All Questions
15
votes
4answers
5k views
Google is using RC4, but isn't RC4 considered unsafe?
Why is Google using RC4 for their HTTPS/SSL?
$ openssl s_client -connect www.google.com:443 | grep "Cipher is"
New, TLSv1/SSLv3, Cipher is RC4-SHA
Isn't RC4 ...
10
votes
3answers
819 views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
10
votes
1answer
1k views
What is a white-box implementation of a cryptographic algorithm?
What is a white-box implementation?
Does a white-box implementation have specific properties?
8
votes
1answer
401 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
7
votes
2answers
481 views
Desirable S-box properties
What desirable properties should an S-box have?
My current standard selection process is to just pick them at random and verify that they fit the following criteria:
The probability that any random ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
10
votes
2answers
1k views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
9
votes
1answer
219 views
What is the theoretical and practical status of mental poker?
I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg:
...
8
votes
1answer
314 views
Is H(k||length||x) a secure MAC construction?
If $H$ is a typical secure hash function, then $(k,x) \mapsto H(k \mid\mid x)$ is not a secure MAC construction, because given a known plaintext $x_1$ and its MAC $m_1$, an attacker can extend $k ...
8
votes
2answers
2k views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
7
votes
1answer
190 views
Alice trusts Bob only when Bob trusts Alice
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.
Is this something ...
6
votes
2answers
340 views
What's is the main difference between a key, an IV and a nonce?
What are the main differences between a nonce, a key and an IV. Without any doubt the key should be kept secret. But what about the nonce and the IV. What's the main difference between them and their ...
6
votes
2answers
2k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
4
votes
2answers
100 views
How to do a literature search
How do I do a literature search of the research literature on cryptography? Assume there's some topic in cryptography I'd like to learn more about; how do I search the cryptographic research ...
3
votes
3answers
566 views
Why is the IV passed in the clear when it can be easily encrypted?
The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
3
votes
4answers
906 views
How are timestamps verified?
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
13
votes
4answers
545 views
Is Wiener's attack on RSA extendable to larger keys with low hamming weight?
Using small private exponents with RSA improves performance.
However, it has been shown (Wiener, 1990) that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the ...
12
votes
3answers
793 views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
11
votes
3answers
1k views
For Diffie-Hellman, must g be a generator?
Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator?
Recall the mathematics of Diffie-Hellman:
Given public ...
11
votes
4answers
5k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
7
votes
8answers
366 views
Two mutually untrusted parties want to exchange data: how to ensure each one gets the data it needs?
I am trying to come up with what could maybe be a novel algorithm for an application I am writing. Client A has a file fA. Client B has file fB. Each party is untrustworthy and will try to rip off the ...
7
votes
4answers
294 views
Can I determine if a user has the wrong symmetric encryption key?
We're using the Objectivity/DB object database with a custom encryption plugin that encrypts serialized objects on disk. Encryption uses AES with a shared secret key held by all users. I would like to ...
7
votes
3answers
506 views
Modern integer factorization software
What are the modern software packages that can be used to factoring large numbers into primes. By modern I mean developed and made public within the last 5 years. I'm interested in things that are ...
6
votes
2answers
282 views
Deriving Keys for Symmetric Encryption and Authentication
So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
6
votes
2answers
1k views
Predicting values from a Linear Congruential Generator
I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form:
...
6
votes
5answers
2k views
Why do we need asymmetric algorithms for key exchange?
In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
5
votes
3answers
434 views
Converting a stream cipher into a block cipher
The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
4
votes
1answer
368 views
Is a second preimage attack on MD5 feasible?
What's the practical status of MD5 w.r.t. second-preimage?
Integrity of a piece of data is protected by an MD5 hash, itself assumed genuine. The data (and thus the hash) is known to the adversary. ...
3
votes
1answer
250 views
What is a smart card?
In many cryptographic protocols, some information is transmitted within smart cards. So, what is a smart card? Is it a physical card? What are they used for in cryptographic protocols?
3
votes
1answer
196 views
Is quantum key distribution safe against MITM attacks too?
i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html
and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution
...
3
votes
1answer
725 views
Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
1
vote
3answers
151 views
Message authentication codes construction
I was reading the paper $[1]$ and came across the scheme that I show below. While I understand the scheme well, I don't understand why they prepend a 0 to the block containing $r$ and a 1 to all other ...
0
votes
1answer
269 views
How do I generate a session key using the Diffie Hellman algorithm?
How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
11
votes
1answer
843 views
No SHA-1 Collision? Yet SHA1 is broken?
Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)?
If the answer is no than how can SHA1 be considered broken?
8
votes
3answers
456 views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
8
votes
5answers
422 views
Is it feasible to build an index of prime factors?
Would it be possible to break an RSA key, in for example 1 week of time, if the cracker have already spent X number of years building an index of primes by performing every permutation of existing ...
8
votes
3answers
595 views
What is the use of REAL random number generators in cryptography?
I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.
However, I don't understand for what a real random number ...
7
votes
2answers
314 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
7
votes
7answers
662 views
How can I improve a password generation scheme based on a shared secret and URL?
I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
...
7
votes
1answer
363 views
Should I use the first or last bits from a sha-256 hash?
I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a sha-256 hash.
Should I take the first bits or the last bits? Which of them ...
6
votes
2answers
481 views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
6
votes
2answers
269 views
What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures
I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
5
votes
0answers
380 views
How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$? [duplicate]
Possible Duplicate:
How does one attack a two-time pad (i.e. one time pad with key reuse)?
I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first ...
5
votes
1answer
245 views
Why does a broken hash function undermine an HMAC?
For instance, what makes MD4 a bad choice for an HMAC? In this case I am asking about MD4 because its less than ideal. I know that a preimage attack can be used to undermine the system, but why? ...
5
votes
2answers
687 views
Strength of multiple hash iterations?
Is it correct that increasing the iteration possibly decreases the cipher strength but increases the amount of time it would take to find the original hash values if using brute-force on a given hash? ...
4
votes
2answers
226 views
Is the encryption of a hash a good MAC?
At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
4
votes
1answer
439 views
How does GPG verify succesful decryption?
How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)?
Is something appended to the clear text so there exist ...
4
votes
1answer
405 views
Linear Cryptanalysis
What is the principle of linear cryptanalysis, as applied to a block cipher ? For instance, this page gives the rough outline of differential cryptanalysis.
