# All Questions

1k views

### Encrypt-then-MAC Confidentiality, Integrity and Authenticity

Does Encrypt-then-MAC provide equal confidentiality, integrity and authenticity as other constructs such as EAX? If yes, how do I go about using it? My current understanding is: E = ...
168 views

### Generating non-repeating N-bit IVs, which are indistinguishable from randomness

I'm implementing a protocol which needs a 64-bit IV for every encrypted packet. The cipher in use (AES-GCM, more or less as specified in RFC 4106) does not require that these IVs are random, only ...
3k views

### How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
179 views

### When is an asymmetric scheme considered broken?

Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key: An asymmetric encryption scheme is considered to be broken ...
182 views

Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2? (Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = ... 1answer 993 views ### Why choose an authenticated encryption mode instead of a separate MAC? What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ... 3answers 261 views ### SIM security for two messages Here SIM means the simulation based security Consider a two message encryption scheme:$$Enc:K \times M \times M \rightarrow C \times C$$ and$Enc(K, m, m')=(K \oplus m, K \oplus m')$, In ... 3answers 2k views ### At the current time, is SHA256 the de facto standard for strong cryptographic hashes? At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ... 1answer 156 views ### Signature scheme with two private keys, neither derivable from the other Is there any scheme, ideally one widely used or at least widely available, where you can treat both the signing and verifying keys as secret? Basically, the functionality I'm looking for is this: ... 2answers 2k views ### How exactly would someone crack a private key passphrase? [closed] Lets say for a PGP/GPG pair with a passphrase. 1answer 211 views ### A set of key pairs and one hash to secure them I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ... 2answers 291 views ### If Bob steals Alice's private key, how exactly would he read her encrypted documents? So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files? What I am reading is that no he does not need it but as far ... 3answers 2k views ### Hashing or encrypting twice to increase security? Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ... 1answer 329 views ### How exactly would someone attempt to analyse ciphertext produced by popular encryption products such as Truecrypt/PGP? I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented ... 3answers 1k views ### How does one scale encryption strength upwards from 256-bit? I have seen many examples of encryption up to about 256-bit. But how does one programmatically scale the logic upwards in a language such as PHP or Java to say 1024-bit or even 4096-bit and higher? ... 1answer 315 views ### How did the Koblitz/Menezes papers affect the cryptography community? Two highly-critical papers by Koblitz and Menezes (two well-regarded mathematicians who've contributed to the crypto community) were published years ago: Another Look at “Provable Security” in 2004, ... 3answers 318 views ### Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such? Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ... 2answers 466 views ### Why use a 1-2 Oblivious Transfer instead of a 1 out of n Oblivious Transfer? When initiating an oblivious transfer, why would someone use a 1-2 oblivious transfer rather than going for an 1 out of n oblivious transfer? Perhaps a slight time overhead for the extra message ... 4answers 909 views ### Can an Enigma-style cipher of sufficient complexity be considered secure in today's world? Regarding the German Enigma machines, if I recall correctly, the reason they were defeated was because the Allies were able to generate a massive database of possible rotor settings, and because the ... 1answer 743 views ### Need an introduction to SPKI (or “SPKI for dummies”) I am familiar with concepts such as the following: PKI and CAs ID based cryptography Certificateless cryptography PGP web of trust more or less anything in basic Crypto that is taught in a college ... 2answers 909 views ### Can a computationally unbounded adversary break any public-key encryption scheme? Assume there is a public-key encryption scheme$(KeyGen, Enc, Dec)$with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have$Dec_{SK}(Enc_{PK}(M))=M$). Will there ... 4answers 1k views ### Webapp password storage: Salting a hash vs multiple hashes? For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ... 1answer 696 views ### Implementation of Tao Xie and Denguo Feng's MD5 attack It is well known that MD5 is completely broken today - however, to understand the theory behind the attacks I am looking for an implementation of the collision attacks described in the 2009 paper A ... 1answer 463 views ### What is the best method to determine the language used in a monoalphabetic substitution cipher? Working on a cipher (which I assume to be a mono-alphabetic substitution cipher due to the letter frequency) I struggle with the fact that I don't know which language the plain text is written in. ... 3answers 767 views ### Converting a stream cipher into a block cipher The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ... 2answers 2k views ### How do I apply differential cryptanalysis to a block cipher? I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis. I ... 2answers 203 views ### Background for modular arithmetic function I'm investigating this function:$a := ((b\cdot c) \bmod k) - (b \cdot c)/k$where$/$indicates integer division. Two things I've noticed: It's equivalent to multiplying a·b, and then ... 2answers 337 views ### Analysis of Repeatedly Enciphered Plaintext using Same Algorithm / Key Please forgive the impracticality of this question, but I'm curious about the behaviors of encryption algorithms applied to their own output. Suppose I have an encryption algorithm E and (using the ... 3answers 728 views ### UMAC: to what extent is it in use today? Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ... 1answer 168 views ### Is a changing public truecrypt container secure? I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with). If I used Dropbox for synchronisation and someone downloaded ... 1answer 290 views ### How is the MJH double-block-length hash function constructed? I'm looking for information on the MJH double-block-length hash function, but the best free source I could find is the diagram on page 18 of Efficient hashing using the AES Instruction Set (submitted ... 5answers 679 views ### How do I construct a 256-bit hash function from 128-bit AES? I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher? 4answers 13k views ### Basic explanation of Elliptic Curve Cryptography? I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ... 1answer 785 views ### Digital Signature Algorithm signature creation I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for ... 3answers 771 views ### ANSI X9.31: the purpose of the date/time vector in the PRNG? What is the exact purpose of the date/time vector$dt\$ in the ANSI X9.31 PRNG? $$I := E_K(dt)$$ $$R := E_K(I \oplus V_{old})$$ $$V_{new} := E_K(R \oplus I)$$ Specifically, the document seems ...
3k views

My application can authenticate via openid and oauth (facebook, twitter, etc) and also with its own authentication system. I previously switched hashing from MD5 to SHA1 and during migration I had to ...
627 views

### KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
137 views

### How to collect, process, and transmit data securely?

In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
270 views

### If a cryptanalytic breakthrough is made, what process should be followed?

If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do? Has this ever happened before? What are the implications for ...
442 views

### Does MD5 generate 128 independent bits?

I heard that there are 128 stochastically independent bits in an MD5 output. Is that true? If so, are there any citations or proofs for that?
197 views

### How are constructs with data-dependent swaps and rotations cryptanalyzed?

Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the ...
1k views

### Dictionary attack on pass-phrases on common algorithms

I don't yet perfectly understand the difference between brute-force and dictionary attack since this differentiates one attacking the key and another attacking password: apparently attacking passwords ...
1k views

### Is HTTPS secure if someone snoops the initial handshake?

Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
2k views

### Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
1k views

### Any good file format alternative to PGP for encrypting data at rest?

I'd like to create an encrypted file that: Can be decrypted on a variety of platforms (mainly Windows, OS X, and Linux) with knowledge of the key. Can be decrypted with existing tools (perhaps ...
148 views

### Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
932 views

### How can my application make sure the right symmetric key is used for decryption?

I am developing an Encryption/Decryption Utility using Adobe AIR. I have chosen the AES algorithm and currently use the as3crypto library for this. My query is in ...
3k views

### What is a white-box implementation of a cryptographic algorithm?

What is a white-box implementation? Does a white-box implementation have specific properties?