0
votes
1answer
58 views

What's wrong with an iterative (with counter) hashed salted KDF?

It seems like the brain-dead simplest KDF would have a key-stretching structure that is not substantially different from $\text{hash}(S | P | S | P |\dots|S|P)$, where $S$ is a salt and $P$ is a ...
0
votes
1answer
49 views

Physical entropy source: How many bits entropy per byte is sufficent?

8 bit / byte would be perfect obviously. head -c 1M /dev/urandom | ent gives ~ 7.9998 bits per byte. Now, if I have a physical entropy source, how much entropy ...
0
votes
1answer
43 views

Is randomsound for increasing entropy pool not doing what it is supposed to do?

I am using randomsound because I thought it would be a good idea to inject some additional entropy into the entropy pools of my linux machines (clearly those machines have a corresponding sound card). ...
0
votes
2answers
68 views

Brute Force on Key

If you are brute forcing a key and trying trillions of combos, how will you know when you accidentally hit the right answer? Clearly you can't look at each decoded answer to see which "looks right".
0
votes
1answer
105 views

Advantages/Disadvantages of Bcrypt vs. hash/salt

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people ...
0
votes
1answer
46 views

Can Hill Chipher be considered as Asymmetric?

I know hill chipher is a block chipher ,We produce decryption key by inverse of key matirx but we still use different key for decryption. Therefore Can we say that Hill chipher is asymmetric chipher? ...
0
votes
1answer
53 views

Shamir secret sharing with field 2^8

I want to split a message using Shamir's Secret Sharing by splitting each byte of it so the field I'm using is $2^8$. Assume $(2,2)$ scheme, i.e., splitting it into $2$ shares and both of them are ...
0
votes
1answer
92 views

Is this adaptation of one-time-pad still secure?

Having shared a pad of length double the length of your anticipated message, splitting it into x and y. Then using x to encrypt the message, and using y twice to encrypt the next pad, would that be ...
0
votes
2answers
43 views

Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and ...
0
votes
1answer
65 views

What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as: 04:0B:D4:F8:25:88:C5 This serial is listed as the serial for both ...
0
votes
1answer
72 views

Computational indistinguishability with Example

Based on computational indistinguishability definition no PPT algorithm can distinguish $X$ from $Y$, where $X=\{X_n\}_{n \in N}$ and $Y=\{Y_n\}_{n \in N}$ are ensembles of probability ...
0
votes
1answer
86 views

where should private and public keys be stored? [closed]

I am kind of confused whether should a newly generated key pair be stored in a keystore or in just a normal plain text file? From what I read from online source, there are serveral explainations ...
0
votes
3answers
43 views

FIPS 113 Computer Data Authentication

on the NIST website for Message authentication There is a mention of 2 approved algorithms, i am curious about the first one. the link to FIPS 113, Computer Data Authentication appears to be dead ...
0
votes
2answers
111 views

SHA-512 partial preimage

I was looking at how SHA-512 works, and I have a question. Imagine I want an input $N$ of 512 bits whose hash in hexadecimal starts with the digits 12345678. How ...
0
votes
1answer
52 views

Different keys for clients but 1 key on server

Is it possible to have different keys on alot of (embedded) devices and just have 1 key on a server (to witch all these devices connect)? The main point here being when 1 device is compromised this ...
0
votes
2answers
77 views

How is the MAC or HMAC secret shared with the other party for verification?

I've seen people everywhere say to use a MAC or HMAC with block ciphers. I think I understand the basics, but I'm still not sure how the HMAC secret is distributed so the other party can verify that ...
0
votes
2answers
58 views

Length of prime number used in Pedersen Commitment

I am writing a program using a Pedersen commitment scheme and all I'm missing is an appropriate length for my prime $p$. I have heard that a length of $2^{80}$ is ok, is that correct?
0
votes
1answer
50 views

Is $f\colon x\mapsto g(x+1)$ necessarily a pseudorandom function?

Let $l\in\mathbb N$ and suppose $$g\colon\;\{0,1\}^l\to\{0,1\}^l$$ is a pseudorandom function. Is $f$, defined as below, necessarily a pseudorandom function as well? $$f(x)=g((x+1)\bmod2^l)$$
0
votes
1answer
68 views

Altering the message space of Paillier

Is there any obstacle if we restrict in Paillier the plaintext values to be drawn from $\mathbb{Z}_N^*$ instead of $\mathbb{Z}_N$ as the original scheme indicates.
0
votes
1answer
96 views

What is the difference between chosen-plaintext attack and adaptive-chosen-plaintext attack?

I've just dived in cryptography and would like to learn basics of this science. Currently I can't understand the difference between these two types of attacks. As I understood from Bruce Schneier's ...
0
votes
1answer
146 views

Required key size for an ideal cipher with a 32 bit block size

For an ideal block cipher, what size key would be required when the cipher has a 32-bit block size?
0
votes
1answer
59 views

Will there always be 256 collisions for the output of the MD5 hashsum function for 17-byte inputs?

By my math, if you are inputting all possible 17 byte values, and the output is 16 bytes long, then there must always be 256 possible inputs that will result in each output hashsum. However, looking ...
0
votes
1answer
94 views

What makes this mixer function resistant to differential cryptanalysis?

I recently learned how differential cryptanalysis works, and decided to have a play around with testing various designs for resistance against attack. My testing algorithm is essentially to loop ...
0
votes
1answer
52 views

Bit commitment, two blobs with same bit, without revealing it?

Suppose we have bit commitment scheme: $n=p*q$ and $t \in QNR_n$, with Jacobi $(\frac{t}{n})=1$ Commitment(P), random $x\in \mathbb{Z}_n$, $y=x^2t^b$, where $b$ is bit. Ok, suppose we have $y_1$ and ...
0
votes
1answer
110 views

MAC in SSH packet encryption, benefits to not including it?

What are the benefits to not including MAC in a SSH packet encryption? I understand what the MAC is there for, but if it was not included would there be an advantage? Is the MAC somewhat redundant ...
0
votes
1answer
69 views

CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.
0
votes
2answers
88 views

What does variable-base point/scalar multiplication mean in ECC?

I am a bit confuse about the term, variable-base point/scalar multiplication, in Elliptic Curve Cryptography. What I have understood so far. It means that the base or point on EC is variable/unknown. ...
0
votes
1answer
106 views

Multiple keys for the same ciphertext [duplicate]

Say you have a plain text: How are you today? and you encrypt it so it becomes: LKD03Loel03skj1Q03 Now you have multiple people that need to know the plain text of this cipher text but ...
0
votes
1answer
62 views

Text in random image encoder: is it flawed?

I have created a small cryptographic programme: You input your text A random image is generated Random coordinate pairs in number equal to the chars of the message are generated. The red component ...
0
votes
1answer
96 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
0
votes
1answer
54 views

Why is it a quadratic equation?

In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in $\mathbb{Z}_n$ as shown below. But, my idea of quadratic equation was a second order polynomial equation in a ...
0
votes
1answer
88 views

RSA: How effective is this keypair-trash attack [duplicate]

A question that could very well be part of xkcd's "what if?": Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
0
votes
1answer
42 views

With wrong IV at receiver side, the CFB in better than OFB?

Assume the receiver have a wrong IV (initialization vector), in the CFB mode only the first block of plaintext is wrong but in OFB mode the second and all blocks will be affected. Is that correct? ...
0
votes
1answer
65 views

Should the nonce passed to GCM be authenticated?

This answer recommends authenticating the IV with HMAC when using AES and then HMAC. Since AES-GCM provides authentication too, should the external nonce passed to GCM be authenticated separately ...
0
votes
2answers
326 views

Practical Attack on RSA

Currently I am designing an RSA based application, and I am thinking of how long should the key be in order to be secure against attacks. I know that RSA 4096 bit key can be recovered using Sound ...
0
votes
1answer
260 views

Is RSA with SHA1 broken?

I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure? I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?
0
votes
2answers
156 views

What is a good way to demonstrate elliptic curve cryptography?

For school (high school) I am writing an essay on elliptic curve cryptography. The assignment needs to include a practical part, so I decided to write a Python class for elliptic curves. This class is ...
0
votes
2answers
81 views

Is BBS used for generation of keys for any modem cryptosystem?

Is there any (current) cryptosystem or digital signature or cryptographic primitive that uses the BBS PRG in order to generate its secret keys?
0
votes
2answers
116 views

Is the DES F-function injective for a given subkey?

Is it possible for two different half-block inputs to the DES F-function, with the same round subkey, to produce the same output? That is, if we feed two different half-block inputs $b_1$ and $b_2$ ...
0
votes
1answer
88 views

how to represent message as an integer between $1$ and $n-1$ [closed]

I am trying to implement simple El-Gamal cryptosystem. And I can't understand how to represent message as an integer between $1$ and $n-1$. The only thing that comes to my mind is: if $n$ bit length ...
0
votes
1answer
87 views

What happens when cbc+hmac get a replay attack?

If it use AES-CBC and HMAC-SHA256 for message send online, and someone try to replay attack on this message. Can the attack be successful? what will be happen when attacking?
0
votes
1answer
107 views

How does chosen ciphertext attack on Elgamal work?

Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?
0
votes
4answers
130 views

Why do we need to compute message digest of a message first while signing it?

Why it is more efficient to compute a message digest of message and digitally sign it then, rather than sign the message directly?
0
votes
2answers
145 views

Is it possible to decrypt the entire message with one half of the key in this example?

In this scheme, a 256 bit key is split into two 128 bit sub-keys. Message blocks are 256 bits and are also split into two sub-blocks. Before encryption, each sub-block is xor'd with it's partner and ...
0
votes
1answer
246 views

Cracking secret key of a MD5 hash?

I have a MD5 hash which is obtained by hashing certain strings appended by a pipe character ( | ). (I know the values of these) A secret key is added as a suffix to this (I don't know the secret key). ...
0
votes
1answer
87 views

Showing that $2^{N-1}\equiv1\pmod N$ when $N=2^p-1$ for prime $p$

I got this question on a previous exam and I got it wrong. I've gone back through it several times since then, but I can't seem to get it. I would really like to know how to do it, so if someone could ...
0
votes
1answer
97 views

How to figure out the size of the output of a cryptographic checksum function

There is such a putting in Bishop's Introduction to computer security, page 118 as following: Definition 8–2. A cryptographic checksum function (also called a strong hash function or a strong ...
0
votes
2answers
74 views

public key certificate on TLS/SSL

Currently I am working on a public key certificate. I got a question: Why is a public key certificate needed for TLS/SSL? Wouldn't TLS/SSL itself is enough? What is the role of the certificate?
0
votes
1answer
71 views

Encrypt a file for random access but only after an initial read of the whole file

I'm symmetrically encrypting a file (using a random salt and a user supplied password with PKCS5S2, i.e., nothing special) and I need to be able to access it randomly. Therefore I'm using a stream ...
0
votes
2answers
163 views

Does brute force attack use the program that created the ciphertext?

I've read several articles about brute force cryptanalytic attacks, but none explicitly say what algorithm is being run for each attempt, nor what criteria is used to declare an attempt a success or a ...

15 30 50 per page