15
votes
3answers
686 views

Is there an AES identity key?

The following questions are of pure theoretical nature. I don't have an application in mind. Is there a key that makes AES the identity function? Is there a key that makes AES the identity function ...
1
vote
2answers
82 views

Is a PRF applied to a secure MAC also a secure MAC?

Suppose I apply a PRF to a secure MAC. Do I still have a secure MAC?
2
votes
2answers
67 views

Obtaining Diffie-Hellman generator

In the Wikipedia article on Diffie-Hellman, the algorithm calls for a large prime modulus, $p$, and a generator, $g$, which is a primitive root of $p$. As far as my knowledge of number theory goes, ...
0
votes
0answers
29 views

Is it okay to bail out early when length mismatch is detected?

Is it okay to bail out early when length mismatch is detected? Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong ...
3
votes
1answer
103 views

Do 2DES and 3DES2 have the same effective key length?

I am following the notes "Introduction to Modern Cryptography" by Bellare and Rogaway, and on the chapter about blockciphers there is the following claim (page 11 of https://cseweb.ucsd.edu/~mihir/...
1
vote
1answer
134 views

AES implementation to encrypt files

I'm making a small python program to encrypt an arbitrary text file. Currently I have a file to store passwords (hashed values), so nothing stored in plaintext. The user enters the command line ...
0
votes
2answers
50 views

Order and cofactor of the base point? [duplicate]

What is the order and cofactor of a base point? Is it possible to deduct the order and cofactor, given just the basepoint. What about the other way around from order and cofactor to basepoint?
4
votes
1answer
67 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
3
votes
1answer
50 views

About the necessity simulators set adversary random-tape

In the ideal/real proof paradigm we sometimes find simulators with the capacity of set adversary random tape. My question: when do we have to consider the necessity of simulators set adversary random-...
4
votes
1answer
63 views

Does length-prepending stop length-extension attacks?

Does length-prepending stop length-extension attacks on Merkle-Damgård hash functions, assuming that the length is checked?
2
votes
1answer
54 views

Does XChaCha20 exist with similar properties to XSalsa20?

Does XChaCha20 (built from ChaCha20 just like XSalsa20 is built from Salsa20) exist and have XSalsa20's desirable properties?
1
vote
0answers
44 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
1
vote
2answers
130 views

Why can't NORX produce intermediate auth tags like Keyak can?

Why can't NORX produce intermediate auth tags like Keyak can? Keyak appears quite attractive because of this, but seems to be slow in the absence of hardware acceleration.
4
votes
1answer
66 views

Is ChaCha12 considered 256-bit secure?

ChaCha20 is considered 256-bit secure (no attack faster than brute force). However, the best known cryptanalysis that I know of is on ChaCha7. That gives ChaCha20 a rather large security margin (...
3
votes
2answers
369 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
0
votes
0answers
28 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
0
votes
1answer
54 views

Difference between HMAC-SHA1(key, msg) vs SHA1(key + msg) [duplicate]

Is there any practical difference from using HMAC-SHA1(key, msg) vs SHA1(key + msg) as a way to verify the authenticity/...
3
votes
2answers
269 views

Is it possible to decrypt cryptowall-encrypted files? [duplicate]

I am writing regarding a certain ransomware program called cryptowall (prop 4.0). I have lost many documents to this, and as it so happens, I have a few file duplicates before and after they were ...
1
vote
1answer
28 views

Generally accepted algorithm for two-pass, misuse-resistant AEAD that is efficient in software

I would like to know what the standard is for two-pass, nonce-misuse-resistant AEAD that is efficient in software. Thus, AES-SIV is excluded; modes based on a stream cipher like ChaCha20 are ...
1
vote
1answer
74 views

Is the identity function a one-way function?

The definition of the one way function says: it must be verifiable in polynomial time probability of inverting it less or equal to negligible Now, I am not sure I fully understand one way ...
2
votes
1answer
49 views

How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
24
votes
4answers
3k views

Are checksums essentially non-secure versions of cryptographic hashes?

Are checksums basically toned-down versions of cryptographic hashes? As in: they are supposed to detect errors that occur naturally/randomly as opposed to being designed to prevent a knowledgeable ...
4
votes
0answers
76 views

Secure entropy extractor for thermal noise collected from camera input?

I have read this paper (pdf) which talks about measuring the entropy of thermal noise collected from camera input. They estimate the minimum entropy at about 4 bits per pixel. Probably estimating 1 ...
0
votes
2answers
115 views

DIY over-encryption with a related key

I know next to nothing about cryptography, which is bad because I'm a programmer. I was exploring some code the other day and the encryption part of it seemed a little strange to me. I'd like the name/...
1
vote
1answer
34 views

Explanation of protocol secure under random oracle but insecure with any hash fuction

It is known that there is a protocol that is secure in the random oracle model, but where any real hash function makes the protocol insecure. The proof is constructive, but I could not understand the ...
3
votes
2answers
70 views

Misuse-resistant authenticated encryption based on SHA-3/Blake2b and AES-CTR/ChaCha20

I am wondering if the following is a useful misuse-resistant authenticated encryption scheme: Parameters (shared by many users): Choose a hash function $H$, such as Blake2 or Keccak. SHA2 could ...
4
votes
2answers
116 views

Example of a PRP that is not a strong PRP

The exact definition of security for a pseudorandom permutation is straightforward - for some encryption scheme $E\,\colon\,\mathcal{K}\times\mathcal{D}\rightarrow\mathcal{D}$, it must be the case ...
0
votes
1answer
39 views

Considerations on using a single long-term key for file encryption

I'm thinking about designing my own container file format that allows me to store a file in it along with, say, a thumbnail or other metadata. Some of these files are confidential and therefore must ...
3
votes
0answers
29 views

Can I get an explanation of HDCP's key exchange protocol?

I'm talking about HDCP v1.x. The specification is a too dense for me and easy-to-understand information about it on the net is scarce. What I've gathered is: that there is a master key that is a 40-...
1
vote
0answers
122 views

Fiat Shamir with S^3

I'm trying to do Fiat Shamir but with $I = S^3 \pmod n$ where $S$ is the secret key. How will I prove that I know the cube root? I tried doing the old formula but with instead with $(RS)^3 = x*I \pmod ...
0
votes
1answer
65 views

Hardware optimized stream ciphers?

As I understand it, ChaCha20 is slower than AES-CTR in hardware. Are there any hardware-optimized stream ciphers?
1
vote
1answer
53 views

How to create and validate potential grids when attacking a Playfair cipher?

First up: I am not asking you to decypher anything. This question is about attacking a Playfair cipher; more specifically – how to create potential grids when doing so. I'm currently working on a ...
0
votes
1answer
58 views

Proving a function is a one way function

I am trying to prove that a function is a one-way function. The function I am working on in particular is $f'(x,y)=f(x)||f(x \oplus y)$. For what I have understood looking at similar solved ...
1
vote
1answer
125 views

Is $f(f(x))$ a one way function?

I found from a book the following proof. Although I understand the initial construction, I don't understand the last sentence that proves the statement. Why $f(f(x))$, in the paper $h(h(x))$, is ...
2
votes
1answer
43 views

How would you name and/or describe this algorithm?

First up: this is not a decoding request or anything. This is about terminology. Twice per year, we email another department to ask for a new licence file for their software. They are always slow to ...
6
votes
2answers
744 views

Public key crypto without modular arithmetic?

This comment from Reddit math, in response to a statement about how people can communicate secrets to each other with a third party listening, has a very small, simple example of public key ...
0
votes
1answer
53 views

Negative lookup table concept

Interested in password cracking, I thought of a concept for lookup tables that can tell if a hash can be created using a dictionary in about O(log n) time. A simple overview of the idea is a follows: ...
2
votes
1answer
77 views

Can the key-complement property of DES be used against 3DES?

The comments in this recent question about the security of 3DES made me wonder if the key complement property of DES (which reduces its security by ~1 bit) can be used in the meet-in-the-middle attack ...
0
votes
1answer
38 views

Key sizes for RSA over elliptic curves

I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of ...
1
vote
1answer
38 views

Create a potential input for sha-256 hash given a substring of input?

Let's say I'm given a specific SHA-256 hash. Further assume that the SHA-256 input, that yielded this hash contained a known sub-string. Is there a way to find the input (containing the specific ...
0
votes
0answers
36 views

Encryption of both data and code [duplicate]

Suppose we have 3 parties: Alice possesses invaluable data $x_1, x_2, ...$; Bob can compute some extremely useful function $f$; Carol owns a world's largest data center which have enough resources to ...
1
vote
1answer
58 views

Why does a hacker need to crack the key to an encrypted file, instead of just brute forcing the password? [closed]

Most encryption softwares don't seem to have a trial limit. So why would a hacker need to crack the key, or even need to know the salt value, if he can just brute force the 6-8 digit password?
2
votes
1answer
133 views

Doubling the block length of a given block cipher

IMHO the main essence of a Feistel cipher of block length $n$ is the working of a non-linear function $F$ that is applied to the two halves of the block of length $n/2$. Now suppose a certain block ...
5
votes
1answer
42 views

Terminology for secret sharing

To my understanding, there are two "approaches" to t out of n threshold encryption. In both of them, n shares are given to different shareholders, and at least t of them must agree to "proceed". "...
0
votes
1answer
19 views

What will browser show when a user access website and website present certificate of some other domain with same top level domain [closed]

For example, User tries to access a.example.com and server presents abc.example.com with a.example.com not in SANs list. Will it be just a warning or an error?
0
votes
1answer
50 views

Usage of 3DES for single block

I have a device, HASP, which has functionality to encrypt 8 byte data using 3DES in ECB mode, with three different keys, I am interested how secure is this? I know it might not be most secure, but how ...
1
vote
2answers
173 views

PHP AES 256 CBC faster than AES 128 CBC? Or am I doing something wrong?

for last couple of days I'm learning a bit about encrypting data in PHP, as I need a good encryption/decryption function for storing user's passwords in DB. I use ...
1
vote
1answer
87 views

Can RSA with padding detect all errors in ciphertext?

I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly. First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we ...
1
vote
1answer
41 views

Attacks on MICKEY 2.0 Stream Cipher

I would like to know if there are any known attacks, besides from side-channel attacks (differential fault attack, correlation power analysis, template attack), against MICKEY 2.0 or MICKEY-128 2.0. ...
3
votes
2answers
120 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...

15 30 50 per page