3
votes
0answers
361 views

Entropy of Androids motion-sensor data

My app on Android uses the built-in motion sensors to collect seed-data for the PRNG (java.security.SecureRandom) that is later to be used for key-generation. The user is told to shake the device so ...
1
vote
2answers
2k views

Is Dropbox's hashing method cryptographically secure?

Dropbox uses CRC32 and md5 to create a checksum of each 4 mb "block" as part of the their compression/file system. I suspect that Dropbox uses an additional cryptographic hash to check if there's a ...
0
votes
1answer
135 views

Prime factors of non-random keys

I have been working on a challenge i found on the internet. It is as follows: You've stumbled onto a significant vulnerability in a commonly used cryptographic library. It turns out that the ...
1
vote
1answer
90 views

Convincing “someone” on the (in)validity of DH tuple without revealing $u,v$

Is there a way of convincing someone on (in)validity of Diffie Hellman tuple $<g, g^u, g^v, g^{w}>$ without giving away $u,v$. or at least solve the Decisional Diffie Hellman Problem without ...
32
votes
2answers
5k views

Why is H(k||x) not a secure MAC construction?

If H(m) is a secure hash function, can't we implement a MAC using H(k||m)? However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
1
vote
1answer
144 views

Is script execution time a decent source of pseudorandom number generation?

This is for a PHP script for password generation. Naturally there are other things being calculated before the password is generated. But I figure the time it takes for the script to initialize and ...
1
vote
0answers
76 views

Why don't we use H(m||k) as a MAC? [duplicate]

HMAC seems a bit complicated. Why can't we use $H(m||k)$ as a MAC? Unlike $H(k||m)$, length extension attacks won't work. Is there some other obvious attack?
5
votes
2answers
1k views

NTRU crypto from unseen.is; myth busting help

I am always on the look out for privacy enhancing technologies. I stumbled upon the service from unseen.is. I had a look at their site (specifically here) and even though I lack knowledge there are a ...
1
vote
1answer
215 views

Can I use asymmetric encryption for more powerful write-protection?

I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I ...
5
votes
2answers
562 views
3
votes
3answers
202 views

Is it meaningful to consider the leakage of master key of KGC?

In the Identity-based cryptography, the user's private key in the systems is delivered by the key generation center(KGC). My question is : Is it meaningful to consider the leakage of master key of ...
4
votes
1answer
2k views

Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
2
votes
2answers
3k views

OpenSSL PBKDF2 documentation

I'm using OpenSSL 0.9.8 on OSX Maverick, and I want to use a PBKDF but I can't find any doc/man about it on OpenSSL's website. I'm working on QCA, an OpenSSL wrapper for Qt, and when I arrived there ...
1
vote
4answers
3k views

How does TLS generate the shared secret?

From many readings, I got to know that TLS generates master shared secrets using pre-master keys and uses the DH algorithm to generate the shared secret/Master secret. What values during the hello ...
2
votes
0answers
67 views

Machine Learning with Encryption [duplicate]

Machine Learning is sometimes associated with cryptography. Many of such cross field studies have been majorly done in use of machine learning for cryptanalysis/decryption. I am interested in knowing ...
2
votes
3answers
338 views

Frequency of letters change by the length of the texts?

In terms of the frequency of letters, how is it possible to have different frequent letters when the length of the text I'm analyzing is shorter? At the moment, I'm comparing the frequencies of a ...
1
vote
1answer
548 views

Check the validity of a rsa key pair with only the public key? [duplicate]

I am currently developing a messaging application that uses rsa end to end encryption. The client generates permanent rsa keys, and sends the public key to my server for account management. As it ...
0
votes
1answer
76 views

If $G'(s)=G(s0^{|s|})$ and $G$ is a PRNG, is $G'$ necessarily a PRNG? [closed]

I argue it is because there should be no more correlation between the outputs $G(s0^{|s|})$ than between the outputs $G(s)$. Thus we can say the $G'(s)$ is a PRNG that satisfies $|G'(s)| \geq 4|s|$. ...
1
vote
1answer
114 views

Which data to share in CTR mode?

Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just ...
-1
votes
2answers
134 views

Need Help Reversing my Encryption Algorithm [closed]

So I wrote a simple encryption algorithm (Not very secure, just a starting point. I don't want criticism on it.) and I have been having trouble finding a way to decrypt the text. The algorithm is here ...
2
votes
0answers
210 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
3
votes
1answer
257 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
3
votes
3answers
15k views

Where i can find an AES implementation in python?

Where i can find a "reviewed" version of AES implementation in python. Not an API like PyCrypto whereby you can call AES algorithms in a single line.
1
vote
0answers
135 views

Determine the iteration times using Pollard's rho Method for factoring

Let's say, we have a large number $n=181937053$ and $f(x)=x^2+1$. And also we know that $n=12391 \times 14683$. The problem is that ,using Pollard rho method, can we find the algorithm iteration ...
5
votes
2answers
2k views

How to calculate the time it'll take to crack RSA or DH?

Sometimes the easiest way to describe security of a type of cryptography is to say that "the time it takes to solve for an x-bit key would be y years". How would one go about doing such a calculation ...
6
votes
1answer
1k views

Why Elliptic curve cryptography are not popular in practice

RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide ...
1
vote
1answer
716 views

Z*p Generator (Cyclic Group) in java

I am trying to implement ElGamal in java without using the in-built libraries. The problem occurs when I am trying to find the generators of the number(in this case 11). Everything works perfectly ...
5
votes
2answers
914 views

ElGamal signature without calculating the inverse

I stumbled upon this question in some textbook. Propose a variant of ElGamal signature scheme such that there is no need to calculate the inverse $k^{-1}$ as it is usually done using the EEA. ...
3
votes
1answer
322 views

ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse Show how one could exploit an implementation ElGamal signature scheme in which ...
10
votes
3answers
404 views

Mapping between subgroups and the integers

This question is a companion to the equivalent question on elliptic curves. Preliminaries Diffie-Hellman, Elgamal, DSA, etc. are examples of protocols that work in the integers modulus a large prime ...
3
votes
1answer
497 views

ElGamal message signatures retrieving the secret value x

If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined. Why is this true? How would one retrieve x?
7
votes
1answer
1k views

How can one show that an ElGamal-like signature verification scheme is valid?

For an ElGamal-like signature scheme, I am given two things: The signing function, the verification function. How can I show that the verification function is valid? Example 1: Signing: $s := ...
3
votes
2answers
2k views

What does SSL use? RSA? El-Gamal? Elliptic curves?

I'm not sure what SSL uses to share the symmetric key to both end users, i.e. at the beginning of the communication. Is it RSA? Or El-Gamal? Or something else?
9
votes
1answer
3k views

ElGamal Signature Scheme: Recovering the key when reusing randomness

Show how if Alice uses the same value of $k$ to sign two different messages $m_1$ and $m_2$, using the ElGamal signature scheme, Eve can recover the value of $a$ from the corresponding signatures ...
5
votes
1answer
525 views

Safe generator for ElGamal signature

What are the properties a generator $g$ should have to be secure for ElGamal signatures (original scheme)? I am aware that it is poorly chosen and not secure when $g|p-1$ or $g^{-1}|p-1$, where $p$ ...
1
vote
1answer
401 views

Efficient algorithm for remainder calculation over prime field for ECC implementation?

I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) ...
1
vote
2answers
463 views

ElGamal: Generation of “g” value?

I haven't been able to find a clear explanation on this (and I'm probably just confused in general). I have the following parameters of ElGamal signatures: $p$ = safe prime $q = (p-1)/2$ $g$ = an ...
1
vote
1answer
810 views

How to protect from Silver–Pohlig–Hellman algorithm

I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a ...
6
votes
2answers
423 views

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.
3
votes
2answers
936 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
2
votes
0answers
525 views

Example of second preimage attack [closed]

Please, I'm trying to understand second-preimage attacks on cryptographic hash functions. I understand the definition well: given a message and it's hash, an attacker finds another message which ...
-1
votes
1answer
149 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
2
votes
1answer
219 views

Designing a secure IM protocol

I haven't been programming much lately, so I figured I would make an encrypted instant-messaging program (read: Skype clone) with groups to hone my skills. That's not important though, I can do that. ...
2
votes
0answers
2k views

Cryptographic Protocol using NaCl

Why? I wanted to add some security and privacy to a chat-type server for playing various games (with a few things that are done on the server to limit cheating). Going by the "Don't implement ...
3
votes
1answer
249 views

Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known

I been going through some cryptography exercises and stumbled across this problem. Discover message $m$. You know that $m = p * q$. Also $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known ...
2
votes
1answer
373 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
2
votes
0answers
136 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
-3
votes
1answer
130 views

RSA public key security issue

The public key for RSA is $[e,n]$. Since $n = p * q$, are $p$ and $q$ already exposed because it takes no effort to figure out $p$ and $q$ from $n$?
1
vote
0answers
106 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
6
votes
3answers
4k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?

15 30 50 per page