2
votes
0answers
33 views

Password hashing in embedded systems

Are there good options for password hashing in embedded systems? These systems often cannot afford slow has functions. I can think of a few approaches: Store the (hashed) passwords in a HSM that ...
0
votes
1answer
40 views

Attack being kind of completely puzzled?

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 4 the author wrote: Thus, after all, this belief about every attack being kind of ”completely ...
1
vote
0answers
33 views

Impact of Git's use of SHA-1? [closed]

Git uses SHA-1, and it is common to sign Git commit or tag hashes to authenticate a repo. Is this insecure now?
3
votes
1answer
119 views

Why does 0x00 make bcrypt weaker?

On the following site: https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence when talking about the dangers of using bcrypt it states: There is a nontrivial ...
1
vote
0answers
40 views

Is it safe to use a key as message in keyed hashing (HMAC)?

Scenario: User gives password. A "password key" is derived from the password (e.g. by PBKDF2). A random salt is applied. The password key is hashed with a HMAC algorithm (e.g. HMAC-SHA256), with ...
1
vote
2answers
92 views

How to show that this modification of CBC-MAC is insecure?

I'm working on some cryptography problems, found this and I'm not sure how to solve it: Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not ...
3
votes
2answers
700 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
21
votes
7answers
6k views

Why is OTP not vulnerable to brute-force attacks?

I saw this question on the book Understanding Cryptography. At first glance it seems as though an exhaustive key search is possible against an OTP system. Given is a short message, let’s say 5 ...
0
votes
0answers
40 views

Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
0
votes
3answers
133 views

Does RSA have two trapdoors?

I watched some videos from Khan Academy explaining the algorithm for RSA encryption/decryption. They explained that there are two trapdoors, modular exponentiation being one and prime factorization ...
0
votes
1answer
35 views

Probability of generating same master secret key in Identity-based Encryption

Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system ...
1
vote
0answers
63 views

Why is the compression function in Miyaguchi-Preneel scheme secure?

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I ...
1
vote
2answers
85 views

How to calculate entropy of output of a PRNG

Suppose the entropy of seed key is $H(n)$ which is $n$-bit long and random and the output bit length of the PRNG is $2^n$, which will be used as a long running key. Though it is obvious in that case, ...
1
vote
0answers
32 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
1
vote
1answer
52 views

Dangers of using CTR mode for encryption

I know that it is never suggested to use the same key or key/IV pair twice for a stream cipher or for a block cipher operating in CTR mode. Filesystem-level encryption reuses the same key for a file ...
0
votes
1answer
33 views

Is there an algorithm that allows verification that 2 encrypted or hashed bits of data are the same, given that I may only know half of the key/ salt?

We have an interesting problem. Currently, we store a salted hash of some secret key known only to the clients of our clients to allow us (and our clients) to find other records that were generated ...
0
votes
1answer
96 views

Key derivation using the main AES encryption key and some plain text

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
1
vote
1answer
33 views

The security of Hidden Field Equations - sentence

I am reading this paper "The security of Hidden Field Equations (HFE)" and at the end of the page 3 the author wrote: The random oracle paradigm would be to ignore that the function formulae ...
1
vote
1answer
33 views

Building multiple keys from the same input using a KDF [duplicate]

Let's say I have a single secret with high entropy, S, for the entire application. I want to generate keys K1, K2 for 2 ...
2
votes
1answer
61 views

Is it OK to reseed a Deterministic Random Bit Generator from itself?

I want a deterministic PRNG for simulation purposes, and I don't want to have to worry about spurious correlations like those the DMCT is designed to protect the Mersenne Twister against. So even ...
5
votes
2answers
156 views

Is there a security problem with this prime generation algorithm?

I am facing the following algorithm to generate an RSA public key: ...
3
votes
1answer
50 views

Identity-based proxy re-encryption using different system parameters

I am wondering if there is an identity based proxy re-encryption scheme (such as the Green-Ateniese scheme https://eprint.iacr.org/2006/473.pdf) that converts an encryption computed with ID1, system ...
5
votes
1answer
127 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
0
votes
0answers
44 views

Best/average/worst-case complexity for cryptography

I understand that the complexity of a problem can be measured by it's best-case, average-case, or worst-case complexity. Am I correct in thinking that, for cryptographic purposes, each of these is of ...
2
votes
1answer
141 views

Difference left-or-right CPA security, IND-CPA security

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to ...
0
votes
1answer
43 views

What about using AES-ECB with random IV?

Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it ...
17
votes
3answers
2k views

How to publish a cipher (concept)?

In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way. So ...
1
vote
1answer
43 views

How to deal with different setup in Multikey FHE?

The scenario : using a Multikey FHE scheme, let's say LTV-FHE scheme, parties delegate the computation of some function to the mighty cloud. In LTV-FHE scheme the parties generate their keys and ...
0
votes
1answer
49 views

Mathematical Proof for Key independence in Differential Cryptanalysis

How would you construct a proof that XOR difference of two cipher texts cancels the influence of the key? I started out with a simple cipher defined as follows: $C = \Phi( S(P\oplus K_{0}) \oplus ...
2
votes
1answer
64 views

Distinguishing two sets of pseudorandom values when their keys differ by one

Suppose we use a pseudorandom function $PRF$ and a random key $k$ to generate a set of pseudorandom values: $\forall i, 1\leq i \leq n: w_i=PRF(k,i)$ Now, consider instead of picking a fresh key, ...
-1
votes
1answer
39 views

Can shuffling plaintext produce a useable key?

If I 'shuffle' the characters in a long text, is there some number of shuffles that will produce apparent randomness approaching a cryptographically secure random number generator? A chapter in a ...
1
vote
0answers
28 views

Does SIV mode work for asymmetric crypto?

In ECIES and similar schemes, is it possible to use a hash of the plaintext as the IV?
0
votes
0answers
27 views

How does TLS differ from SSH from a strictly cryptographic perspective?

How does TLS differ from SSH from a strictly cryptographic perspective? I know that there are many non-cryptographic differences between them, but I would like to know the cryptographic ones.
1
vote
1answer
74 views

Ciphers providing Deniable encryption?

I stumbled on the concept of Deniable encryption on Wikipedia, with the following scenario: Deniable encryption allows the sender of an encrypted message to deny sending that message. This ...
3
votes
2answers
233 views

Constant time multiplicative inverse within a word

I was playing with an algorithm which at one step, calculated $f(x) = x^{-1} \mod p$ for $0 < x < p = 2^{64}-59$ (note $p$ is a prime). I used Knuth's Vol 2 Algorithm X algorithm for calculating ...
1
vote
1answer
53 views

SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297 With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen ...
0
votes
1answer
47 views

Collusion Attack CP-ABE

Suppose that there are Alice with attributes $A$ and $C$ and Bob with attributes $B$ and $D$. I have a ciphertext with this policy: $A\ \operatorname{AND}\ B$. Why don't users collude ? If Alice ...
2
votes
0answers
49 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
0
votes
1answer
58 views

Apple encrypted DMG volumes strength?

Apple OS X can create encrypted AES 128/256 DMG volumes. Here is written about a men who was able to hack it. And also that DMGs use PBKDF2-HMAC-SHA-1. I couldn't find more information about encrypted ...
3
votes
1answer
57 views

Is a random circuit likely to compute a one-way function?

I remember reading somewhere that (under certain reasonable assumptions) a Boolean circuit with many inputs and outputs (assume equal number for now) chosen at random will be a one-way function with ...
1
vote
1answer
63 views

Running time of Shamir's secret sharing scheme

Let $p>n$ be a prime number. The key steps in the $(t,n)$ Shamir's secret sharing is as follows: Steps of dealer: Choosing $s \in \mathbb{Z}_p^*$ Selecting $b_i \in \mathbb{Z}_p^*$ for ...
-1
votes
1answer
56 views

Should we use modulus switching when dealing with ciphertexts encrypted in different rings?

Having a homomorphic encryption scheme like BGV or LTV-FHE at some point it is possible in the homomorphic evaluation to deal with ciphertexts that are encrypted with respect to different moduli. ...
2
votes
1answer
402 views

Entropy calculation

I calculated the entropy for "variable", "property" and their concatenation "variableproperty" (with e.g. the Shannon Entropy) and got $2.75, 2.5$ and $3.33$ respectively. These are all entropy per ...
0
votes
1answer
46 views

How to implement oblivious transfer where probability of the receiver getting secret is exactly 1 out of 4? [duplicate]

As we know that oblivious transfer is done with probability of 1 out of 2. But how to implement it with probability of 1 out of 3 or 1 out of 4??
1
vote
1answer
77 views

When we turn Random shuffle to Pseudorandom Shuffle

It's well known that a simple but efficient random shuffle algorithm can permute a vector of $n$ elements in $O(n)$ time. In the algorithm, we need to pick a value $U$ uniformly at random where $0\...
6
votes
2answers
187 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
1
vote
0answers
64 views

Is $E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ PRF?

$E_{k}(x) = F_{k}(x) \oplus F_{k}( \bar x)$ and F is PRF which maps $\left \{0,1 \right \}^n \times \left \{0,1 \right \}^n $ to $\left \{0,1 \right \}^n$. Let two messages $m_{0} = 0^l $ and $m_{1} ...
-1
votes
1answer
53 views

application of algebra to cryptography [closed]

I have taken some courses on algebra like abstract algebra, linear algebra etc. I want to know more on the application of algebra to cryptography.I don't know if anyone can be of help. thanks.
2
votes
2answers
188 views

How to decode a (Vigenère?) substitution cipher? [closed]

I am trying to decode a message that I suspect has been encrypted with a Vigenère cipher: Utl zluuocp zsc rvzu hbcp ztvibfz vrabzz utl ilry. Utlal flal cb fbaiz, qszu zbsciz. Utvu cllihl vhzb dvil ...
5
votes
1answer
1k views

Confusing XOR notation in textbook sample solution

I am preparing for the midterm exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook makes this problem ...

15 30 50 per page