7
votes
2answers
3k views

How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
7
votes
3answers
2k views

Security of simple xor and s-box cipher?

What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode? A cipher's internal primitive might be a simple as this: $C = S[M \oplus k]$, where ...
6
votes
1answer
71 views

KFB mode - key feedback

Please, could someone explain to me how the Key feedback mode (KFB) mode works and what the IV in output block stands for? And what properties does the "constant input" has to provide? Should it be ...
6
votes
1answer
380 views

Is it a requirement to understand mathematics when implementing (or breaking) cryptography?

Related: What is the lowest level of mathematics required in order to understand how encryption algorithms work? and Recommended skills for a job in cryptology In the context of putting crypto into ...
6
votes
2answers
2k views

Is PBKDF2-HMAC-SHA1 really broken?

I just read through this article which demonstrates practical (and seemingly trivial) collisions in PBKDF2-HMAC-SHA1, and provides a few examples of collisions. Am I missing something here? Is ...
6
votes
3answers
3k views

How and why can a decryption program tell me that a key is incorrect?

I have noticed that some programs used for file encryption will tell you if an entered key is wrong when you try to decrypt. It seems (to me at least) that this would mean that the key somehow is ...
5
votes
2answers
315 views

Pen-and-paper one-way function for externally-anonymous survey

When conducting surveys, an Administrator might send an Enumerator to survey a Respondent. For "sensitive" questions (e.g. about embarrassing behavior), the Respondent may be fine with the truth being ...
5
votes
2answers
627 views

Is there a practical zero-knowledge proof for this special discrete log equation?

We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob: Alice knows: ...
5
votes
3answers
646 views

Can I jettison MAC if I already have SHA1(M)?

I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
5
votes
3answers
1k views

RS Erasure Coding and Shamir's Secret Sharing

So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here). For what I understand, it states that Shamir's ...
4
votes
1answer
224 views

Factoring two RSA modulus with known $|p_1 - p_2| < \ell $

I have two 1024bit RSA modulus $N_1 = p_1q_1$ and $N_2 = p_2q_2$ such that $0 <|p_1 - p_2| < \ell$, and $\ell$ is at most 64bit integer. Can I factorise $N_1$ and $N_2$? What's the answer when ...
4
votes
2answers
1k views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
4
votes
3answers
980 views

Convert old and busted password encryption to something sensible

Given a TOTALLY HYPOTHETICAL scenario in which passwords for over a million accounts in over 200 databases have been stored using 3DES, a key derived from a (single) MD5 hash of a customer-controlled ...
4
votes
3answers
5k views

Which one of the Block Cipher modes is the best?

I have two questions regarding the Block Cipher Modes: Which one of the modes is considered the best? I know CBC has a problem of IV since the next block of the plain text is XORed with the result ...
4
votes
2answers
3k views

How to attack a general polyalphabetic cipher?

I am able to decrypt vigenere cipher text using the index of coincidence and chi test. However out of interested how do you go about attacking ciphertext that was encrypted using a mix alphabet ...
3
votes
1answer
438 views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys ...
3
votes
1answer
281 views

Why not encrypt salt?

Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted? By encrypted I mean with a block cipher and with key and IV derived from ...
3
votes
3answers
5k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
2answers
820 views

Tools for modelling and analysis of cryptographic protocols

I am designing some cryptographic protocols and I am new to it. Are there any well-known tools that can be used to model and design these protocols? And also verify or analyze their validity? If not ...
2
votes
1answer
2k views

What is a trapdoor permutation?

Can anyone explain to me what a trapdoor one-way permutation is? Is RSA a trapdoor one-way permutation? Context: I was reading about ring signatures. On page 560, it describes steps to ...
1
vote
2answers
333 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
15
votes
2answers
2k views

Is HTTPS secure if someone snoops the initial handshake?

Let's say I'm on an open wireless network that's being actively sniffed and I connect to an HTTPS site. Even though my subsequent traffic is encrypted, couldn't the sniffer use the data from the ...
14
votes
3answers
1k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
13
votes
1answer
7k views

Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
13
votes
2answers
2k views

Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?

Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
12
votes
1answer
612 views

Perfect Forward Secrecy with NaCl

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application. From what I understand, all Bob needs to to decrypt a ...
12
votes
1answer
706 views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
11
votes
3answers
2k views

At the current time, is SHA256 the de facto standard for strong cryptographic hashes?

At the current time, is SHA256 the de facto standard for strong cryptographic hashes? From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
10
votes
3answers
830 views

How useful is NIST's Randomness Beacon for cryptographic use?

NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
10
votes
2answers
1k views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
10
votes
2answers
2k views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
10
votes
1answer
6k views

How does the index of coincidence work in the Kasiki test?

I'm starting to learn about cryptanalysis and I am having a bit of difficulty understanding the Kasiski test's index of coincidence. I have a book (Cryptography Theory And Practice by Douglas Stinson) ...
10
votes
4answers
1k views

Properties of PRNG / Hashes

There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications. So, I was wondering how ...
9
votes
2answers
790 views

Encrypt-then-MAC: Do I need to authenticate the IV?

In the setting of Encrypt-then-MAC, do I need to include the IV in what I'm HMACing, or is authenticating just the AES-encrypted data sufficient?
9
votes
1answer
3k views

Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?

The ASN.1 spec for the PKCS1 RSA private key format is as follows: ...
8
votes
2answers
714 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
8
votes
2answers
297 views

Does the position of the salt improve its effectiveness when hashing?

Seems most documentation I have read suggests the salt should prefix the value to be hashed. Is this just for consistency, or is the salt more effective when prefixed?
8
votes
1answer
1k views

Are there any specific requirements for the function $F$ in a Feistel cipher?

In a Feistel cipher (as shown below), it seems that the security of the cipher would be entirely dependent upon the function $F$. What requirements on $F$ are necessary for a secure Feistel cipher? Is ...
8
votes
3answers
429 views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
7
votes
2answers
249 views

Key Size for Symmetric Homomorphic Encryption Over the Integers

In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2. Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$ Encrypt A Bit m: ...
7
votes
2answers
302 views

Does there exist a proof-of-retrievability scheme that is publicly-verifiable, limited-use, and does not use homomorphic encryption?

I find myself wanting to test out a practical implementation of a proof-of-retrievability scheme, simply out of curiosity. These schemes seem to be divided into two variations, publicly-verified and ...
7
votes
2answers
564 views

Given a message and signature, find a public key that makes the signature valid

Given a message $M$ and a signature $S$, is it feasible to find a RSA public key $(n,e)$ such that $S$ verifies as a valid signature on $M$ (using this public key)? What if we're given one public key ...
7
votes
4answers
843 views

How to best obtain bit sequences from throwing normal dice?

Throwing normal dice, one can get sequences of digits in [0,5]. Which is the best procedure in practice to transform such sequences into bit sequences desired?
7
votes
3answers
878 views

Can I use a key-derivation-function as the hash function H in SRP?

In the Secure Remote Password Protocol, the verifier must be stored on the server. In the case of a server compromise, an attacker could obtain these verifiers. If nobody reused passwords, this ...
7
votes
2answers
2k views

Accelerating SHA-1

I have a program where computing SHA-1 is the bottleneck. This is using OpenSSL 1.0.0e on a 2.6Ghz 16-core Opteron where I get about 325MiB/s throughput. (SHA1 here is via Andy Polyakov's x86-64 ...
7
votes
4answers
3k views

What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?

If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
6
votes
1answer
326 views

The effect of truncated hash on entropy

Suppose i have a 128 bits random binary string (128 bits of entropy), then i hash it using SHA-256, then i take the first 128 bits of the output hash. Does the taken bit string still have (almost) 128 ...
6
votes
1answer
393 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
6
votes
2answers
1k views

Does having a known plaintext prefix weaken AES256? [duplicate]

I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext. ('Hello World!' for example.) Does having this known plaintext prefix weaken AES256? I do not care ...
6
votes
2answers
393 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...

15 30 50 per page