1
vote
2answers
612 views

How many oracle calls to break an affine cipher in a chosen plaintext attack?

Assuming the ability to launch Chosen Plaintext Attacks (CPA), how many oracle calls does an attacker need to break the affine cipher? How does it work?
1
vote
2answers
557 views

DES generating the same ciphertext for different plaintexts and identical key

Is it possible to get the same output for DES while the inputs are different while using the same key? The key should not have to be a weak key. If yes could you give me a hint how to show how to do ...
1
vote
1answer
341 views

Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the ...
1
vote
2answers
529 views

Complexity of ECB and OFB

What is the complexity of ECB in terms of Time and Memory? and also in OFB? I can't find it in the internet, so I decided to ask it in here.
1
vote
1answer
448 views

File format of an $2048$ bits RSA public key

From here, there are $14$ bytes specifying the file format of the key. I am still quite confused about the format bytes. For example, the following public key 30 82 01 0a 02 82 01 01 00 8e a3 d1 c7 ...
1
vote
4answers
263 views

Difference between Pseudorandom Function vs randomly chosen function

I am currently going through a course in cryptography. In this, I stumbled upon Pseudorandom Functions. I got a little idea of Pseudorandom Generators which map an input string (key) to an extended ...
1
vote
4answers
680 views

Is the One Time Pad (OTP) considered a cryptographic hash function?

As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
1
vote
1answer
430 views

Attack an stream cypher using 2 XORed LFSRs

We know that the Key were generated by 2 16Bit LFSRs (output of both is XORed together -> key) I already extracted a 64 Bit key sequence, but how can I calculate the polynom of the LFSRs (and the ...
1
vote
2answers
694 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
1
vote
1answer
1k views

Static DH/Static ECDH certificate using OpenSSL

I've been searching for some time and have found no way to create a working certificate and private key pair with a DH or ECDH public key using OpenSSL. Once I do this, I'd like to sign it with an RSA ...
1
vote
1answer
261 views

Symmetric mutual authentication with client using a derived secret

I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
0
votes
1answer
81 views

What is the benefit of applying the tweak a second time using XTS?

I tried to understand the inner working of XTS. What I understood is that it is applying the tweak two times: once on the plaintext and once on the output. What is the benefit of applying the tweak ...
0
votes
1answer
157 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
0
votes
1answer
146 views

Simple example to describe Bilinear mapping

Notation : $\mathbb{G}$ is an additive group and $\mathbb{G}_T$ is multiplicative group of prime order $q$. Bilinear mapping $e: \mathbb{G} \times \mathbb{G} \rightarrow \mathbb{G}_T$ has to satisfy ...
0
votes
4answers
296 views

what is it called when encrypt('a') + encrypt('a') == encrypt('aa')?

So normally if you do encrypt('a') twice in a row you'll get the same result. But sometimes (as is the case in SSH) this is not desirable. You want encrypt('a') + encrypt('a') == encrypt('aa'). What ...
0
votes
1answer
667 views

Understanding multiplication in the AES specification

I am reading through the AES specification and am not able to wrap my head around the multiplication definition (section 4.2). Sorry to refer to a spec but AES is the holy grail in crypto so I hope ...
0
votes
1answer
1k views

How to implement order preserving encryption or order preserving hashing [closed]

Does anybody know any free implementation of either order preserving encryption or order preserving hashing? I've found some codes like CMPH but I need to dynamically add new DATA and that's why most ...
-1
votes
3answers
3k views

How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
-1
votes
1answer
12k views

Decrypt files with original file CTB-Locker [closed]

I have problem called CTB-Locker. It encrypted all of my files on computer and since I have lot of documents that are very important I am in problems! As I read online CTB-Locker uses "elliptical ...
12
votes
2answers
3k views

Why initialize SHA1 with specific buffer?

SHA-1 is initialize with a specific buffer: h0 = 0x67452301 h1 = 0xEFCDAB89 h2 = 0x98BADCFE h3 = 0x10325476 h4 = 0xC3D2E1F0? Why?
12
votes
3answers
1k views

Does composing multiple substitution ciphers improve security?

Will using two substitution ciphers one after the another be more secure than using single substitution cipher?
12
votes
1answer
451 views

Can one efficiently iterate valid bcrypt hash output values?

bcrypt is an intentionally slow hash algorithm. In my last protocol idea, I wanted to use it to expand a password and then only transfer the bcrypt-hashed password. An efficient attack on this would ...
11
votes
1answer
545 views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
10
votes
3answers
2k views

Why is the permutation in AES (and other ciphers) not random or key-dependent?

If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for ...
10
votes
1answer
1k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
10
votes
1answer
8k views

How does a birthday attack on a hashing algorithm work?

A "normal", brute-force attack on a cryptographic hashing algorithm $H$ should have a complexity of about $2^{n}$ for a hash algorithm with an output length of $n$ bits. That means it takes about $2^{...
10
votes
1answer
777 views

Why restricting SHA3 to have only two possible capacities?

I just read the presentation slides of John M. Kesley (from NIST) for his invited talk at CHES 2013 about SHA-3 and learned that NIST is going to standardize Keccak with a possibly modified padding ...
9
votes
1answer
409 views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
9
votes
2answers
242 views

In the Quadratic Sieve, why restrict the factor base?

In the Quadratic Sieve, when factoring a number $N$, many descriptions and most implementations select as the factor base the set of small primes $p_j$ less than some bound $B$ restricted to having ...
8
votes
1answer
285 views

Why was the Navajo code not broken by the Japanese in WWII?

In reading about this topic recently, to my understanding, the encryption schemes used on top of the Navajo language were very simple and definitely could have been broken (my research shows they ...
8
votes
3answers
2k views

Why programming languages don't provide simple encryption methods?

In c#, there is a namespace called System.Security.Cryptography and there are many classes in this namespace, which help developers encrypt and decrypt data. ...
8
votes
3answers
430 views

Security of a security protocol for key exchange, using symmetric-key cryptography

This is an exam question: $A \to B$: Alice, $nonce_A$ $B \to A$: $nonce_B$, $E_{k_{AB}}(nonce_A \| k_1)$ $A \to B$: $E_{k_{AB}}(nonce_B \| k_2)$ Alice and Bob both compute $k_s$ = $k_1$ xor $k_2$ $...
8
votes
1answer
118 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
8
votes
2answers
249 views

Is there any research on the problem of making a number more memorable to humans?

Authentication protocols often rely on humans dealing with large numbers correctly. For example, when a user logs into a remote machine using SSH for the first time, she is prompted to confirm that ...
8
votes
4answers
213 views

Is deniable error-correction possible?

This question came up as I tried to answer an earlier question I asked: cryptographic data structure wanted: sparse array without membership test. I still have not resolved that question to my ...
7
votes
1answer
243 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
7
votes
1answer
306 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
7
votes
2answers
419 views

Given enough RSA ciphertext, is it possible to determine which key was used?

Given enough RSA ciphertext, is it possible to determine which public key was used to generate the ciphertext? Presume an unknown public key that was used to generate RSA ciphertext, and we have ...
7
votes
2answers
305 views

Are there cryptographic hash functions with homomorphic properties? [duplicate]

Are there cryptographic hash functions that have homomorphism-like properties? E.g. satisfying following relation $h(a || b) = h(a) · h(b)$, where $h(x)$ is hash function itself, $x || y$ is ...
7
votes
1answer
236 views

Is full Homomorphic encryption quantum resistant?

Since most of our asymmetric encryption algorithms are going to be out-of-date in a couple of year due to Shor's algorithm, I was wondering about the future of FHE schemes. I have found this paper, ...
7
votes
2answers
361 views

Is calculating HMAC from hashed input a good idea?

Original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)? ...
7
votes
1answer
225 views

Is there any general description language for block ciphers?

In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that: The NESSIE project is also developing a new generic tool to analyze block ciphers ...
7
votes
3answers
554 views

Did non-military cryptography appear in 50's and 60's only due to NSA leaks?

I'm not talking about scytale, but encryption like RSA, DES, etc... How did exactly civil cryptography evolve after World War II?
7
votes
2answers
338 views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
7
votes
3answers
2k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
7
votes
2answers
1k views

How does cryptanalysis of the Playfair cipher work?

I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, <...
6
votes
1answer
345 views

Low complexity implementation of a small blocksize cipher (< 64 bit)

Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE. This one in particular suggests using AES as the round function of a Feistel network. The ...
6
votes
1answer
164 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
6
votes
2answers
606 views

Meaning of “family” in “family of hash functions”

Many definitions related to universal hashing mention the term "a family of hash functions, say $H$". What does this 'family' mean exactly? A numerical example would be appreciated. Also, what does it ...
6
votes
2answers
2k views

What is the progress on the MIT LCS35 Time Capsule Crypto-Puzzle?

Ron Rivest posed a puzzle in 1999. MIT LCS35 Time Capsule Crypto-Puzzle. The problem is to compute $2^{2^t} \pmod n$ for specified values of $t$ and $n$. Here $n$ is the product of two large ...

15 30 50 per page