at bitcoin.stackexchange.com first, but it seems that this is more of a crypto-question anyway. I'm interested in using a Hierarchical Deterministic Bitcoin wallet branch as a "shared ...
10
votes
1answer
501 views

Shared secret: Generating Random Permutation

-- or: How to Play Poker Without a Dealer I know this question is long but it's a really interesting theoretical problem about shared secrets and multi-party computation. General Problem: "Shared ...
5
votes
1answer
347 views

Is it possible to generate a secure permutation F over 32-bit integers even if F(0) … F(n) is public knowledge?

I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ...
7
votes
3answers
2k views

Change Salt when Changing Password?

Assume a password storage scheme using a computationally-expensive hash algorithm and a CSPRNG salt. User ID, salt, and hash value are stored in a table; if the table is compromised, all three ...
10
votes
1answer
1k views

Using SHA-256 with different initial hash value

FIPS 180-3 defines the initial hash value for SHA-256 as the first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19. What would be the risks of using a different value (...
7
votes
3answers
666 views

Is there some way to generate a non-predictable random number in a decentralised network?

Is there a way to generate a random number with given restrictions: It will be used in a decentralised network with a big number of peers (no central authority to generate it) Its generation should ...
5
votes
1answer
605 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
2
votes
1answer
324 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to another?...
10
votes
2answers
4k views

How can I calculate the SHA-256 “midstate”?

Recently I've been trying to implement some Bitcoin-related code, and I've stumbled upon a weird concept, a SHA-256 "midstate". Some explanation is given here. The general concept is that Bitcoin ...
3
votes
1answer
328 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
5
votes
1answer
676 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
10
votes
3answers
684 views

Bitcoin Research

I have recently been assigned to advise a student on a senior thesis in math. She has taken linear algebra, introductory real analysis, basic cryptography, and abstract algebra. Her interest is in ...
1
vote
1answer
118 views

Timestamping using a hashed linked list and public known events

Let's say we have a timestamping scheme of the following characteristics, The hashes of the documents we are trying to timestamp are XOR'ed with "events" whose time of occurrence are very publicly ...
-1
votes
1answer
159 views

Burn after read algorythm. Software verification on compromised environment. Software smart card

Please help me pick right design of software… I have to design client-server software, where the server should verify that the client runs software from specific source code. It has to be verifiable ...
3
votes
1answer
83 views

Is using SHA256 to extract entropy from a p-rand nonce a good way to create keying material?

Using $SHA256(N)$, where $N$ is 64 bytes of output from the Microsoft Windows CryptGenRandom function. Are there any known vulnerabilities with using this method to ...
2
votes
2answers
231 views

Would xoring 2 independant AES CTRs to produce p-rand introduce vulnerabilities?

Assuming $$AES_{k_1}(C_1) \oplus AES_{k_2}(C_2)$$ where AES is used in CTR mode, $C$ is a 128 bit incrementing counter, keys and counters for both transforms are random as well as unique, and the ...
0
votes
1answer
182 views

Proof for composed signatures

Assumes that we have 3 signature algorithms, $S^A$ with key pair $(sk^A,pk^A)$, $S^B$ with key pair $(sk^B,pk^B)$,$S^C$ with key pair $(sk^C,pk^C)$. We denote by $\epsilon$, $\epsilon'$ and $\epsilon''...
2
votes
0answers
63 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
1answer
135 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
4
votes
1answer
251 views

Encryption-Decryption-Encryption

I have learned from Applied Cryptography that triple encryption with three independent keys in encryption-decryption-encryption (EDE) process gives security not higher then $2^{2n}$ when it comes to ...
2
votes
1answer
889 views

Entropy of the key

Suppose a $1000$-bit key used in the one-time pad is not randomly and uniformly generated. Suppose that the values of the first $5$ bits are $0$, and the other $995$ bits are randomly generated and ...
4
votes
1answer
93 views

Statistical tests for pseudorandom permutations

I'm implementing a format-preserving encryption scheme similar to those described in the literature. I want to sanity test my PRP using some statistical tests like TestU01. However, I'm not sure how ...
0
votes
1answer
1k views

How is HMAC hashed message decrypted on the receiver side

We know that MAC algorithm and key are used in both sender and receiver side to get the matching MAC tages to prove that the data is authentic. Now in HMAC we know that, it makes use of crytographic ...
3
votes
2answers
509 views

AES-ECB as an authentication mechanism

ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication? Assume A wants to transmit an ...
1
vote
0answers
161 views

Complexity of verifying OTP secret

What is the minimum number of unique pairs of digests and inputs to a one-time pass needed to verify that a secret is equal to a ...
0
votes
0answers
82 views

Advantages of using intermediate hash over full hash in digital signature application

Description of intermediate hashes Intermediate (or partial) hashes are canonical forms of digest state that can be transferred from one hash implementation to another, so that the other, limited ...
7
votes
3answers
535 views

How many bits of hash are realistically needed for key verification?

Say I'm connecting to a web server secured with TLS but with a self-signed certificate. Accordingly, I call the owners of the server and ask them what SHA1 fingerprint they have. They start reading ...
0
votes
1answer
452 views

What is the exact purpose of length padding in Merkle–Damgård hash functions? [duplicate]

Is a length padding technique in a hash function used to avoid length extension attacks ?
1
vote
2answers
473 views

Are SSL/TLS used for maintaining data confidentiality?

In SSL/TLS, we use symmetric and asymmetric keys to encrypt the data. Does that mean that the keys are used to encrypt the data (preserve the integrity) or provide a secure channel for the data to be ...

15 30 50 per page