7
votes
2answers
1k views

How does cryptanalysis of the Playfair cipher work?

I have a set of Playfair-enciphered data that I'm trying to crack without the key. I know I need to analyse bigrams; I've currently worked out what decrypts to th, <...
7
votes
1answer
341 views

Can non-assembly crypto libraries truly be secure against timing attacks?

http://cr.yp.to/antiforgery/cachetiming-20050414.pdf states the following: So what went wrong? Answer: NIST failed to recognize that table lookups do not take constant time. “Table lookup: not ...
7
votes
2answers
340 views

Is the HMAC construction really neccessary for a fixed length message?

The HMAC Construction is defined as: Hash( (Key XOR opad) || Hash((Key XOR ipad) || Message) ) This was designed because a simpler construction such as: ...
7
votes
3answers
557 views

Did non-military cryptography appear in 50's and 60's only due to NSA leaks?

I'm not talking about scytale, but encryption like RSA, DES, etc... How did exactly civil cryptography evolve after World War II?
7
votes
1answer
245 views

Is full Homomorphic encryption quantum resistant?

Since most of our asymmetric encryption algorithms are going to be out-of-date in a couple of year due to Shor's algorithm, I was wondering about the future of FHE schemes. I have found this paper, ...
7
votes
1answer
228 views

Is there any general description language for block ciphers?

In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that: The NESSIE project is also developing a new generic tool to analyze block ciphers ...
7
votes
1answer
246 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
7
votes
2answers
366 views

Is calculating HMAC from hashed input a good idea?

Original HMAC algorithm is as follows: H(K XOR opad || H(K XOR ipad || text)) What if text would replaced with H(text)? ...
6
votes
2answers
622 views

Meaning of “family” in “family of hash functions”

Many definitions related to universal hashing mention the term "a family of hash functions, say $H$". What does this 'family' mean exactly? A numerical example would be appreciated. Also, what does it ...
6
votes
2answers
437 views

Cryptanalysis and weaknesses of SEED cipher

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've ...
6
votes
2answers
2k views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
6
votes
3answers
8k views

PBKDF2WithHmacSHA512 Vs. PBKDF2WithHmacSHA1

I'm working on a Java authentication subsystem that specs the storage of passwords in the DB as PBKDF2-generated hashes, and I'm now trying to decide whether I ...
6
votes
3answers
352 views

What are the practical implications of ciphertext distinguishability?

Commonly there are four ways to "break" a secrecy-focused cryptosystem: Recover the secret key Recover the message Distinguish an encryption from random noise Distinguish the encryption of two ...
6
votes
1answer
288 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a co-...
6
votes
1answer
349 views

Low complexity implementation of a small blocksize cipher (< 64 bit)

Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE. This one in particular suggests using AES as the round function of a Feistel network. The ...
6
votes
1answer
1k views

Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
6
votes
1answer
1k views

How much entropy is lost via hashing when you add known or low entropy data?

(I updated the title, as I think there was some confusion as to the question) Here's the question: For example, if I have a bit stream that is 64K bytes long and there is about 16 *8 bits worth of ...
6
votes
2answers
545 views

Deniable Encryption from simple primitives

Is there a deniable encryption scheme $M = E(p_1,k_1,p_2,k_2,...,p_n,k_n), p_j = D(M,k_j)$ of $n$ plaintexts $p_1,p_2,...,p_n$ and $n$ keys $k_1,k_2,...,k_n$, such that we can fix $D$ to be a known ...
6
votes
1answer
440 views

Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
6
votes
1answer
164 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
6
votes
1answer
622 views

Does omitting the first two lines of RC4's pseudo-random generation algorithm weaken the cipher?

A particular educational software program published by a U.S. government agency uses a variant of RC4 to obfuscate its data files (see Stack Overflow question). The variant of RC4 in question is ...
6
votes
1answer
447 views

What's the reason for applying the hash twice when hashing with salt?

One of the typical approaches to computing a salted hash is this: hash(salt+hash(secret)) where hash is something like SHA-256 hash function - taking any size ...
6
votes
1answer
588 views

HMAC for short messages

I am using HMAC (hmac-sha256 to be precise) message authentication without encryption. My question is, is having a short message make it easy to determine what my secret key is? My C# code is as ...
6
votes
2answers
172 views

Purpose of DES parity bits

DES has a 64-bit key size, but only 56 of those are used during encryption. The other 8 are "parity bits". What was the intended purpose of the party bits, and why are they no longer used in modern ...
6
votes
2answers
2k views

What is the progress on the MIT LCS35 Time Capsule Crypto-Puzzle?

Ron Rivest posed a puzzle in 1999. MIT LCS35 Time Capsule Crypto-Puzzle. The problem is to compute $2^{2^t} \pmod n$ for specified values of $t$ and $n$. Here $n$ is the product of two large ...
6
votes
3answers
201 views

Is there an upper bound to the private exponent in RSA?

In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$. Then we calculate $d:=e^{-1}\bmod\varphi(pq)$. My question is: ...
5
votes
2answers
163 views

Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?

Given, say, the Blowfish block cipher, which is considered secure but only has a 64-bit block size, can we construct a secure block cipher of 128-bit block size? Say we run the key through two KDFs, ...
5
votes
1answer
215 views

What functions allow for practical indistinguishability obfuscation?

Recently, there has been a major theoretical breakthrough in program obfuscation, in the area of indistinguishability obfuscation. Background: Indistinguishability obfuscation is a form of program ...
5
votes
1answer
553 views

How to generate unique (random) numbers that can be traced back to a unique source number?

I need to generate unique (random) numbers that I can trace back to a unique source number. For example: source number A can generate numbers A1, A1, A3 .... Am source number B can generate numbers ...
5
votes
2answers
4k views

How large should a Diffie-Hellman p be?

In a Diffie-Hellman exchange, the parties need to agree on a prime p and a base g in order to continue. Assuming some ...
5
votes
1answer
137 views

How can I figure out a hash algorithm?

This may be trivial, and may be impossible... this is outside my field but willing to learn. I have a hardware device that accepts a network MAC address (6 bytes of data) like this: 38-60-77-EC-1D-33 ...
5
votes
1answer
290 views

What is the “compression function” in Merkle-Damgård?

Is the "compression function" in Merkle-Damgård just a collision-resistant, one-way hash function but one that operates only on fixed size inputs? If so, is MD just a way to extend it to work on ...
5
votes
1answer
271 views

HMAC construction based on the combination of two hash functions

I would like an $\operatorname{HMAC}$ that's based on two different hash functions ($H_1$ and $H_2$), so that a break of the combined $\operatorname{HMAC}$ would imply a break of $\operatorname{HMAC}(...
5
votes
1answer
423 views

Small subgroup confinement attack on Diffie-Hellman

I am trying to understand the small subgroup confinement attack on the Diffie-Hellman algorithm. I will present the attack and try to explain why it works. Small subgroup confinement attack on the ...
5
votes
3answers
218 views

Hash which can be used to verify one of multiple inputs?

Is there a hash function H1 which, when given inputs a, b, etc., produces output ...
5
votes
1answer
177 views

Digital signature for an expiring password

I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource. My idea is to digitally sign the current date with a private key ...
5
votes
2answers
278 views

Do test vectors ensure a cipher is free of backdoors?

If a cipher implementation passes unit tests using test vectors from some trusted source (these for AES, for example), then can we say that it is fully conforming to the specification, and must have ...
5
votes
3answers
721 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
5
votes
5answers
249 views

Is it better to encrypt before compression or vice versa?

Is it better to encrypt a plain text file before compression, or vice versa?
5
votes
4answers
1k views

Security proofs for CBC mode

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
5
votes
1answer
518 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
5
votes
1answer
565 views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
5
votes
2answers
1k views

How many bits can be safely extracted from the BBS generator at each step?

The Blum-Blum-Shub generator is a deterministic Pseudo-Random Bit Generator with security reducible to that of integer factorization. Setup: Secretly chose random primes $P$, $Q$, with $P\equiv Q\...
5
votes
3answers
577 views

Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and Dave,...
5
votes
2answers
301 views

Is $f(x)\oplus x$ a one-way function?

Given that $f$ is a OWF and $|f(x)|=|x|$ for all $x$, is $g(x)=f(x)\oplus x$ necessarily also a OWF?
5
votes
1answer
216 views

Why have round constants in hashes?

This may seem like basic crypto knowledge, but why do hash functions like SHA-2 and Whirlpool have round constants that are absorbed into their respective states? I can understand that in a cipher ...
5
votes
1answer
408 views

Toy encryption system that provides “hints”

I'm looking for a toy encryption system that has a specific property that when decrypting it with a key that is close enough to the key used in the encryption, it will produce some of the original ...
5
votes
1answer
161 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
5
votes
5answers
529 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
5
votes
1answer
89 views

Do low-entropy fingerprints actually make any sense?

I'm thinking of ZRTP and OTR in particular here. From my understanding, after a Diffie-Hellman session is initiated, the shared secret is then hashed into a 4-digit number, which the two parties can ...

15 30 50 per page