1
vote
1answer
136 views

Ciphertext indistinguishability (IND-CPA) for symmetric cryptography

My understanding are these steps are necessary for symmetric cryptography to be IND-CPA: The adversary submits two distinct $M_0$, $M_1$ plain-texts to the challenger. The challenger selects one of ...
1
vote
1answer
47 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
3
votes
2answers
303 views

How do we operate IV+1?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
3
votes
0answers
104 views

Lowest number challenge scheme

Suppose Alice knows a secret number $a$, and Bob knows a secret number $b$. Is there a simple way for Alice and Bob to know who has the lowest number, without Alice & Bob exchanging their numbers ...
1
vote
1answer
26 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
4
votes
2answers
106 views

Allowing multiple password reset tokens, and a question on random number predictability

I have a few requirements for a password reset system, along with some questions at the end as to its security. Requirements The aim is to provide a password reset mechanism satisfying the following ...
-1
votes
1answer
39 views

PGP message integrity : How can receiver of an email check the integrity using the sender's public key?

PGP message integrity: Basically, only private key can decrypt message encrypted with public key. But in the message integrity service in PGP does the reverse, where the Hash of the message if ...
2
votes
1answer
76 views

Use AES-256 Or AES-CTR-256 For One Block?

I am have one block of data to encrypt that is 32-bytes long. Is it better to use the AES-256 primitive for this single block (not a stream) or AES-256-CTR, and also would there be any cons or pros to ...
4
votes
0answers
61 views

understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
5
votes
4answers
655 views

Encryption algorithm that produces dummy output on incorrect passwords

Background: I've been thinking about using encryption in the context of backing up files to untrusted locations (to the point of making the file publicly and widely distributed for practically ...
1
vote
1answer
132 views

Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
2
votes
1answer
105 views

How to calculate complexity of ElGamal cryptosystem?

How to calculate time and space complexity of ElGamal encryption and decryption as there are two exponentiation operation during encryption and one during decryption? Here is my code for encryption: ...
9
votes
0answers
103 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
5
votes
1answer
479 views

Is TripleDES 168bit vulnerable to Differential Cryptanalysis?

I was reading this paper. In the table-1 of the paper it says TripleDES (showing both 128bit and 168bit keysize) is vulnerable to Differential Cryptanalysis. It also says that AES (showing all three ...
2
votes
2answers
38 views

AES multiple devices to server communication

I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on ...
2
votes
1answer
89 views

What is the motivation behind Key-policy Attribute-based Encryption?

What is Attribute Based Encryption? has a nice explanation what both forms (Ciphertext-policy Attribute-based Encryption and Key-policy Attribute-based Encryption) are. My question is: what is the ...
5
votes
1answer
79 views

How to construct a next bit predictor from a distinguisher

I read the claim, without proof, that it is possible to construct a next bit predictor for any PRNG given an oracle distinguisher for that PRNG and vice versa. How do I prove that? A distinguisher ...
3
votes
1answer
101 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
2
votes
1answer
53 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
3
votes
1answer
131 views

AES VS PRNG+HASH+XOR

I was thinking of doing symmetric encryption using just hashing and simple XOR encryption. It would work as: Alice and Bob share a symmetric key Alice manages to send an (authenticated) IV to Bob ...
1
vote
1answer
180 views

Which of following new (2013) ECC curves is the most secure or efficient? [closed]

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
0answers
24 views

How to create new PGP key? [closed]

I'm using GNU GPG. I want to replace my old keypair with a new one, and I have a couple of specific questions as I haven't done this before! My keyring currently contains both the new and old ...
3
votes
1answer
195 views

Security equivalent to Diffie–Hellman problem?

I've been doing the security proof for one of my Theorem. Basically, given $g^a$, $g^b$, $g^{cb}$, $g$ and $c$ as known values. Is the problem of computing $g^{acb^{-1}}$ equivalent to the Diffie ...
3
votes
1answer
78 views

KDF based on HMAC-SHA-256

Is KDF based on HMAC-SHA-256(Hashed Message Authentication Code, Secure Hash Algorithm) algorithm a suitable option to generate symmetric key from the secret key? What is the basic funda, behind ...
13
votes
2answers
843 views

Is it safe to seed a random number generator from system time?

It seemed to me that the Bouncy Castle SecureRandom class for C#/.NET only uses DateTime.Now.Ticks as its seed by default. I ...
4
votes
2answers
78 views

Advantages of making streamcipher stream depend on plaintext?

Most descriptions that explain how streamciphers work (like the one on Wikipedia), tend to describe a model that boils down to a simple “$ciphertext = plaintext \oplus stream$”, where the stream is ...
3
votes
1answer
63 views

Decrypting an encrypted text out of order

Does there exist a cipher that can be encrypted twice with two different keys and then decrypted twice using either key first? For example: ...
1
vote
1answer
94 views

Rate my idea: is that a stronger GPG-like algorithm?

I came up with a simple idea but I don't know if it is really secure or not. I know that you shouldn't create any algorithm on your own. I'm just curious, that's all. Algorithm explanation: First ...
8
votes
4answers
644 views

Predicting PRNG given some of its previous output

I a have a question about PRNGs and this is my very first experience with them. I have the following generator that takes a 56-bit seed $p$ during initialization and then chooses both $X$ and $Y$ ...
1
vote
1answer
35 views

Process of dividing 168bit key into 56bit keys in TripleDES

I used TripleDES so many times but never thought about this. In TripleDES it requires 168bit ...
4
votes
6answers
562 views

Generate Elliptic Curve Private Key from User Passphrase?

I'd like to generate a private elliptic curve key from user input like pass phrase. Is the best way to do this with a key derivation function like PBKDF2? Is there a better way? Edit (based upon ...
4
votes
1answer
68 views

Turning PRPs in PRGs with a counter

I am following the Coursera Cryptography I course and I have the following question, I am a bit perplexed by the statement, in week 2 lecture "What are block cyphers?" that a counter-mode PRF is a ...
2
votes
2answers
65 views

OCB nonce usage

I've just come across this piece of code in Bouncy Castle's implementation of OCB Mode: ...
2
votes
1answer
54 views

Is it possible to deduce the value of a string when given its hash and multiples hashes of the string + other known strings?

To be clear, I have access to $H(S)$ and as many $H(S||K)$ as I want. Every string $K$ is known. Can I use the extra information to my advantage and try to deduce $S$, without requiring bruteforce? Or ...
2
votes
3answers
62 views

Can a EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
0
votes
0answers
17 views

Questions about self-signed Certificates' Fingerprints and Client-Server Interaction through SSL [migrated]

I have some questions about how the fingerprint function is performed. First of all, I have some knowledge about cryptography. However it seems to do not be good enough to understand hundreds of ...
1
vote
1answer
93 views

Importance of salt when deriving an encryption key

I'm very curious to know this and a bit confuses too: Suppose, I have two files encrypted using AES-128bit with keys PBKDF2-derived from the same password and the same salt. If an attacker does ...
3
votes
2answers
111 views

Polynomial representation of the affine part of the AES S-box

I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES” by Murphy and Robshaw) and I can't get it to produce the correct output. ...
1
vote
1answer
68 views

LFSR and Markov chain question [closed]

This may seem an elementary question about LFSRs, and their link to Markov chains. LFSRs show Markov chain behaviour in that there can be a transition matrix defined over the LFSR, this follows from ...
1
vote
0answers
73 views

Attacks on Full TripleDES [closed]

I have been reading about attacks and many of them work on specific rounds of TripleDES but not on full TripleDES. Is there any attack except brute force that works on full TripleDES? (theoretical)
4
votes
1answer
55 views

Are HMACs based on hashes with larger bit-lengths also more secure?

When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC. Does it increase ...
2
votes
2answers
133 views

How secure is using a pad (using xor) on a encrypted data, for the purpose of obfuscating/hiding the underlying encryption?

Edit: I know this isn't really a one time pad (as pointed out), though I don't really know what to call it aside from just a pad, I guess. I have been reading around (mostly various stackexchange ...
7
votes
1answer
244 views

Is there a cryptographic function or system in which it becomes HARDER to break as time passes?

Is there a function or system which is time depending in which the effort required to brute force the decryption increases with time? It is easy to break encryption from many years ago because ...
3
votes
4answers
322 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
6
votes
3answers
116 views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
1
vote
2answers
185 views

Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
2
votes
2answers
72 views

Storing encryption key

It's my first time using stackexchange! So, I am doing a password manager in Java. But now I am VERY confused because of the encryption. There will be the program login, where the user types its ...
1
vote
1answer
240 views

Can I crack an AES string if I have all these parameters?

This is for a challenge at followthewhiterabbit.trustpilot.com: We have a message for you. It’s 3ncryp73d and we want you to crack it. The decrypted message will contain further instructions. ...
-3
votes
2answers
122 views

pairing-based schemes

some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ...
3
votes
2answers
595 views

How long does it take to crack PBKDF2?

How much time will it take to crack PBKDF2 while using a 9 character password? I'm not specifying any specific system or platform. If a brute force attack is made using the best ever super computer ...

15 30 50 per page