All Questions
12
votes
4answers
538 views
Can an Enigma-style cipher of sufficient complexity be considered secure in today's world?
Regarding the German Enigma machines, if I recall correctly, the reason they were defeated was because the Allies were able to generate a massive database of possible rotor settings, and because the ...
12
votes
2answers
949 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
12
votes
4answers
4k views
Basic explanation of Elliptic Curve Cryptography?
I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
12
votes
2answers
782 views
What are the main weaknesses, if any, of a Playfair cipher?
What are the main weaknesses, if any, of a Playfair cipher?
I know that they depend on none of the letters missing, but that is an easy fix if a letter gets dropped. Besides that, are there any other ...
12
votes
2answers
329 views
What is the general justification for the hardness of finding preimages for cryptographic hash functions?
Since most cryptographic hash functions are simple, compact constructions does this simplicity impose a limit on the complexity and the size of a function that can generate preimages? That is, given a ...
12
votes
3answers
863 views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
11
votes
2answers
539 views
Is SHA-512 bijective when hashing a single 512-bit block?
It's been said that CRC-64 is bijective for a 64-bit block.
It the corresponding statement true for SHA-2?
11
votes
3answers
1k views
For Diffie-Hellman, must g be a generator?
Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator?
Recall the mathematics of Diffie-Hellman:
Given public ...
11
votes
3answers
748 views
How robust is discrete logarithm in GF(2^n) ?
"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime p. However, there exist other finite fields out there, in ...
11
votes
1answer
816 views
No SHA-1 Collision? Yet SHA1 is broken?
Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)?
If the answer is no than how can SHA1 be considered broken?
11
votes
6answers
354 views
Can I encrypt user input in a way I can't decrypt it for a certain period of time?
I run a baseball league and would like to do silent auctions for free agents. This would require teams to enter their highest bid and the highest bidder at the end of the auction period would win. ...
11
votes
1answer
2k views
Why can't one implement bcrypt in Cuda?
I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there.
bcrypt is ...
11
votes
2answers
1k views
“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?
Similarly, what is the security difference ...
11
votes
1answer
379 views
How to provide secure “vanity” bitcoin address service?
Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
11
votes
3answers
324 views
What exactly is the impact of the hidden subgroup problem on cryptography?
I understand my group theory (allegedly), so I can make partial sense of The Hidden Subgroup problem:
Given a group $G$, a subgroup $H \leq G$, and a set $X$, we say a function $f : G \Rightarrow ...
10
votes
4answers
4k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
10
votes
5answers
632 views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively:
...
10
votes
8answers
845 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
10
votes
2answers
835 views
Why is H(k||x) not a secure MAC construction?
If H(m) is a secure hash function, can't we implement a MAC using H(k||m)?
However, it seems the more widely used MACs, such as NMAC and HMAC (both originally defined in Keying hash functions for ...
10
votes
3answers
1k views
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
At the current time, is SHA256 the de facto standard for strong cryptographic hashes?
From what I am seeing of more sites utilizing it, I would suppose the answer to this is yes, but would like to ...
10
votes
3answers
706 views
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?
Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
10
votes
2answers
342 views
Is digest=HASH(HASH(a)+HASH(b)) equivalent to publishing two digests?
Is combining digests (created using a hash function) using arithmetic addition, and then hashing and publishing the result, less secure than publishing the set of digests?
Does the answer change if ...
10
votes
4answers
473 views
About Cryptography in a Character Language
Suppose I had a message in Chinese (or another non-phonetic language) and I wanted to encipher it.
Some of the simplest encryptions in English are substitution ciphers, but such ciphers don't seem ...
10
votes
3answers
886 views
Known methods for constant time (table-free) AES implementation using 'standard' operations?
There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
10
votes
2answers
391 views
How long would the 100 Year Cryptography Project have secured its data had it been started 100 years ago?
The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 ...
10
votes
2answers
437 views
Why do we append the length of the message in SHA-1 pre-processing?
As we know, SHA-1 is irreversible, so why do we append the length of the message to the preimage?
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
10
votes
2answers
267 views
Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime.
Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
10
votes
3answers
2k views
Why is public-key encryption so much less efficient than secret-key encryption?
I'm currently reading Cryptography Engineering. After giving a high level explanation of the difference between secret-key encryption and public-key encryption, the book says:
So why do we bother ...
10
votes
1answer
995 views
What is a white-box implementation of a cryptographic algorithm?
What is a white-box implementation?
Does a white-box implementation have specific properties?
10
votes
4answers
233 views
Do parts of a hash carry the properties of the entire hash?
When I need to generate unique id's based on some information hashing is typical choice. However, sometimes that id needs to be of a particular size. I've seen a lot of schemes (HMAC-MD5-96 in SSH, ...
10
votes
3answers
577 views
Where do I securely store the key for a system where the source is visible?
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there.
I've ...
10
votes
3answers
533 views
How practical are side-channel attacks and how much of a concern are they?
I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like ...
10
votes
3answers
817 views
How well does scrypt perform on different architectures / OSes?
The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to ...
10
votes
2answers
247 views
Why use a 1-2 Oblivious Transfer instead of a 1 out of n Oblivious Transfer?
When initiating an oblivious transfer, why would someone use a 1-2 oblivious transfer rather than going for an 1 out of n oblivious transfer? Perhaps a slight time overhead for the extra message ...
10
votes
3answers
252 views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
10
votes
2answers
990 views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
10
votes
3answers
540 views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
10
votes
2answers
399 views
Encryption scheme for social-network-like data sharing data via untrusted server?
I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ...
10
votes
1answer
2k views
How to choose a padding mode with AES
Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None.
I ...
10
votes
1answer
337 views
Security of N bit HMAC
Lets say that I am using 128 bit HMAC. How many operations are needed to find "non secure" message. Is birthday attack possible?
10
votes
3answers
439 views
Could one construct a cipher that is secure for friendly parties to use but insecure for hostile parties?
Consider the situation of a nation state (Blue) at war with another nation state (Red). Blue wants to deploy a secure cipher that blue currently can not break, but they are considered that Red could ...
9
votes
3answers
413 views
Does NTRU decrypt correctly now?
The NTRU public-key cryptosystem has a lot of interesting properties (being resistant to quantum computer attacks, being standardized by several important bodies), but it also has a pretty unique ...
9
votes
2answers
534 views
Blum Blum Shub vs. AES-CTR or other CSPRNGs
Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
9
votes
2answers
778 views
What is the most practical fully homomorphic cryptosystem?
Craig Gentry recently gave the first fully homomorphic cryptosystem. Quite a bit of work has been done since extending his work. It seems, however, that no system is practical for real world use.
...
9
votes
5answers
2k views
Types of Cryptography for a 4-8 bit microcontroller
This is more of a research question.
I was wondering what types of crypto algorithms would work best on a small 4-8 bit micro controller. I recently read a paper called Security Considerations for ...
9
votes
3answers
542 views
Why does the padding in MD5 contain the message length?
I understand the need for padding in MD5. But why do we append the message length to the padding?
I heard it strengthens the hash but how?
Please provide an example if possible and how it applies to ...
9
votes
4answers
1k views
Encrypting small values with RSA private key
I'm looking for best practices when it comes to encrypting small (< 128 bytes) amounts of data with the RSA private key. Signing it would make the resulting payload too large.
9
votes
3answers
398 views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity ...
