4
votes
1answer
135 views

What authentication techniques can be used by QKD Systems?

As it is well known that QKD systems are prone to simple MITM attacks… what authentication techniques are being used in QKD to prevent those attacks in practice?
4
votes
2answers
842 views

Homomorphic cryptosystems in RSA

Hopefully Crypto can help me understand homomorphic cryptosystems. I'm designing a high score server for a game I made, and because of facets in the language i'm using, the player would be able to ...
4
votes
4answers
537 views

Which block cipher modes of operation allow a predictable IV?

Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
4
votes
2answers
1k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
4
votes
2answers
543 views

Is this a correctly formatted PGP session key packet?

RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ...
4
votes
1answer
185 views

How to communicate authentication tag for GCM?

I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
4
votes
1answer
346 views

OpenPGP Signature Packet hashed data

RFC 4880 describes the version 4 signature packet, tag 2, as ...
4
votes
1answer
135 views

Does security under ROM imply exactly what?

I'm not sure I understand really the implications of proofs of security in the random oracle model. Does a proof of security in ROM translate to a reduction of security of the crypto-system to the ...
4
votes
1answer
324 views

How can one share information using the 'host-proof' paradigm?

I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it. I really like the idea of a ...
4
votes
1answer
1k views

What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ...
4
votes
1answer
401 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
4
votes
2answers
353 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
4
votes
3answers
564 views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
4
votes
1answer
772 views

How does a key wrapping like RFC 3394 secure my cryptographic keys?

So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it. The problem I'm running into is how to store keys securely on a ...
3
votes
1answer
70 views

Partial hash code protocol for security tokens providing signatures

I've read the following two sentences within a beta protocol specification, which references ISO/IEC 7816-8 for PSO:HASH which already contains notions of a "partial hash". The off-card entity is ...
3
votes
3answers
199 views

How feasible is word-level frequency analysis over English (or any language)?

Say I have some black box which, given any English word, deterministically outputs a token for that word. Assume our black box is implemented using strong cryptography, i.e. the hardness of reversing ...
3
votes
2answers
196 views

Using PBKDF2 twice with different argument order

I'm pretty sure this is a really bad approach (in theory), but one of my clients is doing this and I was wondering… How bad it is to perform pbkdf-2 in this way (with 2000 iterations)? ...
3
votes
0answers
112 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
3
votes
1answer
88 views

Does $i^n=j^n$ for $i, j \in GF(2^q)$ and $i \neq j$ for some $n<2^q-1$

Let $i, j \in GF(2^q)$ and $i \neq j$ and $i,j\neq0$. Is that possible that $i^n=j^n$ for some $n$ such that $0 < n < 2^q-1$? I am looking for a proof if the answer is no, or for a method to ...
3
votes
1answer
168 views

Convert m-Sequence into a de Bruijn Sequence

In his paper Alternating Step Generator Controlled by de Bruijn Sequence, C.G. Günther states on page three that a de Bruijn sequence (..) can easily be obtained from an m-sequence (maximal length ...
3
votes
1answer
234 views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
3
votes
1answer
245 views

Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
3
votes
1answer
124 views

How to attack this authentication protocol from “Cryptography: An introduction”

Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart): ...
3
votes
2answers
280 views

DES — Can I recover the key when I have both ciphertext and the plaintext?

Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
3
votes
2answers
137 views

Why doesn't this dummy mutual authentication protocol provide mutual authentication?

I am a student taking a cryptography course so forgive me if this comes off as a silly question. This is an assignment question: $Alice \rightarrow R \rightarrow Bob$ $Alice \leftarrow [R]B ...
3
votes
1answer
182 views

Can two people with different one time pads securely exchange a message like this?

Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts ...
3
votes
1answer
131 views

What does this Authentication protocol achieve and what information is shared?

I'm having trouble with the following question from my class: "What is the purpose of the protocol, and how does it achieve this purpose and what shared information does A and B end up after ...
3
votes
3answers
255 views

Is it true, that non-military cryptography appeared in 50's and 60's only thanks to leaks from the NSA? [closed]

I'm not talking about scytale, but encryption like RSA, DES, etc... How did exactly civil cryptography evolve after WWII?
3
votes
2answers
262 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
3
votes
1answer
306 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...
3
votes
1answer
316 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
3
votes
2answers
358 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
2answers
312 views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
3
votes
2answers
212 views

Reordering non-block-aligned parts with DES in ECB mode

I was given a ciphertext file which was encrypted using DES in ECB mode. It is known that the plainttext that was encrypted has the following form: Each line of text consists of a payroll followed ...
3
votes
3answers
242 views

How to attack a fixed LCG with partial output?

To show some colleague programmers exactly how broken C's rand() is (at least on Windows) I decided to break it. So everyone knows the exact parameters, MSVC's ...
3
votes
1answer
334 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
3
votes
2answers
171 views

Can S/MIME be still considered secure?

Previoulsy I had asked this question at http://stackoverflow.com/questions/18235983/can-s-mime-be-still-considered-secure but I feel this forum is topic-wise the right place. Recently there has been ...
3
votes
1answer
479 views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
3
votes
2answers
180 views

Does impersonating an SRP server give you enough information for an off-line dictionary attack?

In a comment to an answer I wrote to another question, CodesInChaos wrote that: "Problem with SRP is that an attacker who impersonates a server learns the password hash, enabling offline search." ...
3
votes
1answer
198 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
3
votes
2answers
172 views

Quadratic residuosity problem reduction to integer factorization

How can one show how to reduce the quadratic residuosity problem to an integer factorization?
3
votes
4answers
386 views

RSA by hand - did I do something wrong? (c = m on encryption)

to understand RSA better I am doing a little calculation by hand, this is what I got: Choosing: $p = 3$ $q = 5$ $n = 15$ $\phi(pq) = 2 \cdot 4 = 8$ $e > \phi(n) => e = 13$ $e \cdot d = 1 ...
3
votes
2answers
1k views

Finding a keylength in a repeating key XOR cipher

In an old cryptography FAQ, I found the following step described for determining a the length of the key a cipher was repeatedly XORed against: Discover the length of the key by counting ...
3
votes
3answers
255 views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
3
votes
3answers
521 views

If RSA is limited to 117-200 bytes or so, is that a very limited use case?

Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size? I have read that you can only encrypt a message of around 117 to 200 ...
3
votes
2answers
330 views

Is there a way to do fair exchange between two parties who don't trust each other?

Let's suppose we have an Alice who knows a secret key A, and Bob who knows key B. Using their own keys, they each encrypt a message (Alice encrypts $m_A$, Bob encrypts $m_B$) with their own key, and ...
3
votes
1answer
278 views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
3
votes
1answer
563 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
3
votes
1answer
263 views

How to compute the dot product on encrypted values?

Is there a practical homomorphic encryption scheme that can give reasonable execution time results in computing a dot product: $$a_1*b_1 + a_2*b_2 +a_3*b_3 +\ldots+ a_n*b_n$$ I imagine the scheme will ...
3
votes
2answers
270 views

Can I combine two PRNGs to make use of more seed data?

I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...

15 30 50 per page