29
votes
1answer
2k views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
28
votes
0answers
2k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
27
votes
2answers
16k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
40
votes
1answer
4k views

What is a “freestart collision”?

In their work on SHA-1 collisions (cf. the EUROCRYPT-2016 paper “Freestart collision on full SHA-1” by Stevens, Karpman, and Peyrin) Stevens et al show that they are able to generate "freestart ...
18
votes
3answers
3k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
8
votes
5answers
11k views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
21
votes
2answers
19k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
15
votes
2answers
1k views

Random oracle model proofs and programmability

Proving the security of a scheme with the random oracle model (ROM) involves two steps: first you prove that the scheme is secure in an idealized world where a random oracle exists, and then you ...
9
votes
2answers
6k views

What is the purpose of four different secrets shared by client and server in SSL/TLS?

I was looking through the working of SSL V3, and found that a connection state is defined by a set of things, including client write mac secret, server write mac secret, server write key, client ...
20
votes
2answers
2k views

Is every output of a hash function possible?

Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
14
votes
2answers
16k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...
13
votes
2answers
4k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
13
votes
1answer
8k views

How to choose a padding mode with AES

Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None. I ...
17
votes
3answers
2k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
13
votes
1answer
2k views

What's the difference between a Key Derivation Function and a Password-Hash?

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
12
votes
1answer
179 views

Structure for an introductory course on cryptography?

Many introductory courses on cryptography have their treatment of secret-key crypto start with OTP, then block ciphers, and for public-key cryptography revolve around RSA with no notion of padding ...
11
votes
2answers
1k views

What is a hard-core predicate?

I read this article on Wikipedia: Hard-core predicate. Still I don't understand what exactly is a hard-core predicate. Is it possible to put this in simple English terminology, and perhaps with a ...
17
votes
4answers
1k views

How Brittle Are LCG-Cracking Techniques?

There are published techniques for cracking LCGs, but to my eye those techniques seem very brittle — very minor changes can add nonlinearity that renders techniques like the LLL algorithm unusable. ...
16
votes
2answers
1k views

GPG/PGP Verification of Revocation

How does one verify a key revocation? After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such: ...
15
votes
1answer
781 views

Is it possible to actually verify a “sponge function” security claim?

When using a “sponge function” to create a cryptographic hash, we can look at the flat sponge claim, which flattens the claimed success probabilities of all attacks using a single parameter: the ...
15
votes
1answer
9k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
14
votes
2answers
8k views

What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?

For the purposes of signing and verifying signatures, what is the value of the hash function? Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
13
votes
3answers
346 views

Why is Poly1305 popular given its 'sudden death' properties?

ECDSA has the undesirable property that if a key pair reuses a nonce in a signing operation, the cryptosystem experiences catastrophic failure in the form of private key leakage. I've heard this ...
13
votes
1answer
7k views

Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC ...
13
votes
2answers
11k views

AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
12
votes
4answers
1k views

Are there cryptographic hash functions that can be computed using only paper and pen without leaking any information about the plaintext?

I am looking for a cryptographic hash function that can be computed by a human using only paper and pen without ever leaking any information about the plaintext on the paper. The cryptographic hash ...
12
votes
1answer
440 views

Security of pairing-based cryptography over binary fields regarding new attacks

In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$. Pairing-based cryptography using binary ...
11
votes
1answer
3k views

What are SNARKs?

What does it mean and what is it used for, I have been hearing this term a lot lately. From the context I've heard it talked about it seems to be connected with zero knowledge?
11
votes
2answers
2k views

Why are bitwise rotations used in cryptography?

Any understanding I have of cryptography stops right around the cipher level. As such, I'm just curious as to why bit shifts and moreover circular bit shift are so prevalent in cryptography.
11
votes
2answers
8k views

How does a padding oracle attack work?

I am unsure of how a padding oracle attack works. What I am not getting is how changing one bit at one time allows one to exploit(get keys) ASP.NET machines. Can anyone explain this?
11
votes
3answers
3k views

ElGamal: Multiplicative cyclic group and key generation

Here on the ElGamal wikipedia page http://en.wikipedia.org/wiki/ElGamal_encryption Alice generates an efficient description of a multiplicative cyclic group G, of order q, with generator g. How ...
10
votes
2answers
11k views

What is the difference between MAC and HMAC?

In reference to this question, what are the "stronger security properties" that HMAC provides over MAC. I got that MAC requires an IV whereas HMAC doesn't. I also understood that MAC may reveal ...
10
votes
3answers
1k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
8
votes
2answers
466 views

What is a “rewinding argument”?

I've been reading a bit about cryptographic protocols and I keep seeing the phrase "rewinding argument". I've been unable to find a good source that would explain what is meant by this. It seems like ...
7
votes
1answer
729 views

understanding forking lemma

Every time when I read a paper that has digital signature, when it comes to prove the security of a digital signature scheme, many chances that the author will use the forking lemma. The forking ...
3
votes
3answers
15k views

Where i can find an AES implementation in python?

Where i can find a "reviewed" version of AES implementation in python. Not an API like PyCrypto whereby you can call AES algorithms in a single line.
2
votes
1answer
608 views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
19
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
18
votes
1answer
6k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
17
votes
2answers
8k views

Differences Between White-Box Cryptography and Code Obfuscation

I have been reading the question "What is a white-box implementation of a cryptographic algorithm?" and it led to this short article / Q&A which states in question 2: Q2: What is the ...
12
votes
4answers
7k views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
11
votes
8answers
3k views

Would it be secure to use random numbers from random.org in a cryptographic solution?

Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while ...
10
votes
3answers
2k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
10
votes
2answers
1k views

Encryption scheme for social-network-like data sharing data via untrusted server?

I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ...
10
votes
4answers
3k views

Encrypting small values with RSA private key

I'm looking for best practices when it comes to encrypting small (< 128 bytes) amounts of data with the RSA private key. Signing it would make the resulting payload too large.
9
votes
0answers
294 views

How were shift amount constants in MD5 found?

The md5 specification gives a series of 4 rounds to execute over a 16-word block. Each round has a repeating sequence of 4 shift amounts (s in ...
9
votes
1answer
2k views

Does collision resistance imply (or not) second-preimage resistance?

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel: “Security ...
9
votes
2answers
1k views

Has threefish successfully been attacked (practically or theoretically)?

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating: Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a ...
8
votes
1answer
4k views

Multi-party encryption algorithm

To give some foreground information: I acknowledge that I am a cryptography newb and not by any means an expert (and probably never will be). In a recent CS class we had several assignments writing ...
8
votes
4answers
460 views

Automated security protocol verification tool for eCK model

I want a tool that (runs on Win7 and) can perform automated verification of a protocol in the eCK security model as described in Microsoft Research's paper "Stronger Security of Authenticated Key ...

15 30 50 per page