21
votes
4answers
16k views

Basic explanation of Elliptic Curve Cryptography?

I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
21
votes
4answers
635 views

Necessity of Randomness of Salts?

Given the desire to have unique salts for each user of your system, is it actually necessary to create a cryptographically-random salt for each user? If your system already has some other unique user ...
21
votes
3answers
27k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
20
votes
3answers
886 views

Purpose of outer key in HMAC

From what I know, the HMAC constructions has two strength: It's resistant to length extensions Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
19
votes
6answers
342 views

advances in usability for cryptography/authentication

I'm wondering if there have been any recent advances (say, the past 5-10 years) in human usability for cryptography and/or authentication? By that I mean something that makes it easier for an ...
19
votes
4answers
2k views

With sufficient randomness, is XOR an acceptable mechanism for encrypting?

I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR." Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
19
votes
2answers
3k views

How were the DES S-box values determined?

It seems like the S-boxes in DES have essentially random values. How were these chosen?
19
votes
4answers
12k views

Recommended skills for a job in cryptology [closed]

First let me apologize if this is an ill posed question. Let me also note that I do not in any way seek a comprehensive answer, simply your thoughts on what makes for a valuable asset to a company ...
19
votes
3answers
1k views

Cryptographic Challenge: How to Say Something Confidentially to Snowden?

The Snowden situation raises an intereting cryptograpic problem. At present, how can something be sent confidentially to Snowden? Claim: I have no particular political orientation. The above ...
19
votes
4answers
10k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
19
votes
2answers
10k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
19
votes
3answers
3k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
19
votes
3answers
5k views

Is it possible to derive the encryption method from encrypted text?

Is it possible to identify the encryption method, or at least rule out some of them, by looking at the encrypted text? For example, if you have 3 encrypted strings where the first 10 characters are ...
19
votes
4answers
2k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
19
votes
2answers
5k views

What is entropy?

We discuss a lot of topics and use measures of entropy to determine how difficult it is for an attacker to be successful. What does entropy mean in the context of cryptography? How is entropy ...
19
votes
1answer
33k views

What is safer: ZipCrypto or AES-256?

Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
19
votes
5answers
5k views

Current mathematics theory used in cryptography/coding theory

What are the mainstream techniques borrowed from algebraic geometry (or some other branch of mathematics) which are currently used in cryptography/coding theory? I've only heard about a small subset ...
18
votes
5answers
6k views

What is the lowest level of mathematics required in order to understand how encryption algorithms work?

What mathematical fields of knowledge would be required in order to get a good understanding of encryption algorithms? Is it basic algebra, or is there a "higher education" mathematical field ...
18
votes
2answers
2k views

Blum Blum Shub vs. AES-CTR or other CSPRNGs

Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
18
votes
4answers
2k views

Why is plain-hash-then-encrypt not a secure MAC?

It seems that even in MAC-then-encrypt systems like SSL, something like HMAC is used rather than a plain hash. Why? Suppose we use some stream cipher; then why can't we use $Encrypt(m | H(m))$ as ...
18
votes
7answers
5k views

How can SSL secure a two-way communication with only one key-pair?

As I understand it, SSL involved the use of a public-private key pair. How does this enable two-way communication? Suppose I have some server with which I wish to communicate securely. I connect to ...
18
votes
1answer
1k views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
18
votes
1answer
984 views

Selective format-compliant JPEG encryption?

I am working towards building a format-compliant encryption system for pictures. The aim of it is to be able to obscure specific areas of a picture (i.e. faces, car license numbers...) while keeping ...
17
votes
9answers
3k views

Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
17
votes
3answers
3k views

SHA512 faster than SHA256?

I'm getting this strange result that SHA512 is around 50% faster than SHA256. I'm using .net's SHA512Managed and SHA256Managed ...
17
votes
3answers
3k views

Reverse engineering a hash?

I understand this may not be the best place to ask a question like this, but I believe that this community may be the best/only place I can ask such a question. I have inputs and outputs from an ...
17
votes
2answers
4k views

What exactly is a negligible (and non-negligible) function?

The mathematical definition of neglible and non-neglible functions is fairly clear-cut, but why they are important and how they are used in cryptography?
17
votes
2answers
4k views

understanding a length extension attack

I have been trying to understand exactly how a length extension attack works on SHA-1. I'll detail below what I've understood so far, so that I can convey my understanding of the same and hopefully ...
17
votes
5answers
3k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
17
votes
3answers
1k views

How secure is the Bitcoin protocol?

Are there any evidence (other than not being cracked so far) that the Bitcoin protocol is secure? "How secure" is it? (I realize that this might not qualify as a meaningful question - feel free to ...
17
votes
3answers
389 views

What differentiates a password hash from a cryptographic hash besides speed?

I understand that password hashes like bcrypt have the principal property of taking a long time to run, but I'm wondering what if anything about password hashes make them superior to merely running a ...
17
votes
1answer
3k views

Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?

I am from a web development background (I don't know an awful lot about cryptography or how the algorithms themselves work), so I am asking this question in simple terms. Consider a hash of the word ...
17
votes
3answers
1k views

Is using slow password hashing on the client side easier attackable than on the server side?

As we know, one should use a slow password hashing algorithm instead of a fast one for storing passwords, to hinder brute force attacks when the database is compromised. The problem with this is that ...
17
votes
1answer
4k views

Why can't one implement bcrypt in Cuda?

I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there. bcrypt is ...
17
votes
3answers
2k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
17
votes
1answer
628 views

How to provide secure “vanity” bitcoin address service?

Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
17
votes
1answer
885 views

How secure would HMAC-SHA3 be?

It would be possible to implement the HMAC construction with (draft) SHA-3, leading to HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 (the last 3 digits are the output size $\ell$, where ...
17
votes
0answers
501 views

Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$

Suppose you want to select a prime $p$ such that finding e.g. $log_2(3)$ in $\mathbb{Z}_p$ is expected to be either at least as hard as the general Discrete Logarithm Problem in $\mathbb{Z}_p$, or at ...
16
votes
4answers
4k views

How do we know a cryptographic primitive won't fail suddenly?

It took more than a decade from when MD5 looked like it was going to break to the point when it was actually broken. That's more than a decade of warning. How can we be sure that when our ...
16
votes
5answers
1k views

Is it feasible to build an index of prime factors?

Would it be possible to break an RSA key, in for example 1 week of time, if the cracker have already spent X number of years building an index of primes by performing every permutation of existing ...
16
votes
7answers
3k views

Is calculating a hash code for a large file in parallel less secure than doing it sequentially?

I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size. Normally, you sequentially hash the bytes of the files using a hash function (say, ...
16
votes
5answers
892 views

Why are primes important for encryption

Why are primes so important? Why can't we just use a random number? My guess is that it's because finding a random prime require more computing power, than finding a random number. Can anybody confirm ...
16
votes
6answers
7k views

Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ...
16
votes
5answers
2k views

Does RSA work for any message M?

I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
16
votes
2answers
10k views

How long does it take to crack DES and AES?

Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second. How long would it take for to recover a DES key, ...
16
votes
2answers
2k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
16
votes
3answers
2k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
16
votes
1answer
15k views

How does RSA signature verification work?

I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ...
16
votes
1answer
6k views

Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?

I'm wondering why we use encrypt-decrypt-encrypt sequence in 3DES with three keys instead of three times encryption with three different keys?
16
votes
3answers
1k views

How robust is discrete logarithm in $GF(2^n)$?

"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime p. However, there exist other finite fields out there, in ...

15 30 50 per page