4
votes
2answers
132 views

Are there cryptographic hash functions with homomorphic properties? [duplicate]

Are there cryptographic hash functions that have homomorphism-like properties? E.g. satisfying following relation $h(a || b) = h(a) · h(b)$, where $h(x)$ is hash function itself, $x || y$ is ...
4
votes
1answer
66 views

CBC-MAC based on PRF

Why is the block cipher in the CBC-MAC taken to be a pseudo random permutation (PRP) and not a pseudo random function (PRF)? We don't need the bijective property of the PRP. So why go with it?
4
votes
1answer
146 views

Is hashing a list of hashes safe?

I have an arbitrary long list of hashes (e.g. git tree hashes), and I'm wondering by how much I am increasing the risk of hash collisions by condensing them into a single hash, like so: ...
4
votes
2answers
101 views

Combining two keys

What is the most secure way to combine two "random" keys X of size k (k ≤ 512 bits) and Y of size 512 bits in one key Z of size k? Result Z will be used for encryption/decryption with various ...
4
votes
1answer
71 views

Diffie-Hellman when $p$ and $g$ are pre-agreed and hidden from Eve

During a regular Diffie–Hellman public key exchange, Alice and Bob agree to use a prime number $p$ and a base $g$… which are both made public and are therefore also assumed to be known by Eve. Alice ...
4
votes
1answer
162 views

An unpredictable PRG is secure (Theorem Yao'82)

in the Mr Boneh's online course is stated the following theorem: Let $G:K \to \{0,1\}^n$ be a PRG. “Thm”: if $\forall i \in \{0, … ,n-1\}$ the PRG $G$ is unpredictable at pos. $i$, then ...
4
votes
3answers
126 views

Encrypting text file line by line with stable encryption

I want to store files in a secure manner (i.e. no one should be able to decrypt the contents of the file without the secret key) but I also want a diff tool to be able to show me which lines changed ...
4
votes
1answer
88 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
4
votes
2answers
101 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...
4
votes
2answers
171 views

Quantum key distribution simulation

I'm looking for a simulation of the Quantum Key Distribution protocol. Does anyone here have one that they could recommend?
4
votes
2answers
291 views

Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?
4
votes
1answer
119 views

Generating unsigned, bounded random value using signed bounded random values

Use case: I have a random number generator that can generate random numbers in a range that is limited by a number $x$, say $x$ ranges from $2$ to $2^{(n - 1)} - 1$ exclusive. In this case $n$ is ...
4
votes
1answer
159 views

Understanding hash entropy

I have been told that one advantage of using a hash function is that it spreads entropy over all input bits. But it also seems to be true that a bad hash algorithm can make things less random. But how ...
4
votes
1answer
158 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
4
votes
1answer
159 views

Is Chaocipher a secure cipher under ciphertext-only attack?

Chaocipher was invented by John F. Byrne in 1919. The algorithm was recently revealed – see Moshe Rubin's Chaocipher Revealed, the Algorithm (PDF). While a known plaintext attack successfully finds ...
4
votes
1answer
279 views

Can a commutative block cipher be indistinguishable from a random permutation, for fixed key?

Define a commutative block cipher with keyspace the finite set $K$, and data space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto E(k,x)\text{ ...
4
votes
2answers
304 views

Perfect Forward Secrecy with Pre-shared Key

I've recently been looking at how to do perfect forward secrecy on a unidirectional connection (server can only push messages to client, client cannot respond). What I've come up with is the idea of ...
4
votes
1answer
414 views

What are the advantages of CBC over ECB?

From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption ...
4
votes
1answer
228 views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
4
votes
1answer
139 views

Why does CBC-MAC need prefix-free inputs to be a good PRF?

In the FFX spec, there is a note about using CMAC as the round function. Security notes. The round function F is constructed in such a way that the set of inputs on which the CBC-MAC is ...
4
votes
2answers
182 views

How to Distribute the Shares using Secret Sharing for arbitrary Monotone Access Structures

Consider 4 people, $A$,$B$,$C$,$D$, & a secret $s\in\{0,1\}^k$. Construct a scheme which enables the following subsets of people to retrieve the secret $\{A,B\}$, $\{A,C\}$, $\{B,C,D\}$. I know ...
4
votes
1answer
128 views

When would one prefer a proof of knowledge instead of a zero-knowledge proof?

I've just realized I find it hard to distinguish between these two terms (proof of knowledge, and zero-knowledge proof), specially where only the latter seems to be used in many cryptographic ...
4
votes
1answer
2k views

Multiplication/Division in Galois Field (2^8)

I'm attempting to implement multiplication and division in $GF(2^8)$ using log and exponential tables. I'm using the exponent of 3 as my generator, using instructions from here. However I'm having ...
4
votes
1answer
192 views

hardware and software optimizations for Salsa20

I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG? ...
4
votes
3answers
204 views

Can padding length, and thus plaintext length, be considered public information when using aes-cbc?

Right now I'm using a simple padding system that takes the plaintext, hashes it with SHA512, and appends $x$ bytes of the hash as padding where $x$ is the delta between the plaintext and nearest ...
4
votes
2answers
243 views

Can we proxy-re-encrypt using homomorphic encryption schemes?

Homomorphic encryption schemes are PKE schemes with an additional special method Evaluate. The Evaluate method takes input any function (as boolean circuit) and encrypted inputs of the function and ...
4
votes
2answers
1k views

How can I remove my personal data from my PGP public key?

According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key. What steps do I have to follow in order to remove all ...
4
votes
1answer
815 views

Fast Salsa20 in java?

For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4. There are plenty of libraries in C, but are there any good ...
4
votes
2answers
90 views

Is it possible to insert a key derivation function when using EAX?

I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
4
votes
1answer
140 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
1answer
192 views

How to pad messages with large amount of padding

I'm playing around with an application for secure email-like communication and I want to perform length hiding padding on the plaintext messages so they always have a consistent size before encrypting ...
4
votes
1answer
341 views

Has GMAC mode a future outside GCM?

Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
4
votes
1answer
75 views

“proof of access” schemes

What is the state of the art way when implementing a scheme challenging a party to prove they have access to certain data? What I'm looking for something along the lines of Give them ...
4
votes
3answers
311 views

Is there a way to use Shamir Secret Sharing with updatable data?

I want to divide a system that maintains these properties, based on Shamir's Secret Sharing: A secret key is split up to N pieces, where T of them are enough to reconstruct the key. The original key ...
4
votes
1answer
545 views

Hashing passwords with a salt - why use different salt for everyone?

Given a database where we have usernames and passwords, we want to secure users' passwords by hashing them. We should not use only username and passwords in this hash, as someone having data from ...
4
votes
1answer
167 views

Future-Proof Versioning and Validation

I am working on a library (using standard primitives: AES256 CTR; HMAC with SHA256; PBKDF2 with SHA256, 128 bit salt, and 10000 rounds) to encrypt and decrypt data, given a password. The encrypted ...
4
votes
2answers
478 views

Attacks on the RSA Cryptosystem

I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem. Theorem (Coppersmith). Let $N=pq$ be an $n$-bit RSA modulus, where ...
4
votes
2answers
274 views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
4
votes
1answer
145 views

What authentication techniques can be used by QKD Systems?

As it is well known that QKD systems are prone to simple MITM attacks… what authentication techniques are being used in QKD to prevent those attacks in practice?
4
votes
1answer
89 views

Dimension of Encryption of a linearly dependent set of plaintexts

Suppose I have an encryption scheme of the form $ E(P)=C $ where $P$ is the plaintext and belongs in $\{0,1\}^N$, $C$ the ciphertext which belongs to $\{0,1\}^M$ and the encryption is performed under ...
4
votes
1answer
176 views

Why are there $ signs in my passwd file?

I am trying to get access to my eReader and I managed to get the passwd file. ...
4
votes
2answers
172 views

How can the Schmidt–Samoa cryptosystem uniquely decrypt large messages?

Suppose I choose $p=7$ and $q=11$. This gives a public key of $p^2·q = 539$. However, decryption occurs using a modulus of $p·q=77$. If a person chooses to encrypt $500$ using my public key, how ...
4
votes
3answers
1k views

Hash function in PBKDF2

From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
4
votes
1answer
413 views

Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...
4
votes
1answer
284 views

Is it secure to use the hash of key as the IV in AES encryption?

I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be ...
4
votes
1answer
473 views

How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
4
votes
1answer
364 views

How was the complexity of the Biclique Attack calculated?

The abstract of the Biclique Attack paper claims: The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$. What does $2^{126.1}$ mean in this context? And ...
4
votes
1answer
515 views

Does the Biclique attack on AES pose a credible risk to its security?

I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES. Exactly how close did they get? Does this attack propose a ...
4
votes
1answer
464 views

How is BCrypt secure when it uses a static dataset for blowfish hashing?

I'm planning on using this Javascript BCrypt implementation, but as you can see in the code, it uses a 4KB precalculated dataset for the P and ...
4
votes
1answer
1k views

How does PBKDF1 work?

I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5). What is the step behind this?

15 30 50 per page