5
votes
4answers
6k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
5
votes
3answers
881 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
5
votes
3answers
426 views

How can two different passphrases unlock the same content?

I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts. It would be temping to think, that the IT admin's ...
5
votes
2answers
676 views

Which bitwise operations are used in SHA-256?

From the wikipedia entry on SHA-256 I'm a bit confused about which operations actually go into the algorithm. From the pseudo code it appears the operations are $\texttt{xor}$, $\texttt{and}$, rotate, ...
5
votes
4answers
820 views

Subverting the key generation step in RSA public key cryptography

I am interested in the ways the implementation of an RSA key generation implementation can or cannot be subverted so that the subverter has an advantage, but the owner of the key, and the people who ...
5
votes
3answers
732 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
5
votes
2answers
560 views

Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?

As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so: ...
5
votes
5answers
636 views

Do I need to prepare plain text before encryption?

When I want to encrypt chat messages (in ASCII) before sending, whether it brings some bit of security if I add some extra bytes to the message or shuffle it in some way? I can even try to make data ...
5
votes
2answers
846 views

uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
5
votes
2answers
2k views

Why can't the IV be predictable when its said it doesn't need to be a secret?

I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should ...
5
votes
3answers
651 views

Can I jettison MAC if I already have SHA1(M)?

I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...
5
votes
5answers
2k views

Crypto-Compression Algorithms?

I was wondering, whether there exist such algorithms/enciphering procedures which both compress and encrypt the input data. That means, for starters, the output will be both smaller in size and ...
5
votes
1answer
1k views

Confusing XOR notation in textbook sample solution

I am preparing for the midterm exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook makes this problem ...
5
votes
2answers
1k views

NTRU crypto from unseen.is; myth busting help

I am always on the look out for privacy enhancing technologies. I stumbled upon the service from unseen.is. I had a look at their site (specifically here) and even though I lack knowledge there are a ...
5
votes
3answers
317 views

Digital identification using steganography, can it be broken?

Digital identification using steganography, can it be broken? I have read a few articles saying that using an I.D. embedded in video, audio, etc can help track down the origin of a copyright ...
5
votes
3answers
791 views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
5
votes
1answer
3k views

Why must IV/key-pairs not be reused in CTR mode?

Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
5
votes
2answers
286 views

Is $f(x)\oplus x$ a one-way function?

Given that $f$ is a OWF and $|f(x)|=|x|$ for all $x$, is $g(x)=f(x)\oplus x$ necessarily also a OWF?
5
votes
2answers
5k views

Does SHA-1024 hash exist?

Does SHA-1024 cryptographic hash function exist similarly to SHA-512? If not, what's the reason for that? Links: SHA-2 at Wikipedia
5
votes
5answers
913 views

Would it be possible to generate the original data from a SHA-512 checksum?

So, I have a file that is XY Exabytes big. I create a SHA-512 hash from it. Are there any theoretical chances that I can retrieve the original data just from the sha512 hash? Also, are there any ...
5
votes
3answers
607 views

What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
5
votes
2answers
1k views

Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
5
votes
6answers
965 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
5
votes
2answers
294 views

Do MD5's weaknesses affect Oplop?

Oplop is an algorithm that generates account-specific passwords from a master password and user-chosen nickname (typically username@domain). From the website: Concatenate the master password with ...
5
votes
4answers
1k views

Webapp password storage: Salting a hash vs multiple hashes?

For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better. But, if bad guys steal your ...
5
votes
3answers
1k views

Is the number of creatable torrents limited?

Currently, a magnet link containing a 40-digits long SHA-hash value, is assigned to every torrent which is created. Therefore, this hash should be unique to identify a torrent and send the right bytes ...
5
votes
1answer
824 views

Why does applying 56-bit DES twice only give 57 bits of security? [duplicate]

Given two 56-bit keys, $k_1$ and $k_2$, why does $E_{k_1}(E_{k_2}(M))$ only give 57 bits of security? So basically I'm unsure why it only gives 57 bits of security; I understand that one key will ...
5
votes
2answers
464 views

What makes an algorithm “fast in software” vs. “fast in hardware”?

When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher ...
5
votes
3answers
321 views

How do I generate a number for a lottery and later proves its existence

I want to create a lottery that works like this: I choose a secret number A in the range [0:999] and publish an object B. People must try to guess the number A to win. When somebody wins, I want to ...
5
votes
1answer
635 views

Is TripleDES 168bit vulnerable to Differential Cryptanalysis?

I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
5
votes
3answers
2k views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil ...
5
votes
3answers
2k views

How to perform authentication without central server in P2P?

How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority? ...
5
votes
4answers
1k views

Is it possible to create an open-source SecurID?

As far as I understand it, the hardware key-fob two-factor systems such as RSA SecurID depend on secret algorithms, and employ tamper-resistant hardware to prevent reverse engineering. Is there some ...
5
votes
3answers
1k views

Convert old and busted password encryption to something sensible

Given a TOTALLY HYPOTHETICAL scenario in which passwords for over a million accounts in over 200 databases have been stored using 3DES, a key derived from a (single) MD5 hash of a customer-controlled ...
5
votes
4answers
541 views

How is it possible to parallelize a hashing function to crack an iteratively hashed password?

Suppose I have an algorithm that relies on multiple iterations of a hash function like SHA1 to slow down an attacker trying to bruteforce a hash. ...
5
votes
3answers
3k views

Do I have to recompute all hashes if I change the work factor in bcrypt?

The well-known article about why we should use bcrypt for hashing passwords mentions the work factor - some parameter to the algorithm that determines how long one hashing should be in terms of number ...
5
votes
2answers
330 views

Is there a hash algorithm that is slow to calculate but relatively fast to check?

Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took?
5
votes
5answers
299 views

In storing passwords in a database should I use a per-application salt in addition to a per-secret salt?

Assuming that the salts are sufficiently long (16 random chars) is there any advantage in using a per-application salt in addition to a per-secret salt when storing hashed passwords in a database? ...
5
votes
3answers
334 views

What other one-way functions are used in cryptosystems?

For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties ...
5
votes
2answers
215 views

How are constructs with data-dependent swaps and rotations cryptanalyzed?

Linear and differential cryptanalysis seem well suited for constructs with a (relatively) simple fixed structure of boolean expressions. But some ciphers incorporate swaps of array elements where the ...
5
votes
3answers
268 views

Order of MACing and Encrypting in TLS

I've been working through how TLS1.0 works, and think I've basically understood most of it. One thing I can't seem to find a explanation of though is the order in which MACing and encrypting should ...
5
votes
2answers
180 views

Is there a cryptographic algorithm which is immune to side channel attacks?

Is there any cryptographic algorithm immune to side channel attacks based on scan chain? In VLSI point of view.
5
votes
2answers
1k views

Is RSA key size the size of private key exponent?

I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the ...
5
votes
2answers
1k views

What are Cryptographic Multi-linear Maps?

I've encountered this term many times in the fields of Fully-Homomorphic Encryption and Obfuscation. I want to learn those subject and Cryptographic Linear Maps seems to be an obstacle in the way. ...
5
votes
2answers
748 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
5
votes
2answers
1k views

Leaving authentication data blank less secure for AES GCM?

The AES GCM example for Ruby / OpenSSL shown at: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html has a GCM example of the following: ...
5
votes
4answers
821 views

Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)

I have a question about Pseudo Random Functions. Let $f:\{0,1\}^m \times \{0,1\}^n → \{0,1\}^n$ be a secure PRF. Define $F(k,x) = f(k,x) - f(k, x-1 \bmod 2^{n}) \bmod 2^{n}$. Is $F$ is a secure ...
5
votes
2answers
1k views

What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
5
votes
3answers
694 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
5
votes
2answers
1k views

Why is sharing the seed and using SecureRandom “deterministically” so bad?

I've recently been reading an article about "using cryptography to store credentials", and I would love it someone explained this in more detail… Up until Android 4.1, Android used a SecureRandom ...

15 30 50 per page