21
votes
4answers
6k views
How can I generate large prime numbers for RSA?
What is the currently industry-standard algorithm used to generate large prime numbers to be used in RSA encryption?
I'm aware that I can find any number of articles on the Internet that explain how ...
15
votes
3answers
687 views
Is using slow password hashing on the client side easier attackable than on the server side?
As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
13
votes
1answer
400 views
Is this password migration strategy secure?
I want to upgrade the security of some existing databases of users' authentication tokens strictly for the purpose of making sure that if the database is stolen, attackers will not be able to guess ...
20
votes
1answer
1k views
Does the generator size matter in Diffie-Hellman?
For the Diffie-Hellman protocol I've heard that the generator 3 is as safe as any other generator. Yet, 32-bit or 256-bit exponents are sometimes used as generators. What is the benefit of using ...
9
votes
3answers
2k views
What is the relation between RSA & Fermat's little theorem?
I came across this while refreshing my cryptography brain cells.
From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
15
votes
4answers
5k views
Google is using RC4, but isn't RC4 considered unsafe?
Why is Google using RC4 for their HTTPS/SSL?
$ openssl s_client -connect www.google.com:443 | grep "Cipher is"
New, TLSv1/SSLv3, Cipher is RC4-SHA
Isn't RC4 ...
10
votes
3answers
865 views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
10
votes
1answer
1k views
What is a white-box implementation of a cryptographic algorithm?
What is a white-box implementation?
Does a white-box implementation have specific properties?
8
votes
1answer
425 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
7
votes
2answers
501 views
Desirable S-box properties
What desirable properties should an S-box have?
My current standard selection process is to just pick them at random and verify that they fit the following criteria:
The probability that any random ...
20
votes
10answers
2k views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means; in theory, that all asymmetric encryption algorithms, such as RSA are now useless, due to the speed at which quantum ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
10
votes
2answers
1k views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
9
votes
1answer
229 views
What is the theoretical and practical status of mental poker?
I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg:
...
8
votes
1answer
331 views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
8
votes
2answers
2k views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
7
votes
1answer
202 views
Alice trusts Bob only when Bob trusts Alice
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.
Is this something ...
6
votes
2answers
374 views
What's is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV. Without any doubt the key should be kept secret. But what about the nonce and the IV. What's the main difference between them and their ...
6
votes
2answers
2k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
3
votes
3answers
599 views
Why is the IV passed in the clear when it can be easily encrypted?
The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
3
votes
4answers
955 views
How are timestamps verified?
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
13
votes
4answers
556 views
Is Wiener's attack on RSA extendable to larger keys with low hamming weight?
Using small private exponents with RSA improves performance.
However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
12
votes
3answers
808 views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
11
votes
3answers
1k views
For Diffie-Hellman, must g be a generator?
Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator?
Recall the mathematics of Diffie-Hellman:
Given public ...
11
votes
4answers
5k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
10
votes
8answers
897 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
8
votes
1answer
587 views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
7
votes
8answers
374 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
7
votes
4answers
301 views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
7
votes
3answers
532 views
Modern integer factorization software
What are the modern software packages that can be used to factoring large numbers into primes. By modern I mean developed and made public within the last 5 years. I'm interested in things that are ...
6
votes
2answers
321 views
Deriving Keys for Symmetric Encryption and Authentication
So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
6
votes
2answers
1k views
Predicting values from a Linear Congruential Generator
I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:
...
6
votes
5answers
2k views
Why do we need asymmetric algorithms for key exchange?
In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
5
votes
3answers
445 views
Converting a stream cipher into a block cipher
The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
4
votes
1answer
404 views
Is a second preimage attack on MD5 feasible?
What's the practical status of MD5 w.r.t. second-preimage?
Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
3
votes
1answer
206 views
Is quantum key distribution safe against MITM attacks too?
i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html
and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution
...
3
votes
3answers
463 views
What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?
How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related?
From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
1
vote
3answers
151 views
Message authentication codes construction
I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
0
votes
1answer
283 views
How do I generate a session key using the Diffie Hellman algorithm?
How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
11
votes
1answer
944 views
No SHA-1 Collision? Yet SHA1 is broken?
Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)?
If the answer is no than how can SHA1 be considered broken?
9
votes
3answers
472 views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
8
votes
1answer
185 views
Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
A recent paper by Göloğlu, Granger, McGuire, and Zumbrägel: Solving a 6120-bit DLP on a Desktop Computer seems to "demonstrate a practical DLP break in the finite field of $2^{6120}$ elements, using ...
8
votes
3answers
606 views
What is the use of REAL random number generators in cryptography?
I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.
However, I don't understand for what a real random number ...
7
votes
2answers
332 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
7
votes
7answers
665 views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
7
votes
1answer
377 views
Should I use the first or last bits from a sha-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a sha-256 hash.
Should I take the first bits or the last bits? Which of them ...
6
votes
2answers
524 views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
6
votes
1answer
263 views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
