8
votes
4answers
579 views

Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)?

Alice is going to use some existing RSA scheme (employing industry-standard signature or/and encryption with proper padding), which she can't change, or influence beyond her choice of key. In this ...
4
votes
1answer
546 views

Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?

I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
2
votes
1answer
670 views

Crack SHA1 hash code

Given a set of SHA1 hash code, if we knew a portion of the plaintext for each particular hash code, and also the remaining portion of the plaintext is a constant value for each hash code. Is it ...
2
votes
2answers
1k views

Optimising Pollard's Rho algorithm for large semi-primes

I have programmed an implementation of Pollard's Rho factoring algorithm using C++ and the GMP library. It is reasonably fast with large numbers, however I haven't implemented any form of cycle ...
1
vote
4answers
2k views

“Padless” One-time-Pad encryption

I have just read about the perfect security of an OTP encryption and what came to my mind was that what if the Pad used for encryption/decryption did not have to be transported separately from the ...
4
votes
2answers
419 views

Real world use cases of Multi-Party Computation

Most of the research papers give imaginary applications of multi-party computation. Either they talk about Yao's millionares' problem or two or more corporates willing to compute some intrustion ...
4
votes
1answer
4k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
2
votes
2answers
834 views

Why is an Encrypt-and-MAC scheme with deterministic MAC not IND-CPA secure?

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. It's the task from two-years ago exam. At the bottom I reminded one definition. Let $(Gen_E,Enc,Dec)$ be an IND-CPA-...
3
votes
2answers
620 views

Modifications of CBC-MAC

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions. At the beginning I want to remind the ...
2
votes
1answer
205 views

Messages of different lengths and one-time computationally-secret

I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. Let $\Pi=(Gen,Enc,Dec)$ be an efficient secret-key encryption scheme that is not fixed-length. That is, for any $n$ ...
1
vote
2answers
638 views

Is there an algorithm for factoring N, which is just as simple as this one, but faster?

I found a simple algorithm for factoring semiprime numbers, you can read about it in Factoring Semiprimes and Possible Implications for RSA. It basically works like this: You reverse the digits in $...
3
votes
1answer
1k views

Why do we need in RSA the modulus to be product of 2 primes?

I think I roughly understand how the RSA alorithm is working. However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$. I vaguely know it ...
1
vote
2answers
2k views

decrypt AES without whole key

Is there a way to decrypt a AES cipher Text which was encrypted twice with some key, when having a part of this key? (the last 3 bytes of the key are missing)
1
vote
1answer
522 views

What is the complexity of the Square attack against the reduced 4-rounds 128-bit Rijndael variant?

I'm looking at a square attack against a reduced version of AES-128 with only 4 rounds (with block and key size of each 128 bit). I have a set of 256 plaintext-ciphertext block pairs. What is the ...
-1
votes
1answer
471 views

Recovering SHA1 knowing 2/3 of the hash generated

I am doing some research on cryptography, so I generated a random string of numbers resembling a creditcard number(according to MOD10 validation) and encrypted it with SHA1 algorithm for encryption. ...
2
votes
2answers
283 views

Subgroups generators with respect to group generators of composite order

If I have a group $\mathcal{G}$ of order $N=npq$ and subgroups $\mathcal{G_n,G_p,G_q}$ of order $n$, $p$, $g$ respectively and if $g$ is a generator of $\mathcal{G}$ why then $g^{nq}$ is a generator ...
9
votes
3answers
248 views

Does chaining random number generators lead to loss of randomness?

Assume you chain random number generators, i.e use the result of one PRNG as the seed for the next. What kind of errors can that introduce in the randomness of the numbers generated?
1
vote
5answers
907 views

Would this simple encrypted chat program be feasible using One Time Pads?

Lets say I want to build a simple chat program that has encryption that is impossible to crack for anyone, even a theoretical government with a massive super computer. Ok here's my idea. You'll need ...
2
votes
6answers
2k views

How secure will this be against brute-force attacks?

I'm looking into encrypting files like this: First, I SHA-1 hash the password. Let's say the password is something normal like "hello123", and then hashed. Then I encrypt a file using this: ...
3
votes
1answer
257 views

Seed a PRNG with random data and a password

I'd like to combine a random key file with a password to generate a secure seed for a CSPRNG. The key file is assumed to have very high entropy, but the password will be whatever the user provides. ...
2
votes
2answers
385 views

Why is a non fixed-length encryption scheme worse than a fixed-length one?

I have the following definition (highlights by me): An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$, where $Gen$ and $Enc$ are PPT algorithms and $Dec$ is a Deterministic Polytime ...
-1
votes
1answer
225 views

Because the algorithm is known, it is no longer a trade secret [closed]

In wiki about RC4 cipher they said, Because the algorithm is known, it is no longer a trade secret. Is that mean the cipher text will be more secure if the algorithm unknown to the attacker. ...
-1
votes
2answers
485 views

How weak/strong is this hand cipher? (updated) [closed]

In simple steps here the system: first write text. hand cipher then divide into groups of three letters: han dci phe r then choose a key consisting of three letters, for example ...
3
votes
1answer
211 views

Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$

Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g., Factoring integers and computing elliptic curve rational points, ...
3
votes
1answer
413 views

Is frequency analysis a useful tool against encryption by multiplication?

If I transform natural plaintext by: making each letter two decimal digits, considering the whole as a decimal number; multiplying by the key (some integer constant), giving the ciphertext; would ...
2
votes
1answer
725 views

How to multiply a matrix of bits with another?

For example, assume I have two 4x4 matrices of bits: 1 1 1 1 1 1 1 0 0 0 0 0 0 1 1 1 1 0 0 1 1 0 1 1 0 1 1 1 1 0 1 0 I want to apply ...
4
votes
1answer
204 views

What authentication techniques can be used by QKD Systems?

As it is well known that QKD systems are prone to simple MITM attacks… what authentication techniques are being used in QKD to prevent those attacks in practice?
53
votes
5answers
20k views

Is AES-256 weaker than 192 and 128 bit versions?

From a paper via Schneier on Security's Another AES Attack (emphasis mine): In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
3
votes
2answers
980 views

Key derivation from a random seed

The main problem is to use a block cipher to generate a random key. I would like to generate 256-bits key which can be as random as possible. I generate it in the following way: Pick a plaintext $...
3
votes
1answer
6k views

What exactly is addition modulo $2^{32}$ in cryptography?

EDIT: I've been confusing this the whole time. What I've been wanting to say this whole time is addition modulo $2^{32}$ not addition modulo 32 as the question originally said. Thanks for pointing ...
2
votes
1answer
965 views

Shamir Secret Sharing - Threshold decryption implementation

I'm implementing Shamir secret sharing in C using OpenSSL. I've split up the private key and I'm ready to start decrypting the original message using some of the shares. I set $n = 5$ (5 shares ...
9
votes
2answers
5k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
1
vote
1answer
109 views

Is secure remote snap possible?

Scenario: We have a central server $S$. We have a number of peripheral servers $P_i$ We have some individuals $U_j$ A given individual may be "known" to one or more peripheral servers. Each ...
1
vote
1answer
132 views

Conditional entropy

Suppose I have a file with random binary strings of the same length in each line. If I'm computing the conditional entropy $H(Y|X)$ where $Y$ is the variable string of fixed length $l$ which is ...
3
votes
3answers
156 views

The meaning of “scheme”

This question is a bit different from other questions here, but I think it is suitable to correctly understand the terminology of cryptography. Consider the following two sets of terms: Encryption ...
1
vote
1answer
3k views

How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?

I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo. This is how IDEA operates: IDEA operates on 64-...
2
votes
2answers
255 views

How to construct a variable length IND-CPA cipher from a fixed length one?

Suppose we can construct a secure (IND-CPA) encryption scheme for fixed length messages. I was wondering if there is a natural way to extend this construction for messages of variable length such that ...
3
votes
4answers
767 views

Is there a symmetric-key cryptography based on key establishment techniques?

Most of the current key exchange techniques are based on public-key cryptography. Are there any key exchange/establishment techniques based on symmetric-key cryptography too? In my setup primary ...
4
votes
3answers
4k views

Hill Cipher known plaintext attack

I know a plaintext - ciphertext couple of length 6 for a hill cipher where its key is a [3x3] matrix. Based on what I've read and learned, to attack and crack keys of [n x n], if we know a plaintext -...
1
vote
1answer
504 views

Key Scheduling of International Data Encryption Algorithm (IDEA)

How to perform the key scheduling in International Data Encryption Algorithm (IDEA), I took a research but I can't understand how to perform it, "further groups of eight keys are created by rotating ...
3
votes
1answer
637 views

Are there secure stream ciphers that cannot be parallelized?

Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized? So for example if I seed it with a specific value, and then "...
1
vote
1answer
2k views

Traditional DES scheme in Unix crypt function

In a security context course, we need to reproduce the old DES hashing scheme in the crypt program, on an old unix system. I am actually reading the crypt page on wikipedia: The traditional ...
2
votes
1answer
284 views

Ways to protect flash player against MITM diffie hellman

We have a server, which sends content encrypted with AES128 or RC4 to a flash client over an insecure HTTP channel. The encryption key is negotiated using Diffie Hellman. The problem: Diffie ...
2
votes
1answer
435 views

Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
3
votes
2answers
505 views

Can I save space for short messages by using encryption with private key instead of a signature?

Let's say I have a message, a Private Key and a Public Key. Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you ...
5
votes
1answer
412 views

Is my password entropy calculation correct?

I have a password with a prescribed format: 111 + “2 Random lowercase letters” + “random digit” As you can see, it starts with a fixed value of ...
2
votes
1answer
120 views

Is it safe to hold key file's hash in application

Title says all; Is it safe to hold key file's hash (MD5 or SHA1) in application (hard-coded)? Thanks
2
votes
0answers
202 views

How do I encrypt with the private key? [duplicate]

Possible Duplicate: RSA encryption with private key and decryption with a public key This wording is creeping everywhere (e.g. there): "I encrypt with the private key" and even sometimes, "I ...
5
votes
1answer
1k views

What happens to the entropy of a password when you hash it?

For example, if the entropy of a password is 30 bits, what is the entropy of the password when you hash it with MD5?
13
votes
1answer
2k views

What's the difference between a Key Derivation Function and a Password-Hash?

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...

15 30 50 per page