6
votes
1answer
456 views

Does TLS use RC4-drop[n]?

According to many sources, the first few (n) bytes of the RC4 keystream are strongly biased, and therefore should be discarded before using the keystream to encrypt anything; this precaution is ...
6
votes
1answer
431 views

Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
6
votes
2answers
3k views

128 bit hash with least chance of collision

I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
6
votes
4answers
202 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
6
votes
1answer
95 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
6
votes
1answer
113 views

Non-deniability of data sent over TLS

Andy is going to connect to a server Selma over TLS. Later, Andy would like to be able to publish everything (the ciphertexts, the plaintexts, all his keys) and prove to a mediator what data he sent ...
6
votes
2answers
81 views

How to propagate error in variable-sized message?

I want to design a scheme to encrypt a variable-length message with a secret key, to provide confidentiality. The message is a short human-readable text string with byte granularity, let's say under ...
6
votes
1answer
514 views

Crack linear congruential generator knowing every other word in sequence

I need to crack one of the example of linear congruential generator. I have $X_{n+1} = (a \cdot X_n + b) \bmod m$ and I know every other word in the output sequence: ..., 3158, ..., 1888, ..., ...
6
votes
1answer
459 views

ECC considered secure in OpenSSL?

If I perform the following command: openssl ecparam -list_curves using my OpenSSL version (1.0.1f), it spits out the following supported curves: ...
6
votes
1answer
676 views

Interpretation of the results of NIST (p)NRG suite

I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result: ...
6
votes
1answer
337 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
6
votes
2answers
496 views

What are the pros and cons of deterministic site-specific password generation from a master pass?

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this: Pick a master username and a master passphrase. The username could be your ...
6
votes
1answer
241 views

repeated use of HKDF-extract on the same PRK

Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand. Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple ...
6
votes
1answer
339 views

Why use variable p, q, g for Diffie-Hellman?

In the book Cryptographic Engineering, it is said that fixing p, q, g for a key negotiation protocol based on DH is a bad idea (page 228 1st ed). But allowing for flexible p, q and g requires a lot ...
6
votes
1answer
526 views

Prove that textbook RSA is susceptible to a chosen ciphertext attack

Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed. So I use the fact that the ...
6
votes
2answers
489 views

A lower bound on the insecurity of CipherCloud?

CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ...
6
votes
1answer
261 views

How can I use Weierstrass curve operations with a=-3 for implementing operations for a=0?

I am working with golang's elliptic library. It implements functions on Weierstrass elliptic curves with $a=-3$. I need to make my own library that allows me to handle curves with $a=0$. I understand ...
6
votes
1answer
83 views

Is a composition of clocked entities a clocked entity in the UC model?

In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
6
votes
1answer
81 views

Calculation of the avalanche effect coefficient

Given a strict avalanche criterion matrix/dependence matrix for a hash function,how do I calculate the avalanche coefficient for it. I want to calculate a single parameter(value) which represents the ...
6
votes
2answers
175 views

How much entropy is generated by 'random' human keystrokes?

I'm wondering about using human input as an entropy generator. We all know humans are terrible at making up random numbers or keys or passwords. But what if we let a user 'randomly' type in some ...
6
votes
1answer
103 views

Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519. ...
6
votes
1answer
117 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
6
votes
1answer
175 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
6
votes
2answers
653 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
6
votes
1answer
145 views

Cryptography used for login and signing transactions

My bank uses a smartcard reader (separate module not connected to the computer) as depicted below: When I need to log into my account it provides me with a challenge and I need to provide some ...
6
votes
1answer
250 views

multiple keys via HKDF - whats better, one or two applications of HKDF-extract

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256. Which alternative ...
6
votes
1answer
314 views

Difference between actual attacks and theoretical attacks on SHA cryptographic series

Could anyone tell me what the difference is between a theoretical attack (Like the one done on SHA-1) and an actual, practical attack (Like the one done on SHA-0)? Is a theoretical attack a proposed ...
6
votes
1answer
363 views

Single-purpose symmetric encryption scheme for single files

I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design: ...
6
votes
1answer
279 views

Finding where I am in a linear recurrence relation

Suppose I have a linear recurrence relation $$a(n) = c_1 a(n-1) + \dots + c_k a(n-k) + d,$$ where the constants $c_1,\dots,c_k,d$ are given and the initial values $a(0),\dots,a(k-1)$ are given as ...
6
votes
2answers
161 views

Abstracting primitives and modes of operation

I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
6
votes
1answer
546 views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
6
votes
0answers
53 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] ...
6
votes
0answers
85 views

Is there a standardized tree hash?

SHA-1, SHA-2, and the standardized version of SHA-3 are all sequential. This is impractical for hashing very large files distributed across machines. Any sequential hash can be straightforwardly ...
6
votes
0answers
233 views

Parallel Pollard's Rho: Number of distinguished points

When using the parallel version of Pollard's Rho algorithm for discrete logs, each processor performs its own random walk to find distinguished points, and reports the starting point and the ...
6
votes
1answer
202 views

Is it possible to determine or estimate the period for Blum-Micali PRG?

The Blum-Micali is a cryptographically secure pseudorandom number generator. The construction (from wikipedia): Let $p$ be an odd prime, and let $g$ be a primitive root modulo $p$. Let $x_0$ be a ...
6
votes
0answers
215 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
6
votes
2answers
189 views

power consumption in a XOR

I'm trying to understand how a XOR affect traces of power consumption in a Differential Power Analysis on smartcards. What's the difference in energy radiated in a $1 \oplus 1$ and in a $0 \oplus 1$? ...
5
votes
3answers
722 views

Is it possible to reduce the size of an RSA key?

The details about what an RSA key is made up of are explained succinctly here. Is it possible to reduce the amount of data that's usually packaged with the (private) key and then derive it later?
5
votes
4answers
3k views

What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?

How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related? From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
5
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
5
votes
4answers
1k views

How to require two keyholders to decrypt a document?

I want to create a system to encrypt a document and store it with a 3rd party, but not have the 3rd party be able to decrypt it until some unspecified later date. It seems like the solution would be ...
5
votes
3answers
3k views

What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
5
votes
2answers
1k views

Why is this the inverse of a Enigma Machine rotor?

I am learning about how the Enigma Machine works and I found this example of one letter being encrypted by an Enigma Machine. It shows the letter "G" going through three rotors and then it goes into ...
5
votes
5answers
1k views

Is it theoretically possible to construct a string that contains its own hash value?

After saw the xkcd comic Self-Description, I wonder if it is theoretically possible to construct a self-descriptive string that contains its own hash value? Let's say the string's MD5 value is ...
5
votes
2answers
1k views

Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
5
votes
4answers
7k views

Is it fair to assume that SHA1 collisions won't occur on a set of <100k strings

I'm building a system that has to take file paths, and generate a unique name for each one. I'm planning on using SHA1 as the hash function. My question is: do I have to deal with possible collisions ...
5
votes
3answers
897 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
5
votes
3answers
3k views

Calculating the amount of zero bits to be appended to the message

From FIPS 180-3 Suppose that the length of the message, $M$, is $l$ bits. Append the bit $1$ to the end of the message, followed by $k$ zero bits, where $k$ is the smallest, non-negative solution ...
5
votes
3answers
426 views

How can two different passphrases unlock the same content?

I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts. It would be temping to think, that the IT admin's ...
5
votes
2answers
679 views

Which bitwise operations are used in SHA-256?

From the wikipedia entry on SHA-256 I'm a bit confused about which operations actually go into the algorithm. From the pseudo code it appears the operations are $\texttt{xor}$, $\texttt{and}$, rotate, ...

15 30 50 per page