1
vote
1answer
429 views

How do unkeyed hash functions (for MDCs) provide security?

Unkeyed hash functions are, by definition, hash functions computed without a key. SHA-1 is an example. MDCs (message digest codes) are a subclass of unkeyed hash functions. How are unkeyed hash ...
1
vote
0answers
120 views

Timestamping services authorities, utilizing Linked, hybrid and other than PKI schemes

What are well respected Cryptographic Timestamping authorities utilizing more sophisticated than just PKI (RFC 3161) schemes, like Linked, Linked and signed, distributed hash trees (maybe P2P?), ...
1
vote
2answers
403 views

Complexity of ECB and OFB

What is the complexity of ECB in terms of Time and Memory? and also in OFB? I can't find it in the internet, so I decided to ask it in here.
0
votes
4answers
196 views

what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?

So normally if you do encrypt('a') twice in a row you'll get the same result. But sometimes (as is the case in SSH) this is not desirable. You want encrypt('a') + encrypt('a') == encrypt('aa'). What ...
0
votes
1answer
94 views

How does chosen ciphertext attack on Elgamal work?

Can it be proven that attacker can obtain the full message if he knows some plain-ciphertext pairs?
0
votes
0answers
52 views

Permutation parity after cycle-walking

Let $E$ be a random even permutation of the set $\{0\dots n-1\}$. We construct a permutation $P$ of the set $\{0\dots m-1\}$, for some $m\le n$, using cycle-walking; that is, computing $P(x)$ is as ...
0
votes
0answers
45 views

Need: Fast bulk signature verification followed by fast non-interactive multisignature aggregation

Q: Is there an efficient way to batch-verify signatures (e.g. some may be incorrect) and then non-interactively aggregate the correct ones into a multisignature (they are of the same message) such ...
0
votes
1answer
315 views

Understanding multiplication in the AES specification

I am reading through the AES specification and am not able to wrap my head around the multiplication definition (section 4.2). Sorry to refer to a spec but AES is the holy grail in crypto so I hope ...
0
votes
0answers
84 views

Question Error Correcting Codes

Let $C$ be a code over the finite field $GF(2)$ with generator matrix $G$ and parity matrix $H$. Let $e+C=C'$ be a coset of code $C$. Let $S$ be a non-singular matrix and $H'=H\times S$. Finally, let ...
0
votes
4answers
528 views

Is the One Time Pad (OTP) considered a cryptographic hash function?

As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
0
votes
1answer
829 views

How to implement order preserving encryption or order preserving hashing [closed]

Does anybody know any free implementation of either order preserving encryption or order preserving hashing? I've found some codes like CMPH but I need to dynamically add new DATA and that's why most ...
0
votes
1answer
2k views

Is MAC better than digital signature?

MACs differ from digital signatures in the sense that MAC values are both generated and verified using a shares secret key. Does this in any way put MAC on a disadvantage as compared to digital ...
-1
votes
1answer
11k views

Decrypt files with original file CTB-Locker [closed]

I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ...
-2
votes
3answers
2k views

How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
-2
votes
2answers
314 views

How do I choose the best 3*3 s-boxes?

I've read about 20 papers about the criteria for choosing best $n \times n$ s-boxes. Now, I've got two problems: How to generate $2^{24}$ s-boxes, and how to test them considering the criteria. ...
10
votes
2answers
1k views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
10
votes
2answers
788 views

Why RSA can't handle numbers above 76?

I'm going to encrypt the characters Zhu, and decrypt them using RSA. I'm using the public key $\{e, n\}$ and private key $\{d, n\}$. The values of $e$, $d$ and $p$ ...
10
votes
1answer
5k views

How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about ...
9
votes
1answer
809 views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
9
votes
2answers
1k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
9
votes
1answer
2k views

Diffie-Hellman: choosing wrong generator “g” parameter and its implications of practical attacks

In traditional DH one chooses two shared parameters: a large prime "p" and base "g", which is primitive root mod "p". Suppose generation algorithm is broken and "g" generates only a subgroup (group ...
9
votes
1answer
422 views

How to choose constants in a cryptographic function?

A number of cryptographic functions have constants built in. For example, the constants used in RFC 2104 for HMAC, or the constants used in s-boxes (e.g., DES and AES), or MD5. In general, how are ...
9
votes
1answer
399 views

Can one efficiently iterate valid bcrypt hash output values?

bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password. An efficient attack on this would ...
8
votes
3answers
387 views

Security of a security protocol for key exchange, using symmetric-key cryptography

This is an exam question: $A \to B$: Alice, $nonce_A$ $B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$ $A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$ Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$ ...
8
votes
1answer
604 views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
7
votes
4answers
189 views

Is deniable error-correction possible?

This question came up as I tried to answer an earlier question I asked: cryptographic data structure wanted: sparse array without membership test. I still have not resolved that question to my ...
7
votes
2answers
2k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
7
votes
2answers
225 views

Is there any research on the problem of making a number more memorable to humans?

Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
7
votes
6answers
10k views

Difference between encrypting something and hashing something

What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
7
votes
1answer
373 views

Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
7
votes
2answers
1k views

How to better generate large primes: sieving and then random picking or random picking and then checking?

I'm writing an RSA algorithm, and am wondering what is the best and/or usual way to choose the initial prime numbers (p and q). I know of two methods to achieve this, one based on a prime number ...
7
votes
3answers
2k views

Why programming languages don't provide simple encryption methods?

In c#, there is a namespace called System.Security.Cryptography and there are many classes in this namespace, which help developers encrypt and decrypt data. ...
7
votes
1answer
176 views

Is there any general description language for block ciphers?

In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that: The NESSIE project is also developing a new generic tool to analyze block ciphers ...
6
votes
1answer
340 views

What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
6
votes
1answer
143 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
6
votes
2answers
285 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
6
votes
2answers
328 views

Meaning of “family” in “family of hash functions”

Many definitions related to universal hashing mention the term "a family of hash functions, say $H$". What does this 'family' mean exactly? A numerical example would be appreciated. Also, what does it ...
6
votes
3answers
1k views

Why is the complexity of RSA-1024 80 bit and not 86 bit?

Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit? Here is the complexity for the GNFS (pulled from the linked Wikipedia article): $$\exp\left( ...
6
votes
1answer
613 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
6
votes
2answers
1k views

What is the progress on the MIT LCS35 Time Capsule Crypto-Puzzle?

Ron Rivest posed a puzzle in 1999. MIT LCS35 Time Capsule Crypto-Puzzle. The problem is to compute $2^{2^t} \pmod n$ for specified values of $t$ and $n$. Here $n$ is the product of two large ...
6
votes
2answers
1k views

On-the-fly computation of AES Round Keys for decryption?

The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that ...
6
votes
1answer
380 views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
6
votes
1answer
472 views

Does omitting the first two lines of RC4's pseudo-random generation algorithm weaken the cipher?

A particular educational software program published by a U.S. government agency uses a variant of RC4 to obfuscate its data files (see Stack Overflow question). The variant of RC4 in question is ...
6
votes
1answer
361 views

Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
6
votes
2answers
1k views

How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
6
votes
2answers
1k views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
6
votes
2answers
473 views

Deniable Encryption from simple primitives

Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known ...
6
votes
1answer
285 views

Hermitian curves introductory references

Could you give me some reference to start on Hermitian Curves. Some papers or textbooks would be perfect, and please mention if it's math inclined or comp.sci. inclined. I've only seen hermitian ...
5
votes
2answers
134 views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
5
votes
3answers
434 views

What is the most computationally efficient way of generating pseudo-random permutations?

I have an application in which I need to create up to J randomly shuffled-copies of an array of length N. Then I will have millions or even billions of iterations such that, in each iteration, I will ...

15 30 50 per page