2
votes
0answers
74 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
1
vote
1answer
159 views

Simplied DES why 10-bit key?

In Simplified DES algorithm, the plain text is 8-bit & the key is 10-bit, why is that, why can't both be of 8-bits each?
3
votes
1answer
61 views

Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
1
vote
0answers
15 views

References for cascade [closed]

I have found many sources against cascading encryption, however I am having trouble finding arguments FOR using cascading. AES-256 + BlowFish + RC5 etc... each with a different key. This is for ...
0
votes
0answers
15 views

Are the ECDSA public keys of a stable/fixed length relative to curve size? [duplicate]

I am working in an environment with strict bandwidth requirements, and we need predictable bit lengths of the stuff we send. We need to broadcast ECDSA public keys, and we are using OpenSSL to ...
2
votes
1answer
72 views

Can I shorten the large ECDSA public key output file from OpenSSL?

I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at ...
3
votes
2answers
144 views

Understanding the length b used in MD5

I am trying to understand MD5 hash algorithm from the link http://www.ietf.org/rfc/rfc1321.txt At first I was not able to understand padding of MD5. Then I asked a question in this link: To ...
2
votes
0answers
37 views

What is the canonical way of creating merkle tree branches?

I'm currently looking into creating some compact merkle tree branches to prove that a given hash was included in a given merkle root. My initial thought was to list the leaf, the merkle root and all ...
-3
votes
1answer
51 views

1 bit shannon entropy CPU instructions?

It has been proved, that the xor operator is suitable for entropy accumulation, due to its theoretical shannon entropy of 1 bit. There are six truth tables with ...
3
votes
1answer
60 views

Does a “commutative” asymmetric system exist?

Completely crypto noob here. I'm looking for a cryptosystem made of a func f + key1 + key2 such that they satisfy: g(f(msg, key1),key2)=msg g(f(msg, key2),key1)=msg key1 != key2 Does such a ...
4
votes
0answers
45 views

Security parameter p =O(n)

In many homomorphic encryption scheme, a security parameter is calculated as p =O(n). How to use the complexity order as values? Is there any specific method with an appropriate example?
3
votes
1answer
143 views

Is finding collisions in a part-hash not often enough a bad problem?

My situation: I've been working now for a couple of months on my own unique hash function, I've changed it many times and had two main versions but I won't bore anyone with the details of my work; at ...
1
vote
2answers
84 views

Homomorphic encryption diagram and trouble about a paper

I'm reading a paper based on Homomorphic Encryption: “Fully Homomorphic Encryption over the Integers: From Theory to Practice” (PDF). Now, I need a diagram of this algorithm if possible with all the ...
2
votes
1answer
296 views

Periodic One Way Function

Is there any notion of a periodic OWF? I.e. an OWF $f$ that on every input $x$ in its domain it holds that $f(f(f\ldots f(x))\ldots )=x$ when $f$ applied many times, each time on the previous ...
6
votes
2answers
199 views

Scrypt not “old enough” to be safe?

I just check all the questions with scrypt tag about that and usually it's said that scrypt is nice in theory and theoretically better than bcrypt and PKDF2, but it's too young to be "completely ...
5
votes
0answers
78 views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
1
vote
0answers
70 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
2
votes
1answer
50 views

Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
2
votes
1answer
83 views

Why is CBC-MAC with length appended not secure?

I've just read about CBC-MAC for the authentication of arbitrary length messages. In particular I cannot figure out why appending the message length before computing the MAC yields a non-secure MAC. ...
5
votes
1answer
441 views

To understand a fact related to padding in MD5

I'm trying to understand to padding process of MD5 from the link: http://www.ietf.org/rfc/rfc1321.txt In this link I have found the following description of padding: The message is "padded" ...
2
votes
2answers
141 views

Collision free one way function

I was playing with a function that I think is collision free and uninvertible assuming the hardness of integer factorization. I am unfortunately not as skilled at math as I would like to be, and do ...
1
vote
1answer
52 views

Can homomorphic operations on many different ciphertexts be multiplied by a same constant?

Assume Alice encrypts messages $m_1$,...,$m_n$ using secret keys $k_1$,...,$k_n$ on a homomorphic encryption scheme (BHHO), so she would get $c_1=Enc_{k_1}(m_1)$,...,$c_n=Enc_{k_n}(m_n)$. Then Alice ...
2
votes
0answers
45 views

compact rsa private key format

As shown in Why does my SSH private key still work after changing some bytes in the file? a typical RSA private key file contains. The public modulus $n$ and exponent $e$; The private ...
1
vote
0answers
63 views

Encryption used in a commercial software product [closed]

I found (through some reverse-engineering) that the following encryption scheme is used in a commercial software that is quite widely used in Germany (Security by obscurity at its best). I have the ...
5
votes
0answers
70 views

Why is AES-SIV not used, but AESKW, AKW1?

I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ...
1
vote
1answer
41 views

Elliptic ElGamal Public Key Cryptosystem doubt

I need an example of Elliptic ElGamal Public Key Cryptosystem. I have been trying with some values but I don't get the right solution. I have $p=13$, the elliptic curve $E:y^2=x^3+11x+7$ and a point ...
7
votes
2answers
385 views

Need for salt with IV

I have mainly referred to this question. Definitely in case of using a salt, IV has a use of adding randomisation to each and every key. But isn't it redundant in case of using an IV to use a salt? ...
2
votes
1answer
63 views

Proven secure scheme under random oracle

Currently I am trying to understand random oracle model in order to make a small presentation about it but I seem to be very confused about it. Since it's an hypothetical model without a real life ...
2
votes
1answer
58 views

How to test an implementation of a homomorphic scheme?

I want to implement the following homomorphic encryption scheme from On-the-Fly Multiparty Computation on the Cloud via Multikey Fully Homomorphic Encryption by Lopez-Alt et al. I use C++ and I want ...
0
votes
1answer
60 views

Steganographic embedding of an RSA-encrypted message into an image

The goal is to combine the RSA encryption system with the LSB steganography system in a BMP image. Since every pixel of the image is an integer between 0 and 255, if we choose $p$ and $q$ such that $N ...
2
votes
0answers
42 views

Recover secret $x$ when $c\equiv m^x \pmod p$ with public $p$ (modified)

Given an encryption system where $c\equiv m^x \pmod p$, $p$ is a known prime, 1. Is it possible to recover $x$ with a known plaintext attack? Given $(p,\text{factorization of }\varphi(p),m,c)$ 2. Is ...
3
votes
2answers
65 views

(Non-) Perfect Secrecy of Vernam Cipher Using $E(m) = m \oplus k \oplus \operatorname{rev}(k)$

Given the cipher $$E(k, m) = m \oplus k \oplus \operatorname{rev}(k)$$ where $\operatorname{rev}(k)$ is the reversed binary of $k$, how would one prove that the cipher is not perfectly secret. I ...
45
votes
1answer
3k views

Why does my SSH private key still work after changing some bytes in the file?

I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, ...
2
votes
1answer
63 views

Which values are used for an elgamal cryptosystem public key?

I know that – within the elgamal cryptosystem – the values of $a$ and $b$ are public. But which values are used to create public keys?
6
votes
4answers
486 views

Why can’t the public key exponent in RSA be negative?

I am looking at why certain public keys in RSA can't be used, such as: 2 and all other even numbers (since $\gcd(\phi,e)$ must equal 1) 1 (since the cipher text would equal the message) 0 (since the ...
10
votes
3answers
244 views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
1
vote
0answers
67 views

What can I do to improve my encyption method [closed]

I'm new to cryptography and I want to learn more. For me, the best way to learn about something that I have no experience with is to experiment and I've coded a very basic approach to a simple ...
8
votes
1answer
109 views

A general definition for cryptocurrencies

I am trying to find the definitions to several terms related to digital currencies. Unfortunately, I am always ending up on Bitcoin-oriented pages and websites which only take Bitcoin itself into ...
6
votes
3answers
564 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
3
votes
1answer
66 views

Is it secure to use hexadecimal data for IV instead of raw binary?

Is it safe and secure to use a function like bin2hex (which converts binary data to hexadecimal) on the binary output of functions like ...
6
votes
2answers
105 views

RSA: Proving that $p+q-1 < 3 \sqrt{N}$, where N = pq and p,q are prime?

I'm doing some research into attacks on the RSA cryptosystem and have stumbled across Wiener's attack. Within the proof there exists the statement "$p+q-1 < 3\sqrt{N}$". No proof is given for ...
-1
votes
1answer
33 views

Creating a custom 2 way encryption class [closed]

I am trying to make a simple 2 way encryption function that currently uses a substitute cipher for the encryption and an inverse substitution for the decryption. I want to move away from this ...
3
votes
1answer
31 views

What is PCT_SSL_CIPHER_TYPE_1ST_HALF?

I'm writing a tool to do security posture assessments of SSL/TLS services, and ran into an interesting result. I ran through all defined cipher suites to test which could be negotiated (like sslscan ...
-3
votes
1answer
58 views

How to calculate d in RSA for my number with this [duplicate]

I took the p&q value as 61 & 53 and n=3233 e=17 d=? How to find it? Plz help me...
4
votes
2answers
90 views

Do we have anyway of knowing if avoiding self-permutation in RC4 makes it any stronger?

OK, so lots of questions get asked about RC4 but I want to make mine specific and hopefully answerable. RC4 Design as I'm sure anyone reading this knows, uses self permutation in stage 1 of the KSA. ...
0
votes
0answers
38 views

Choise enother scheme to basises of lattice cryptosystem

In the lattice cryptosystem to find a good or bad basis we apply "hadamard Ratio". But in high dimension computing of this ratio is hard. dose any other scheme exist to solve this problem?
4
votes
1answer
107 views

What is an impure NIST true random number generator?

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components: The entropy rate provided shall be ...
3
votes
1answer
61 views

Is frequency analysis the only attack on a simple substitution cipher?

I understand that "anagramming" is often used after frequency analysis of a traditional substitution cipher, but anagramming requires prior frequency analysis to provide a starting point. Is there any ...
0
votes
2answers
106 views

Why IV does not have to be secret yet has to be random [duplicate]

The IV used in schemes such as CBC has to be random and unpredictable. But at the same time it does not have to be kept secret. If the IV does not have to be secret, why does it have to be random ...
5
votes
0answers
71 views

Rule 30 Cellular Automaton for Cryptography

Steven Wolfram of Mathematica uses a pseudorandom number generator based on Rule 30 for applications in Mathematica software but I would like to know if a pseudorandom generator based on Rule 30 is ...

15 30 50 per page