1
vote
1answer
587 views

Precisely how does CBC mode use the initialization vector? [duplicate]

As I understand it, AES in CBC mode does an XOR of the 128-bit initialization vector and the first 128 bits of plain text. Is this correct? I am using the PHP 5.3 openssl extension in aes-256-cbc ...
1
vote
1answer
27 views

Diffie-Hellman in the wild

Say we have a public network and lots of peers. Each may need to communicate with another peer. Would there be any huge security issue to each peer making the the public part of their key openly ...
1
vote
2answers
115 views

Perfect secrecy with n-time key

How can you encrypt $n$ messages with the same key, and have the same theoretical security you'd have encrypting a single message with a one time pad? For example, how can you encrypt two messages ...
1
vote
1answer
127 views

Padding size with a CBC Block cipher in TLS

I'm currently looking at an encrypted Client Finished message in Wireshark from a TLS session. The cipher suite that was agreed on in previous messages was ...
1
vote
1answer
123 views

Knowing that $G(s)$ is a PRG, is the following construction $G'(s) = G(s||0)$ a PRG?

I know there already is a very similar question. However, I can't understand why $G'(s)$ is not a PRG. If $G(s)$ is a PRG, then why $G(s||0)$ can't also be a PRG? How can the distribution over ...
1
vote
1answer
60 views

Certificate for the public key

I am new to Network Security and learning about various security features like Diffie-Helmann and others. I understand that the Public key send by the server to the client needs to certified that it ...
1
vote
1answer
110 views

Is one-time-pad still secure if the number of 1's in the key is revealed to the attacker?

For example, if $m = 10011$, $k = 11001$, $n=3$ (which is the number of 1's in k), $c = m \oplus k = 01010$. If $c$ and $n$ are revealed to the attacker, is this scheme still secure?
1
vote
1answer
503 views

Suggestion : CRC vs SHA1

I need some suggestions about the use of the CRC in my application. I need to be sure about the BIOS run by the CPU. I have a FPGA between the BIOS flash and the CPU that sniff every read performed by ...
1
vote
1answer
216 views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication ...
1
vote
1answer
315 views

Why is the public/private key length used in libsodium so much shorter than needed for RSA [duplicate]

Reading the libsodium source I see that is uses a key length of 32 bytes (256 bit) for private/public key encryption. For RSA private/public key encryption a key length of 2048 (or 4095) bit is ...
1
vote
1answer
288 views

Discrete Logarithm (512 bits numbers) - Find exponent parameter

I'm trying to resolve a discrete logarithm equation: $$y = g^x \bmod p$$ Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know ...
1
vote
2answers
54 views

Definition of indistinguishable schemes

Let $\mathsf{Exp}_{A,\Pi}(\lambda)$ be some indistinguishability experiment that finally outputs 1 if A outputs $b'$ that satisfies $b' = b$, otherwise 0. Then the textbooks often define the security ...
1
vote
2answers
3k views

simple algorithm to encrypt/decrypt a text file

I need to write a first program in one language that saves data in a text file, and write a second program in a second language to decrypt that file. The two languages in question don't include any ...
1
vote
1answer
146 views

Is it OK to encode data using key equal to data

For some project, I need to store some short string in encrypted form. It would be ideal for the current purposes to encrypt it using itself. ...
1
vote
1answer
751 views

Advantages/Disadvantages of Bcrypt vs. hash/salt

I have an application that I use sha3-512 to hash my password with a randomly generated 64 characters salt for each password. Is it bad to use this method to store passwords? I know many people ...
1
vote
1answer
102 views

Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says,given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
1
vote
1answer
51 views

Winternitz Signature Scheme Verfication

I am reading page 39 in this "Post Quantum Cryptography" book. Why does equation 15 hold? There is no further knowledge about f and you definitely cannot use any power laws. So, why is ...
1
vote
1answer
640 views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
1
vote
1answer
81 views

Is there a tangible benefit in keeping the number of PBKDF iterations secret and not storing them with the ciphertext?

Suppose I have a local file and it is encrypted with a symmetric key derived from a strong passphrase, unique salt and $x$ number of PBKDF (e.g. Scrypt) iterations. I am interested in keeping this ...
1
vote
3answers
137 views

Is what i'm trying to do safe?

What both parties have: Server Master Secret (MS) Server supported versions (Svers) Agreed upon version (ver) Client Master Secret (MS) Client supported versions (Cvers) Agreed upon version (Ver) ...
1
vote
3answers
108 views

with RSA encryption, how do I find the md5sum of the private key from the public key?

This is a purely mathematical question on RSA encryption. Having $e$ as the public key exponent and $n$ the modulus of a public key. Can I recover the md5sum of the private key $d$ (inverse of $d$ ...
1
vote
1answer
79 views

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process trasform a message in a curve point? To sign a transaction (message) in Bitcoin system, you need to encode ...
1
vote
1answer
190 views

Clefia Vs AES 128 bit

I am running a comparison between Clefia (Lightweight cipher from Sony Corporation which is a standard now http://www.sony.net/Products/cryptography/clefia/standard/index.html) and AES 128 bit. The ...
1
vote
2answers
252 views

Why are there no OTP ciphers?

We all know the OTP is unbreakable and we all love the OTP (judging by the amount of question on this site). The strength of the OTP is not that it is unable to find a word without the key but you ...
1
vote
2answers
85 views

Is a padding oracle attack possible if data is only encrypted internally on a server (e.g. for storage)?

I read something about the padding oracle attack when analysing the use of an AES-encryption of data in a database and was "scared" it could be a serious issue. But after investigating a bit further, ...
1
vote
1answer
152 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
1
vote
1answer
79 views

Can a cryptographic hash be used as a cryptographic RNG?

Say I roll a six sided die 200 times (6^200 = ~2^517) and string all the results together into a long string of numbers and hash then result with SHA-512. Can I use that result for cryptographic ...
1
vote
1answer
719 views

Common Modulus Attack in RSA

Consider the following scenario: The Information Security Department (ISD) of an organization issues each of the organization's employees, domestic and abroad, with an individual RSA key. To simplify ...
1
vote
1answer
162 views

Benefit of using random key in Shamir's Secret Sharing

I am implementing Shamir's Secret Sharing, and I find that in (t,n)-threshold scheme, the shares are just using 1,2,3...,n as the key to form the shares ...
1
vote
3answers
88 views

Why do we get the following equation in case of a One Time Pad?

If m: message, M: message space, k: key, K: keyspace, c: cipher, C: cipher space and $E_k$: encryption function, such that $E_k(m) = c,\ m,m^* \in M,\ k\in K,\ c\in C.$ My first question is, is the ...
1
vote
1answer
119 views

algebraic attacks for mixed operations (mod 2 and mod 256) [closed]

If a cipher has mixed operations, e.g $\oplus$ (addition mod $2$), and addition modulo $2^8$. How we we going to express them mathematically? Thanks in advance!
1
vote
1answer
367 views

Creating a random password based off of a prime number

So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a ...
1
vote
1answer
98 views

Common reference string in NIZK

I want to ask that does the common reference string in NIZK have to be random? Or can it be anything?
1
vote
1answer
86 views

Are there any valid, and person readable, checksums possible?

We've been trying to produce a valid, and pretty, MD5. Something that has repeating digits, or spells a word, or something. It's probably more difficult than spelling out the dictionary on a ...
1
vote
1answer
81 views

What does invertibility of the cryptographic primitive mean?

source: http://www.cosic.esat.kuleuven.be/publications/thesis-152.pdf ,page 32 Note that key recovery implies invertibility of the cryptographic primitive (because due to the Kerckhoffs’ ...
1
vote
1answer
89 views

CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.
1
vote
1answer
360 views

What is the most light-weight symmetric cipher thats still usefull?

I need a very light encryption scheme which costs almost no performance during encryption (while decryption may be slow). I found 5 algorithms: RC4, DES, LED, PRESENT, and Piccolo. But how do I ...
1
vote
2answers
143 views

What does variable-base point/scalar multiplication mean in ECC?

I am a bit confuse about the term, variable-base point/scalar multiplication, in Elliptic Curve Cryptography. What I have understood so far. It means that the base or point on EC is variable/unknown. ...
1
vote
1answer
52 views

Is this discrete log generalization a well known cryptographic assumption?

Assume you have a finite group $\mathbb{G}$ and an integer $n$. Given $g_1,\dots,g_n,t$ chosen uniformly from $\mathbb{G}$, consider the problem of finding a vector $(a_1,\dots,a_n)\in \mathbb{Z}^n$ ...
1
vote
3answers
176 views

DH and PKI for KeyExchange

My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. ...
1
vote
1answer
155 views

Is the result of HMAC-sha256 distinguishable from random noise?

Is if the result of HMAC-sha256 distinguishable from random noise? If so, given: a collection of 1000 keys, and 1000 messages of random noise, 100 signed by each of only 10 of those keys Can ...
1
vote
1answer
524 views

Why don't PyCrypto and M2Crypto produce the same result as OpenSSL here (AES-128 ECB)

If I run the following, for openSSL: echo -n "0123456789abcdef0123456789abcdef" | openssl aes-128-ecb -nosalt -nopad | xxd and enter the key "YELLOW SUBMARINE", ...
1
vote
2answers
170 views

Equivalent key size between HMAC and AES?

I have seem comparison between AES and RSA, e.g., AES 128 bit key is equivalent to RSA modulus 3072 bits. Is there such comparison between AES key size and HMAC?
1
vote
2answers
2k views

What is the length field in SHA-512 padding?

If I am using SHA-512 on a message and need to determine the padding field and length field, how do I determine the length field? I think I understand the padding, but not the length field. For ...
1
vote
1answer
123 views

Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts). I do not understand why ...
1
vote
1answer
162 views

Is it a variant of Strong RSA assumption?

Informally, the hardness of RSA/Strong RSA assumption lies in the hardness of factoring a large composite number $N$ having two large primes as its factors. If RSA modulus $N$ is a prime number, then ...
1
vote
2answers
41 views

Combined message separation

I have two ciphertexts, I suppose that its RC4 with reused key. I have XORed both ciphertexts and obtained message containing combined cleartexts. I suppose that the underlaying messages are written ...
1
vote
1answer
67 views

Verifying identity using a sha-1 hash

I was reading http://blog.zorinaq.com/?e=74 which is about a Windows kernel developer. The developer proves that he is an actual developer by posting the SHA1 hash of a particular revision of a file. ...
1
vote
1answer
91 views

How bad would it be to reuse the random blinding factor in a scheme like Paillier?

A secure and somewhat fast way to "re-encrypt" (refresh? anonymise?) a Paillier ciphertext, $c$, is to multiply it by an exponentiated random value: $c \gets c \cdot r^n \mod n^2$ (with $r \in ...
1
vote
1answer
139 views

Hardness of problem related to bilinear pairings

Let $e: \mathbb G_1 \times \mathbb G_1 \rightarrow \mathbb G_T$ be an efficient bilinear pairing. Note that the pairing is symmetric (i.e., Type 1). The problem is, given $g \in \mathbb G_1$ and ...

15 30 50 per page