8
votes
1answer
4k views

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

At stackoverflow this question has been asked. It uses additional random entropy and a hash method (among others) to try and create a cryptographically secure pseudo-random number generator for PHP. ...
4
votes
2answers
404 views

What challenge should I use in a challenge-response proof-of-work?

In order to guard against denial-of-service attacks, I want to require clients to do some work (more work than the server does fulfilling the request) before talking to them. Client connects Server ...
6
votes
1answer
1k views

Do Rabin Fingerprints have any advantages over CRC?

Background In both, bitstrings are interpreted as a polnomical over GF(2) and they each can be used to implement a hash over a sliding window. The definitions of each are as follows: Rabin ...
5
votes
2answers
1k views

Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
2
votes
1answer
1k views

RC4 : Keystream reconstruction?

First up: it's a step in some challenge found on the Internet, where we get an application and a file. The application must be feed with that file and a password (the password is the flag for the ...
24
votes
2answers
21k views

What are the advantages of TOTP over HOTP?

HMAC-based One Time Password (HOTP) was published as an informational IETF RFC 4226 in December 2005. In May, 2011, Time-based One-time Password Algorithm (TOTP) officially became RFC 6238. What ...
2
votes
2answers
426 views

Does AES with whitening mode have the following property?

This mode is that each time a random number $K$ is generated, you XOR it with plaintext $M$ and then pass the result to AES. Since AES is a pseudo random permutation, does AES have the following ...
13
votes
5answers
1k views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
5
votes
1answer
515 views

Are there any Implementations of Secure Indexes? [closed]

There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions" and "Secure Indexes". ...
2
votes
1answer
81 views

Rapidly changing passwords?

Suppose you need to authenticate yourself to a program with the password - but the program's source code is public, the program doesn't have access to any private information and all your ...
6
votes
1answer
462 views

Can a user of a password-protected Wi-Fi sniff on other user's communication?

Imagine a Wi-Fi network protected by WEP/WPA/WPA2. Users can join the network in case they know the pre-shared key of the access point. Is it possible for a user A (who has successfully logged into ...
2
votes
0answers
448 views

Openssl implementation of improved sha1 hashing [closed]

I want to use the improved sha1 hashing algorithm from the Intel blog described here Intel sha1 hashing. Currently I am using Openssl sha1 hashing in my application. I wanted to know if anybody has ...
10
votes
1answer
483 views

Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
7
votes
3answers
1k views

How to authenticate over open channel?

I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
8
votes
3answers
1k views

Is RSA padding needed for single recipient, one-time, unique random message?

I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
1
vote
1answer
379 views

ZKIP for Paillier public key correctness

I'm using the Paillier cryptosystem in a protocol similar to mental poker. In the beginning of the protocol, each player generates a Paillier public key $(n,g)$. Later in the protocol, a player may ...
1
vote
1answer
365 views

Which encodings have |encoding key| >> |decoding key|?

I'm looking for an encoding scheme that requires a very large encoding key E (>10MB) and suffices with a relatively small decoding key ...
8
votes
3answers
1k views

What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
12
votes
4answers
2k views

Is compressing data prior to encryption necessary to reduce plaintext redundancy?

As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy. I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
1
vote
1answer
328 views

BigInteger in Java and Randomness

I'm looking for some PRNGs and – as I have been using Java for a long period of time – I thought that the BitInteger class, together with the ...
7
votes
2answers
4k views

How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
1
vote
2answers
304 views

Factoring a polynomial over a GF [closed]

I have the following question: What polynomial, when factored over the field $GF (2^8)$ based on the irreducible polynomial that is used in Rijndael, will factor into all the polynomials in the ...
4
votes
1answer
239 views

Is a subset of a random set still random?

Suppose you have an infinite list of random bytes, and you select the first N bytes that correspond to printable ASCII characters. Is this list of N bytes still as secure (e.g. for the purpose of a ...
5
votes
2answers
461 views

Checking a key before actually using it

I have a block of data crypted using twofish with a key of 128 bit. The data must be accessed from a GUI, the user gives the key, the block is decoded and the real data is accessed. Problem is that ...
8
votes
1answer
899 views

How realistic is a dictionary attack on a secure remote password protocol (SRP) verifier?

I'm deploying a secure remote password protocol implementation and I'm wondering what the consequences are when the client generated verifier gets leaked to an attacker. I've read Thomas Wu's paper ...
6
votes
2answers
290 views

Unit testing a library RNG and its seeding for practical security

Suppose I have a cryptography library that provides me with a black-box random number generator that is supposed to be suitable for long-lived key generation. (Under the hood it may be assumed to use ...
2
votes
1answer
113 views

Secure Remote Protocol - Are these 2 equations equivalent?

I'm implementing the Secure Remote Protocol that is specified to have this equation for the parameter S, the premaster secret. ...
4
votes
2answers
1k views

Order Preserving Encryption for Numeric Data Values

How can I ensure order of encrypted data i.e., Enc(m1) < Enc(m2) where m1 < m2, and all messages are integer values. I have gone through Order Preserving ...
6
votes
4answers
24k views

Does the SHA hash function always generate a fixed length hash?

I'm using the SHA1/2 family of algorithms for a particular project. I was wondering if all the SHA algorithms return a fixed length hash regardless of the length of the data.
2
votes
0answers
196 views

john the ripper, usages [closed]

As evident from the site of john the ripper, JTR example, john can be used for finding password form a unix machine passwd file. can JtR be used to crack password ...
1
vote
1answer
233 views

Block ordering and security in a MAC?

To authenticate a message $m = m_1 \,\|\, \dots \,\|\,m_n$ the tag $t := F_k(r) \oplus F_k(m_1) \oplus \dotsb \oplus F_k(m_n)$ is used, where r is uniform random number $(0,1)^n$ and $m=(0,1)^n$. Even ...
4
votes
2answers
474 views

Is it generally possible to employ brute force methods when the encryption scheme is not known? Why or why not?

Lets say you are presented with an encrypted string of bits or text, and no other information. What would be necessary before you could apply brute force methods to decrypting the string? How would a ...
5
votes
1answer
137 views

If plaintext is random, how does it affect my choice of encryption algorithm?

I want to encrypt a key file, which is assumed to be truly random (generated with hardware RNG, for instance). Given that there are no patterns in the plaintext, what implications are there for my ...
6
votes
2answers
3k views

128 bit hash with least chance of collision

I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
9
votes
1answer
1k views

How should I check the received ephemeral Diffie-Hellman public keys?

In my application I'm doing a DH key exchange, where both sides generate their own ephemeral key. No static keys are used. I am trying to make my application resistant against an active attack and ...
9
votes
1answer
761 views

What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?

Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$. While I am unable to find a paper which directly ...
21
votes
3answers
42k views

RSA encryption with private key and decryption with a public key

When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?
3
votes
1answer
145 views

McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
5
votes
1answer
347 views

S-box Cryptanalytic Resistance

In DES, different S-boxes were tested for cryptanalytic resistance and the most secure one was chosen for the algorithm itself. How do different S-boxes offer different levels of security against ...
2
votes
1answer
83 views

Are there any signature schemes that protect against collusion by multiple parties?

Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
1
vote
1answer
704 views

Is this fixed length MAC unforgeable?

Consider the following fixed length MAC for messages of length $\ell(n)=2n-2$ using a pseudorandom function $F$: On input of a mesage $m_0||m_1$ ($|m_0| = |m_1| = n-1$) and a key $k \in \{0,1\}^n$, ...
5
votes
1answer
309 views

Why does RSA give better security on longer messages?

I am trying to understand the notion of RSA security. Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long. If the ...
11
votes
2answers
818 views

What is the purpose of using different hash functions for the leaves and internals of a hash tree?

I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
4
votes
2answers
235 views

Is SHA1 secure with such many inputs Z that Z = constant secret X + variable public Y?

Let me ask whether SHA1 is designed to be secure for the following case. You compute each SHA1 of many strings,for example 1 million, where each string is a concatenation of X+Y , where X is secret ...
4
votes
1answer
561 views

How is BCrypt secure when it uses a static dataset for blowfish hashing?

I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
3
votes
1answer
100 views

Is the following scheme secure for different cipher

Let's say I have two keys K1 and K2. two messages M1 and M2 of the same length. Cipher (E,D) 3 ciphertexts: C11, C12,C22 where Cij = E(Ki, Mj) In situation ...
3
votes
2answers
2k views

Why do all hash functions use big-endian data?

I've looked at several hash function specifications, and they all emphasize the need for big-endian byte ordering. Is there a reason for this that has to do with security, or is it simply convention?
7
votes
1answer
960 views

How does a “Tiger Tree Hash” handle data whose size isn't a power of two?

Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two. ...
4
votes
1answer
1k views

If you had to implement the BGN Cryptosystem, how would you do it?

If you had to implement BGN, how would you do it? I'm looking for an implementation of the public-key cryptosystem due to Boneh, Goh, and Nissim (aka BGN), or at least some suggestions on ...
11
votes
2answers
5k views

Predicting values from a Linear Congruential Generator

I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form: ...

15 30 50 per page