All Questions

1answer
1k views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
0answers
191 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
1answer
398 views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
2answers
347 views

SHA-1:Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output?

Is there any mathematical result that gives us the minimum number of 1's in a 160-bit SHA-1 hash output? What is the probability that a 160-bit SHA-1 hash output contains at least 128 1's?
2answers
363 views

Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
1answer
1k views

SHA256 HMAC brute force with chosen plaintext attacks

This is a follow up to Is It Possible To Reconstruct a Cryptographic Hash's Key I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length ...
2answers
263 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
0answers
139 views

Correct way to truncate data to a range [duplicate]

2 hours ago I thought I had this figured out, but now I am doubting myself and want someone to validate my algorithm. I want to take a stream of k trusted random ...
2answers
2k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...
1answer
245 views

Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
2answers
1k views

Even passwords are vulnerable to hash collision attacks?

As stated in this page large documents hashed using md5 maybe vulnerable to collision attacks. My question is even passwords of 6-30 character are vulnerable to such hash collision attacks? If yes, is ...
2answers
215 views

How to verify a number encrypted with an unknown key

Alice and Bob are going to follow the protocol below. Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?: Alice encrypts a set of numbers using some ...
4answers
410 views

How to perform Multiplicative Inverse Modulo in IDEA

How to perform the Multiplicative Inverse Modulo in International Data Encryption Algorithm? I don't understand on how to perform it… For example, let's say I have a value of ...
1answer
252 views

Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
0answers
101 views

How hard is a known prefix hash preimage attack?

Suppose the attacker knows $X, Z$ such that $H(X || Y) = Z$ If bit-length(Y) < 60 then a brute force attack is possible. What if ...
3answers
870 views

Why is RSA encryption significantly faster than decryption?

I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
1answer
103 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
0answers
173 views

Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]

Possible Duplicate: Using CBC with fixed IV Forgive me if this has been asked before, I looked but haven't seen any answers that suit. Is there any danger in using CBC, encrypting a ...
2answers
401 views

How can I add more rounds to AES?

I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional ...
1answer
186 views

Messages of different lengths and one-time computationally-secret

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. Let $\Pi=(Gen,Enc,Dec)$ be an efficient secret-key encryption scheme that is not fixed-length. That is, for any $n$ ...
1answer
519 views

Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
2answers
162 views

RSA keys finding when messages are known

I have this situation, where, in a game, people send messages to each other (game moves etc...) These messages need to be encrypted, and should only be readable by the destination person. I am using ...
2answers
554 views

Avalanche noise RNG for one-time pad use

I came across this little HRNG widget and was really intrigued as I have been looking for a decent but afordable source for truly random bits to use in a one-time pad. The question is, would a HRNG ...
1answer
294 views

implications of SSH server key compromission when authenticating users against a public key

Friday we had a disagreement with a colleague of mine about the implications of SSH server key compromission The question was stated as this : What could a hacker do while provided with the SSH ...
1answer
255 views

Why pairing based crypto is suitable for some particular cryptographic primitives?

Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...
1answer
334 views

Is there another resource for Carter-Wegman-style message authentication?

I'm wondering if there are other resources that cover Carter-Wegman style message authentication, besides the sources themselves. Is there an online text or a book that covers their ideas? I'd ...
4answers
450 views

What is the actual difference between security through obscurity and true encryption?

In an abstract sense, aren't both the same? Don't their definitions boil down to the following? security through obscurity: trying to make sure some information cannot be obtained without knowing ...
2answers
344 views

Can I build a secure tweakable block cipher from a normal one by adding key and tweak?

Let (E,D) be a secure block cipher. Consider the following tweakable block cipher: ...
1answer
463 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's some sort of OpenSSL interoperability thing a b c. Is there some ...
0answers
139 views

How to properly format a PGP Message Block?

As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
3answers
366 views

PRNG taking advantage of very large seed

Can anyone suggest a good (CS)PRNG algorithm that takes advantage of having a very large (ideally arbitrarily large) seed? I'd like to use several kilobytes, perhaps several hundred kilobytes, of ...
2answers
653 views

Capacity of Advanced Encryption Standard in terms of File Encryption

what is the capacity of AES in terms of File Encryption? is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES? is it still good to used ...
1answer
131 views

Separate Read and Write Keys in TLS Key Material

Why does the TLS protocol use different symmetric keys for receiving and sending data? Isn't it enough to have a single key used for both reading and writing?
2answers
826 views

Is RSA in a ECB-like-mode safe for bulk encryption?

Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA. (Note: I do realize that in practice this is done through an intermediate symmetric key, but ...
4answers
925 views

Is my pseudo-random initialization vector secure?

How can I know if I am generating a secure pseudorandom initialization vector? Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
1answer
6k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
3answers
462 views

reverse of md5sum

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size N whose md5sum is X? For example, ...
1answer
354 views

Offline anonymous electronic money systems and their cryptographical base

What anonymous offline electronic money systems exist and what are they based on? I know only one currently - eCash, based on RSA blind signatures.
3answers
141 views

Combating traffic analysis over request-response protocols

Suppose I am to design a request-response protocol (similar HTTP). For the sake of simplicity let us assume that this is a "chat" protocol where the client can only perform two actions: Contribute a ...
2answers
370 views

Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
2answers
171 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
1answer
129 views

SHA1 collision event probability after n iterations

There are String1 and String2 - some variables-strings. The probability of collision for different ...
1answer
53 views

Non-commutitive and nonassociative algebraic structures in cryptography

Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ...
1answer
40 views

4answers
253 views

Does it make sense to have a 4000 bit long key?

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?

15 30 50 per page