4
votes
1answer
172 views

Why have round constants in hashes?

This may seem like basic crypto knowledge, but why do hash functions like SHA-2 and Whirlpool have round constants that are absorbed into their respective states? I can understand that in a cipher ...
4
votes
2answers
128 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
4
votes
1answer
548 views

ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
4
votes
2answers
320 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
4
votes
1answer
114 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
4
votes
3answers
214 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
4
votes
3answers
297 views

Cryptographic data structure: sparse array without membership test

I would like a data structure supporting two operations: $\mathsf{set}(k,v)$ and $\mathsf{get}(k)$, with the following properties: $k$ can be any number between $0$ and something impressively large, ...
4
votes
1answer
235 views

Encryption-Decryption-Encryption

I have learned from Applied Cryptography that triple encryption with three independent keys in encryption-decryption-encryption (EDE) process gives security not higher then $2^{2n}$ when it comes to ...
4
votes
1answer
156 views

Public key in fully homomorphic encryption over the integers

I'm reading “Fully Homomorphic Encryption over the Integers” by van Dijk et al. I wonder why $x_0$, which is a component of the public key, should be an odd number?
4
votes
1answer
578 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
4
votes
1answer
238 views

Solving Vignere Encryption

I'm currently trying to crack a cypher that I believe is Vignere Encrypted and I'm currently stuck. I calculated the key length by finding repeated sequences in the cypher and calculating the the ...
4
votes
1answer
465 views

Making my steganography code more hard to detect and crack

I'm doing a college project about digital image steganography on MATLAB. So far i've been able to get the help i needed from cool guys on stackoverflow but i now need to make my algorithm more hard to ...
4
votes
2answers
508 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
4
votes
4answers
867 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
4
votes
1answer
510 views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
4
votes
2answers
1k views

Why is the discrete logarithm problem assumed to be hard?

This might be a quite stupid question: since a naive brute force algorithm to solve the discrete logarithm problem will only take O(n) time for a group G with order ...
4
votes
1answer
283 views

How to attack this authentication protocol from “Cryptography: An introduction”

Consider the following protocol (from the book "Cryptography: An introduction", by Nigel Smart): ...
4
votes
2answers
260 views

Do test vectors ensure a cipher is free of backdoors?

If a cipher implementation passes unit tests using test vectors from some trusted source (these for AES, for example), then can we say that it is fully conforming to the specification, and must have ...
4
votes
1answer
195 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
4
votes
2answers
265 views

How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$. I know ...
4
votes
1answer
879 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
4
votes
1answer
1k views

HMAC-SHA1 input size

I know that the HMAC is a message authentication code that uses a cryptographic key in conjunction with a hash function (SHA1 , MD5, etc.). The HMAC output is 160 bits for HMAC-SHA160 and 256 bits for ...
4
votes
2answers
321 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
4
votes
1answer
184 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
3answers
466 views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
4
votes
1answer
317 views

How hard is it to generate a partial RSA fingerprint collision?

When I use SSH to log into a new system, I get asked to verify that the fingerprint (a 32 hex digits string) of the hosts's RSA key is correct. How much if it must I actually compare (by hand/eye) to ...
4
votes
1answer
147 views

low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
4
votes
1answer
997 views

Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
4
votes
1answer
651 views

Hill-cipher, disordered alphabet

I am going to apply a simple substitution cipher to my input, then encrypt the result with a Hill cipher. How can this be broken, in a chosen-plaintext threat model? In other words, instead of the ...
4
votes
1answer
1k views

Secure order preserving hash function

Is there a construction of an order preserving hash function that keeps the preimage property of a crypto hash function? By order preserving hash function (OPHF) i mean for $x<y$ then $OPHF(x) < ...
4
votes
2answers
656 views

Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy

I am trying to find the protocol with the least overhead, which still meets the following requirements: Server Authentication of server identity to client. The client has an authentic copy of the ...
4
votes
2answers
433 views

Can I combine two PRNGs to make use of more seed data?

I have 320 bits of seed data (actually 512 bits of data with 320 bits of entropy, derived from a Diffie-Hellman shared secret and nonces). The PRNG I am using at the moment is the android version of ...
4
votes
1answer
210 views

How can we determine if two discrete logarithms are equal?

Let $p$ be a prime number, and let $g_{1},g_{2},...,g_{n}$ be $n$ generator of $Z^{*}_{p}$. We have a list $y_{1},y_{2},\dotsc,y_{n}$ of elements in $Z^{*}_{p}$ such that for every $i\in ...
4
votes
1answer
985 views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
4
votes
1answer
703 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
4
votes
2answers
834 views

Is this a correctly formatted PGP session key packet?

RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this. Given this public key: ...
4
votes
1answer
494 views

Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ...
4
votes
2answers
206 views

Addition step in MD5 implementation

In MD5, there are four rounds. After every round, why do we need to add the computed $Q$ values to the initial values and then take this value as input to the next round. For example after the first ...
4
votes
1answer
489 views

Blind signature with openssl

I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
4
votes
0answers
121 views

RSA security assumptions - does breaking the DLP also break RSA? [duplicate]

Possible Duplicate: Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, ...
4
votes
1answer
2k views

What is the 'Version Incompatibility" Problem in TLS 1.1/1.2 and 1.0?

It's unclear to me if there are multiple problems, or a single one, (and just what that problem is) with servers incorrectly negotiating down from a client offering 1.1 or 1.2 to something they ...
4
votes
2answers
671 views

Does RSA padding have to be unpredictable if the payload is?

I'm trying to understand the precise requirements on padding when using RSA for encryption. Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
4
votes
1answer
623 views

Differential cryptanalysis - breaking the last round of FEAL4?

I've been trying to learn cryptanalysis. I've come across this resource which proved very helpful: http://theamazingking.com/crypto-feal.php So far I've been almost successful in breaking FEAL4 ...
4
votes
2answers
415 views

Provable Encryption

Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key? Alice chooses some plaintext, then she encrypts it with a certain scheme. She ...
4
votes
1answer
276 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
4
votes
1answer
1k views

How does a key wrapping like RFC 3394 secure my cryptographic keys?

So I'm messing around in the BouncyCastle library with the RFC 3394 AES Key Wrap engine and I'm trying to understand the benefit of it. The problem I'm running into is how to store keys securely on a ...
3
votes
1answer
65 views

How to perfrom modular division while numerator is lesser than the denominator?

I'm implementing point addition and point doubling of elliptic curve cryptography. The formula that I'm using for slope is Point addition: $S = \frac{(P_y-Q_y)}{(P_x-Q_x)}$ where $P$ and $Q$ are the ...
3
votes
1answer
44 views

May I use Random Oracle for Inversed Look-up?

Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, ...
3
votes
1answer
114 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
53 views

Memory hardness of key derivation function through XOR-ring multiple matrix values

For theoretical purposes in order to enhance my own understanding, and NOT in order to create my own cryptography, I am asking a question about the memory-hardness of a key derivation function ...

15 30 50 per page