All Questions

65 views

Factors of the group order to secure against Pohlig-Hellman

I am looking into the security of Diffie-Hellman and the discrete log in general. To make sure an attacker can not use Pohlig-Hellman to solve the discrete log quickly we need to make sure that the ...
139 views

Proving security of TLS handshake with ProVerif

Background For my dissertation I am working on an application protocol for which I require a TLS session. I am looking to achieve Perfect Forward Secrecy, which means I have selected ephemeral ...
102 views

SSL pinning - how to safely hide the certificate?

We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre ...
70 views

ssh-keygen DH Primality Testing

I'm pretty familiar with using ssh-keygen to create groups that go in the /etc/ssh/moduli file for the Diffie-Hellman Group Exchange in openssh. Reading over the man page, it says "By default, each ...
60 views

Encryption algorithms larger than 256 Bit for “big data” encryption?

I'm somewhat new to encryption. When looking at encryption programs for big data, I frequently see a maximum of 256 bits. Why do we generally restrict our (symmetric) keys to 256 bits? Can more ...
48 views

59 views

Execution speed of AES_128 GMAC operation

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
86 views

Converting a pre-image resistant hash to second pre-image resistant

I am looking for some standard conversion from any hash function $f$, which has pre-image resistance, to another hash function with second preimage resistance. Is there such a standard conversion?
170 views

ElGamal and Paillier key sizes for short messages

I am using ElGamal and Paillier schemes to encrypt a large number of short messages: typical 4-byte integers. I do this for the homomorphic properties of these schemes. However, the way the ...
86 views

MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both ...
56 views

Unconditional authentication

I have a few questions regarding universal-hash functions: Is there a way universal hash functions can be used to provide unconditional authentication in the way the OTP provides unconditional ...
83 views

Is it a good practice to use plain text for derivation of Keys?

I have a question regarding the derivation of keys in crypto. Is it a good practice to use the plain text (in form of hashes) for derivation of keys ? these keys will be used for encryption of the ...
51 views

“Order” in cryptographic terms for generators

Frequently I have seen people use the term order in cryptography (the group theoretic one). I have a mathematical background and order (say for prime modulus $p$) is defined as the smallest integer ...
87 views

AES-CBC pre-determined IV vs. null IV

Is there any security advantage to using a pre-determined IV in CBC mode over a null IV? I'm implementing a license key system similar to this article on CodeProject, but I'm confused by the authors ...
64 views

How to compute two EC point multiplication?

I would like to know how to compute multiplication of two valid EC points over a curve E with generator G. i.e. Given only P and Q points then how to compute R = P * Q where $P = p G$, $Q = q G$ and ...
56 views

J-PAKE : About Schnorr NIZK proof for ephemeral private keys

Reading J-PAKE Authenticated Key Exchange Without PKI document : J-PAKE Round 1 : Alice sends out g^x1 and knowledge proof for x1, e.g : To prove the knowledge of the exponent for X = g^x1 ...
49 views

About DH-EKE and ECDHE_PSK (PSK versus Pasword)

I am currently having a look at J-PAKE , so learning about Authenticated Key Exchange : Reading 2.2.2 E.K.E from this paper https://people.kth.se/~maguire/Erik_Ehrlund_Literature_Study_report_v1.2.pdf ...
144 views

SPI security of FE1 scheme

I have a question about security of FE1(Page 16-18) in paper "format preserving encryption". Can anyone explain me, why we are allowed to replace PRF with random function in security proof? And also, ...
170 views

Calculating Multiplicative Inverse for Rijndael S-box using EEA

I am currently learning, and I'm stuck on something that I thought is very simple. On many academic sources they suggest using Extended Euclidean Algorithm to calculate the multiplicative inverse for ...
42 views

Question on Miller's algorithm (change the input m)

From the book titled " An Introduction to Mathematical Cryptography" (Chapter 5,page 322), we know that the miller's algorithm returns a function $f_P$ whose divisor satisfies div(f_P) ...
64 views

Does anyone still use BAN or GNY logic in practice?

I want to implement a simple protocol, and I'd like to verify it through BAN or GNY logic. I would assume that if these logics are still used that there would be some programs available that would ...
106 views

Pseudo Random Function

The definition of pseudo randomness that leads to pseudo random function talks about indistingishability of a key-ed function and a random function. i.e. The key-ed function family $\{F_k\}$ is PRF ...
97 views

Is this client-side password hash scheme secure?

I want to build an app that uses client-side encryption for storing encrypted data on the server. A user-specific master key would be used, so to easily share it between devices a encrypted version of ...
46 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
112 views

Can I use HKDF to improve security of HMAC used with weak hash function?

I am writing a framework which encrypts/decrypts files (or streams, in general) with symmetric key using block cipher (for example, AES). To authenticate encrypted file, I use HMAC, which is ...
186 views

Derive cipher IV and cipher Key using PBKDF2 with random salt?

It is said that cipher IV does not have to be secret and the only secret component of the encryption scheme should be a cipher key. Question: is it safe to generate IV using PBKDF2 function, which ...
109 views

How is wpa2 authentication structured

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to ...
57 views

Determine if encryption is safe against CPA

The following encryption scheme encrypts each block of length $n$ of the plaintext separately: $c_i = k_1 \oplus F(k_2 \oplus p_i)$ Where $F$ is a strong pseudo-random permutation (i.e. it is easy ...
129 views

Session key Exchange, some doubt

I have to find a solution to this problem: I have a network composed by 1 server and some client. The server has a couple of keys (public and private) and it shares a secret key with each client. My ...
65 views

Period of pseudo random sequence generated from (5, 2, 0) LFSR

I was reading about the Linear Feedback Shift Registers and I am confused about the technique to find the period of a primitive polynomial. Consider the polynomial $x^5 + x^2 + 1$. As this is a ...
190 views

Why does rsyncrypto require a public key during decryption?

I recently came across a project called rsyncrypto that sacrifices some security so that you can have rsync-friendly files. My understanding is that it works by generating a symmetric key for each ...
216 views

Supersingular Isogeny Key Exchange Software [closed]

Are there any optimised implementations of the Supersingular Isogeny Key Exchange by Defeo, Jao, and Plut. It seems like this would be a great drop-in replacement for Diffie-Hellman in both OpenSSL ...
71 views

Distinguishing between two probabilities and the uniform probability

Say I have a polynomial adversary $A$ that can distinguish with a non-negligible adventage between $x$ generated from a probability $X$ and $y$ generated from a probability $Y$. Obviously, this ...
32 views

Why does P1363 require RW signature with $0 ≤ s < n/2$?

I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs. P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45: ...
81 views

Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
73 views

What is meant by - computational complexity $2^x$?

Recently Bi-clique Cryptanalysis allowed to obtain following results on full AES ES that claim to have The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$ The ...
91 views

Correctness in Multi-party Computation: Real/Ideal Paradigm in Malicious case

I need to know: 1- What does exactly correctness mean in this context? 2- How is correctness implied in malicious model? 3- If the correctness means " the adversary cannot cause the output to be ...
64 views

Differences between HMAC and HKDF in a specific case

I want to use a key derivation function to derive a key to another one. I think HKDF is the easiest solution in my case. The following picture gives a clear definition of it : ...
245 views

About Primitive roots mod n in Diffie-Hellman [duplicate]

I'm on the study of Diffie-Hellman and its related math (multiplicative group of integers $\mod n$). In some crypto papers and documents I've read that $g$ needs to be a primitive root mod $n$ ($g$ ...
138 views

Finding public exponent e

I'm trying to create an algorithm to find the public exponent e given a plain (non-CRT) private key that doesn't include the public exponent, i.e. I've only got $n$ and $d$. A question has already ...
80 views

HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
41 views

Can a TLS client perform any DH regeneration?

I have only the barest understanding of cryptography, but I've been following the Logjam issue; some posts and articles (elsewhere) imply that a client can regenerate DH keys. Is Logjam solely a ...
70 views

one-way deterministic hash for low entropy input?

My problem is the following: we have a low entropy data called ID. (personal id number of 10 decimal digits plus a sum, and it contains a date) We want to create a data (H) which is the same for the ...