2
votes
1answer
77 views

Is it possible to combine two hash functions in such a way that cracking the constructed hash would require cracking the constituent hashes? [duplicate]

Suppose A is some arbitrary hash function, for example BCrypt or MD5. And B be some other arbitrary hash function, maybe SHA256 or SCrypt. Let ...
1
vote
1answer
58 views

How would an attacker perform an exhaustive key search on a block cipher using ECB mode?

Do you always assume from Kerchoff's principle, that the attacker has access to everything but the decryption key? That is, am I to assume that to perform an exhaustive key search, the attacker has a ...
6
votes
1answer
66 views

Is every point on an elliptic curve of a prime order group a generator?

If the order of elliptic group is prime then every point is a generator of that group. I tested the above statement on some elliptic curves and found it true. Does that really work on all curves? Is ...
0
votes
1answer
74 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
1
vote
1answer
37 views

Triple DES with 2 keys

Suppose triple DES is performed by choosing two keys $K_1$ and $K_2$ and computing $C = T (T (T (L, K_1), K_2), K_2)$. How to attack this modified version with a meet-in-the-middle attack, in which ...
0
votes
2answers
50 views
3
votes
3answers
195 views

Do sites store login password with hash? If so, can people can use hash collision to log in?

I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen: User A has the password 'hello' User B finds out the hash code of the password of ...
1
vote
1answer
27 views

If I am about to generate one-time pad, where should I generate my pads from?

If I want to generate a few one-time pads, is it OK to just read required number of bytes from /dev/urandom without weakening information-theoretical security?
1
vote
0answers
50 views

Yaos Millionaire Problem: Why distance >= 2?

I'm currently reading about Yao' Millionaire Problem: http://research.cs.wisc.edu/areas/sec/yao1982-ocr.pdf Alice and Bob want to know which of them is richer. Let $j \in \{1, \cdots 10\}$ be Bobs ...
4
votes
2answers
90 views

Probabalistic Polynomial-time Algorithms & One-way functions

I've been reading up on probabilistic polynomial-time algorithms and one-way functions, and I was hoping to get some guidance on the topic. A textbook I'm reading states the following for one of the ...
0
votes
0answers
23 views

What kind of analysis can I perform on my implementation of Salsa20 and Rabbit ciphers?

I've implemented both the Salsa20 and Rabbit ciphers in C#. My implementation is for academic purposes and I've tested both of them against the test vectors. I implemented a system that encrypts a ...
4
votes
2answers
102 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
3
votes
1answer
28 views

How are the IVs of SHA512/256 and SHA512/224 calculated?

This seems odd to me, because there are a lot of resources out there saying that the initializer values of SHA512 and SHA384 are the first 64 bits of the fractional parts of the square roots of prime ...
1
vote
2answers
102 views

Is multiplicative blinding less secure than additive?

It's easy to see that additive blinding (e.g., $x+r$ for secret x and random r) is perfectly secure in a finite field (this is a one-time-pad) and statistically secure for $r$ uniformly distributed in ...
3
votes
1answer
29 views

How much does using the same $H$ for all messages weaken GCM?

How much is GCM weakened by using the same MAC key $H = E_K(0^*)$ for all messages that use the same key (which is what GCM actually does) instead of using $E_K(N||0_{32})$ (which is different for ...
0
votes
0answers
50 views

Which AES encryption do banks use? [on hold]

I'm trying to find what size keys banks use for symmetric and asymmetric encryption. I know that the symmetric one is smaller because they want it to be fast but I can't find any information on their ...
1
vote
1answer
37 views

Is it safe to use fast/small hash for key identity?

I have to roll database access keys often, but it's important to know which key each system is using in order to avoid unavailability. I want the systems to report that without exposing the key ...
0
votes
1answer
78 views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
1
vote
1answer
127 views

CP-ABE for threshold cryptography

I would like to know if there is any research work using CP-ABE for threshold cryptography? I want to know also if applying CP-ABE for threshold cryptography would overcome other techniques.
4
votes
5answers
271 views

To what extent is WhatsApp's statement on secure messaging realistic?

As those of you who use WhatsApp Messenger probably know, with their recent update chats and calls are now encrypted. Here's what WhatsApp claims: Messages you send to this chat and calls are now ...
7
votes
1answer
329 views

Blinding twice in RSA

I understand that if you have a message $m$, you can blind it by selecting a random $r$ and then multiplying $r^e\times m \pmod{n}$ Someone else then signs it with $d$, raising to the power of $d$: ...
0
votes
1answer
15 views

Create composite group for pairing in JPBC

We use bilinear map $S = (G, G_T , e(\cdot, \cdot))$ of composite order $n = s \times n'$ with two subgroups $G_s$ and $G_n'$ of $G$. Random generators $w \in G$, $g \in G_s$, and $φ \in G_n'$ are ...
1
vote
0answers
47 views

Is it safe to encrypt data using XOR along with CSPRNG seeded with a truly random number?

I was wondering a couple of days ago whether I could reverse the normal encryption order to produce a good AES based cipher variant. The method is as follows: Two users, Alice and Bob, each have a ...
8
votes
0answers
163 views
+150

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
6
votes
1answer
51 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
4
votes
2answers
60 views

Strength of $H(k\|H(m))$ as a MAC algorithm

What is the strength of $H(k \| H(m))$ compared to HMAC? Compared to $H(m \| k)$? What is the strength in bits of a given key/output size?
0
votes
0answers
11 views

Can anyone tell whether combinational has higher frequency of operation than sequential or vice-versa?

I have designed SHA3 algorithm in 2 ways - combinational and sequential. The sequential design is giving frequency of operation as 700MHz while the combinational one is giving 0.5MHz so i want to ask ...
1
vote
1answer
166 views

Sorting over encrypted data with different symmetric keys

I'm working on a security project. I need to perform a sorting on the lists of encrypted integers and strings. The encryption used is symmetric. The clients send the encrypted data in a list to the ...
0
votes
1answer
26 views

Partial-Message Collisions on Iterated Hash Functions

In Cryptography Engineering by Ferguson et al it says the following is a problem with iterated hash functions: Because hashing $m$ and $m'$ leads to the same value, $h(m||X) = h(m'||X)$... for all ...
5
votes
1answer
74 views

Why do we use hex output for hash functions?

Why do we use hex representation as default for the output of a hash functions result? For example the sha256 hash function: the output of sha256 in hex representation uses 64 characters, while ...
2
votes
1answer
254 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = ...
0
votes
0answers
35 views

1-out-of-2 OT from Random 1-out-of-2 OT

Last week I came upon this problem in my h.w.: Let $OT^m$ denote 1-out-of-2 oblivious transfer of $m$ bit inputs. Let $RandOT^m$ denote the following primitive: The sender’s input ...
2
votes
3answers
296 views

What is the fastest block cipher in the (Intel) world?

In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than ...
0
votes
1answer
30 views

Homomorphic multiplication by a scalar

Few homomorphic encryption schemes like Paillier , Ring-LWE support homomorphic multiplication operation by a scalar apart from additive homomorphic property. Loosely they could be defined as below ...
3
votes
2answers
45 views

Is Schannel supposed to use SHA1 for (EC)DHE params?

I captured a TLS 1.2 handshake on my server (WIN2012.R2/IIS 8.5) and noticed that SHA1 is being used to hash ECDHE parameters despite both the server and client(s) supporting SHA2 signatures. ...
1
vote
1answer
37 views

Can I get successful signature verification with just altering message and signature?

Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I ...
2
votes
1answer
227 views

RSA signatures without padding

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
4
votes
3answers
174 views

Polynomials and efficient computability

In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT. It's clear that adversaries should be at ...
9
votes
2answers
144 views

Is there a way to optimize a linear scan while preserving anonymity?

I've been wrestling with a problem, and I was hoping if someone else had a bright idea. Here's the problem: I have two sides, Alice and Bob. Alice has a single high entropy string $A$, and Bob has a ...
-5
votes
0answers
64 views

Shamir secret sharing and homomorphism [closed]

Problem: Implement Shamir’s (k, n) Secret Sharing (SSS) scheme, with $k = 3, n = 5$, to (a) Find shares of a given set of numbers. (b) Compute average from shares (c) Choose any ...
4
votes
1answer
66 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
6
votes
2answers
5k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the ...
0
votes
1answer
89 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
0
votes
0answers
44 views

Deoxys: disadvantages vs. AES?

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
2
votes
1answer
54 views

Why is DSA falling out of favor?

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely ...
0
votes
1answer
64 views

Ciphers providing Deniable encryption?

I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario: Deniable encryption allows the sender of an encrypted message to deny sending that message. This ...
0
votes
0answers
10 views

Cryptographic key with editing safeguard [on hold]

I need to encrypt a number in a file, say 142345. It encrypts to EfsFjs or something else. I need a method that safeguards ...
0
votes
1answer
32 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
1
vote
0answers
22 views

Determining an encryption key when ciphertext and algorithm are known

I would like to know how I can tell that I have successfully performed an exhaustive search attack on an encrypted message. Here are the conditions: key is 40 bit I am aware of the cipher text and ...
0
votes
0answers
17 views

Is AES-256 bit encryption secure against this kind of attack? [duplicate]

Recently I came across this article. http://www.cs.tau.ac.il/~tromer/acoustic/ Could this put all computers at risk for decryption?

15 30 50 per page