6
votes
3answers
856 views

Is the logic for how the enigma machine worked documented somewhere?

I know that there is a formula to calculate the result of any input but is the logic of how the machine actually worked documented? I have seen schematics for the circuitry and even a how to make ...
5
votes
2answers
87 views

How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
5
votes
1answer
257 views

Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
5
votes
1answer
3k views

Second pre-image resistance vs Collision resistance

From Wikipedia: Second pre-image resistance Given an input $m_1$ it should be difficult to find another input $m_2$ such that $m_1$ ≠ $m_2$ and $\operatorname{hash}(m_1) = ...
5
votes
1answer
121 views

Secure multiparty computation of conjunction

Suppose Alice and Bob each have bits a and b, respectively. How can Alice and Bob compute the function ...
5
votes
2answers
340 views

Secure way to derive separate encryption and MAC keys from a single master key?

I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ...
5
votes
2answers
10k views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
5
votes
2answers
1k views

What are Cryptographic Multi-linear Maps?

I've encountered this term many times in the fields of Fully-Homomorphic Encryption and Obfuscation. I want to learn those subject and Cryptographic Linear Maps seems to be an obstacle in the way. ...
5
votes
1answer
2k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
5
votes
2answers
846 views

uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
5
votes
6answers
962 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
5
votes
3answers
3k views

Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
5
votes
5answers
2k views

Crypto-Compression Algorithms?

I was wondering, whether there exist such algorithms/enciphering procedures which both compress and encrypt the input data. That means, for starters, the output will be both smaller in size and ...
5
votes
2answers
8k views

Cracking plain RSA without private key

I was wondering whether plain RSA encryption can be cracked given: The public key A plaintext of a known cipher text(s). In other words the decrypted message from an encrypted one (but without ...
5
votes
1answer
832 views

If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?

If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN? ...
4
votes
2answers
163 views

Public key crypto instead of hashing passwords in a database

Suppose I want to keep a client's password database secure (not in plaintext), while still having access to the plaintext password. Now I generates a public/private keypair. Then I send the public ...
4
votes
2answers
300 views

Is the reduction from left-or-right IND-CPA to real-or-random IND-CPA tight?

A modern trend in cryptography consists of defining security as rigorously as possible, and then designing schemes which are secure according to those definitions. Proving security comes in the form ...
4
votes
2answers
11k views

Why we can't implement AES 512 key size?

Out of curiosity why we can't implement AES 512 key size? Please explain somehow i can understand! I'm not an expert.
4
votes
2answers
375 views

Zero-knowledge proof of a product

I have non-negative integers $x,y,z$. I'm going to give you commitments $C(x),C(y),C(z)$ to them. Then, I would like to prove in zero knowledge that $xy=z$. I can choose the commitment scheme to ...
4
votes
2answers
3k views

Why is a 2048-bit public RSA key represented by 540 hexadecimal characters in X.509 Certificates?

In the public certificate, an RSA public key specified as 2048 bits long is represented by 540 hexadecimal characters. Converted to base-2, this yields 2160 bits, 112 more than the stated 2048.
4
votes
1answer
577 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
4
votes
2answers
2k views

What data is saved in RSA private key?

What data is saved in RSA private key in openssl? How to view it? Wikpedia says these variables are saved.
4
votes
1answer
558 views

Security of Pohlig-Hellman exponentation cipher?

I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
4
votes
2answers
387 views

How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the ...
4
votes
3answers
446 views

Can I use PGP to sign a message without providing cryptographic non-repudation?

The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC ...
4
votes
3answers
1k views

What algorithm would give the shortest ciphertext for very short plaintexts?

I have to encrypt some very short messages (approx. 5 characters) and I would like the ciphertext to be as short as possible. I am currently using AES but the initialization vector (IV) is making my ...
4
votes
1answer
1k views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
4
votes
2answers
866 views

are CFB and OFB really meant for streaming?

CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?
4
votes
1answer
397 views

How can one share information using the 'host-proof' paradigm?

I am attempting to make a web-based secure password management and sharing utility, both as an academic exercise and to fully understand and feel safe about using it. I really like the idea of a ...
4
votes
3answers
1k views

Alphabetic Substitution with Symbols

I was reading on a site about the Zodiac Killer and how he used a basic substitution cipher, but instead of substituting english letters and characters he substituted symbols. I was wondering, if you ...
3
votes
1answer
310 views

Do Weak Elliptic Curves Exist?

I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
3
votes
1answer
947 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
3
votes
2answers
4k views

Diffie-Hellman Key Exchange with Authentication: Man-in-the-Middle query

I have been reading up on MiTM attacks, and the prevention of them using public key certificates. Recently I learnt about Diffie-Hellman Key Exchange with Authentication, and how it uses signed ...
3
votes
3answers
234 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, ...
3
votes
1answer
673 views

Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
3
votes
1answer
885 views

How do TLS 1.1 and 1.2 generate IVs (initialization vectors) for each record?

According to RFC 4346 Explicit IVs [CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC ...
3
votes
1answer
464 views

Hamming Distance vs. Index of Coincidence

When analyzing a repeating-key xor cipher to find the key length, I've read about two key methods (assuming there aren't just repeating chunks of ciphertext for Kasiski's method), for some assumed key ...
3
votes
1answer
4k views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
3
votes
1answer
2k views

Brute forcing an HMAC

Given current technology such as GPUs and GPU cracking software I was wondering if anyone has an idea on how long it would take to brute force the key used to derive an HMAC?
3
votes
2answers
372 views

Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
3
votes
3answers
2k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
3
votes
2answers
378 views

How is de-synchronisation of HOTP solved?

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
2
votes
4answers
2k views

Is there an existing cryptography algorithm / method that both encrypts AND compresses text?

So I'm trying to find a method of encryption that not only obfuscates text, but also compresses the result. For example, if I encrypted ninechars, the ideal result ...
2
votes
0answers
65 views

Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text. I suspect, the steganography changes (elevates) ...
2
votes
2answers
103 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
2
votes
1answer
435 views

What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
2
votes
1answer
368 views

SSL-like protocol with public-key hard-coded in the client

Imagine a SSL-like protocol that instead of using certificates signed by a trusted CA, has the server's public key hard-coded in the client. My question is: what happens if the server's private key is ...
2
votes
1answer
484 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
2
votes
2answers
231 views

Alice's forgetful banking

Alice has a bank account number, but has forgotten which bank it is for. There are 4 banks, run by Bob, Carlos, David, and Eve. She could find out by going to all of the banks and asking if they have ...
2
votes
2answers
5k views

AES+CTR+HMAC Encryption and Authentication on an Arduino

In my project we would like to encrypt and authenticate the the communication channel between our server and our Arduino nodes, which relies on an underlying TCP channel. We have chosen AES in CTR ...

15 30 50 per page