10
votes
1answer
467 views

What is the theoretical and practical status of mental poker?

I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg: ...
9
votes
2answers
6k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
8
votes
2answers
970 views

Desirable S-box properties

What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ...
7
votes
3answers
3k views

In the SHA hash algorithm, why is the message always padded?

In the SHA hash algorithm the message is always padded, even if initially the correct length without padding; the padding is of the form "1" followed by the necessary number of 0s. Why is it ...
6
votes
1answer
409 views

Correct way to map random number to defined range?

Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX. What is the best way to map this random number to a ...
6
votes
4answers
2k views

How are timestamps verified?

You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
2
votes
2answers
4k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
20
votes
1answer
4k views

No SHA-1 Collision? Yet SHA1 is broken?

Is there a known pair of distinct bit strings (A,B) such that SHA1(A) == SHA1(B)? If the answer is no than how can SHA1 be considered broken?
18
votes
3answers
5k views

Is it possible to derive the encryption method from encrypted text?

Is it possible to identify the encryption method, or at least rule out some of them, by looking at the encrypted text? For example, if you have 3 encrypted strings where the first 10 characters are ...
15
votes
5answers
2k views

Does RSA work for any message M?

I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
11
votes
6answers
5k views

Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ...
10
votes
1answer
4k views

Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid

When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$. I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
10
votes
6answers
860 views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n ...
8
votes
1answer
1k views

From hash to Cryptographic hash

After reading some excellent papers on SipHash, I understood that good non-cryptographic hashes such as MurmurHash and CityHash are not secure for MAC usage, due to a certain type of DDos attack ...
8
votes
2answers
2k views

What's is the main difference between a key, an IV and a nonce?

What are the main differences between a nonce, a key and an IV. Without any doubt the key should be kept secret. But what about the nonce and the IV. What's the main difference between them and their ...
8
votes
1answer
1k views

How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
8
votes
3answers
2k views

Is it possible to validate a Public Key in RSA?

If I have a 1024-bit number, and someone is telling me that it is in fact a valid RSA public key, is there any way I can quickly validate that it is indeed so (without cracking RSA)? (I suppose I am ...
7
votes
1answer
854 views

Why Addition Mod 32?

I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
7
votes
2answers
2k views

Predicting values from a Linear Congruential Generator

I have learnt that Linear Congruential Random Number Generators are not cryptographically secure - my understanding is that given an LCG of the form: ...
7
votes
3answers
876 views

Using a Non-Random IV with modes other than CBC

The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
6
votes
1answer
1k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ...
6
votes
2answers
413 views

Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?

There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
6
votes
3answers
1k views

Why is the IV passed in the clear when it can be easily encrypted?

The initialization vector (IV) is exclusive or'd against the plain text before encryption for the first block sent in order to prevent an attacker from learning that duplicate message blocks are being ...
16
votes
1answer
4k views

Why can't one implement bcrypt in Cuda?

I had heard that although it's easy to implement message digest functions like MD5, SHA-1, SHA-256 etc. in CUDA (or any other GPU platform), it is impossible to implement bcrypt there. bcrypt is ...
15
votes
3answers
2k views

For Diffie-Hellman, must g be a generator?

Due to a number of recently asked questions about Diffie-Hellman, I was thinking this morning: must $g$ in Diffie-Hellman be a generator? Recall the mathematics of Diffie-Hellman: Given public ...
11
votes
2answers
227 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
11
votes
4answers
772 views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
9
votes
2answers
501 views

Can AES decryption be used as encryption?

Definition E: AES encryption D: AES decryption x: plain text y: encrypted text k: key In original AES cipher, encryption: y = E(x, k) decryption: x = D(y, k) Then I define the "reverse AES ...
7
votes
3answers
2k views

Why hash or salt when signing?

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
7
votes
3answers
806 views

Is RSA padding needed for single recipient, one-time, unique random message?

I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
6
votes
5answers
3k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
6
votes
1answer
1k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
5
votes
1answer
1k views

Low Public Exponent Attack for RSA

I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
4
votes
1answer
376 views

The difference between these 4 breaking Cipher techniques?

I'm trying to understand the difference between the following and what they actually mean : Known plaintext attack Known ciphertext attack Chosen ciphertext attack Chosen plaintext attack Any ...
4
votes
4answers
5k views

Why is padding used for RSA encryption given that it is not a block cipher?

In AES we use some padded bytes at end of message to fit 128/256 byte blocks. But as RSA is not a block cipher why is padding used? Can the message size be any byte length (is the encrypting agent ...
4
votes
1answer
1k views

Sending KCV (key check value) with cipher text

I was wondering why it is not more common to send the KCV of a secret key together with the cipher text. I see many systems that send cipher text and properly prepend the IV to e.g. a CBC mode ...
3
votes
1answer
613 views

What is a smart card?

In many cryptographic protocols, some information is transmitted within smart cards. So, what is a smart card? Is it a physical card? What are they used for in cryptographic protocols?
3
votes
2answers
1k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
14
votes
1answer
844 views

Should I use the first or last bits from a SHA-256 hash?

I have the need for a hexadecimal token that is smaller than the normal length of the hexadecimal representation of a SHA-256 hash. Should I take the first bits or the last bits? Which of them ...
9
votes
4answers
2k views

What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
7
votes
2answers
572 views

Is the encryption of a hash a good MAC?

At university we were told that it is a bad idea to implement a MAC by simply concatenating a key with the data to sign and to run it through a hash function (e.g. $s = ...
7
votes
1answer
426 views

CBC key lifetime, or, “how big is too big?”

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
6
votes
1answer
1k views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
4
votes
1answer
396 views

AES mixcolumn stage

I'm studying AES, and am having problems with the "mixcolumn" stage. I read about finite fields, but I still don't know. How do I construct $GF(2^8)$? ...
4
votes
5answers
458 views

Is it theoretically possible to construct a string that contain its own hash value?

After saw the xkcd comic self-description, I wonder is it theoretically possible to construct a self-descriptive string that contains its own hash value? Let's say the string's md5 value is ...
4
votes
2answers
494 views

Hill cipher, unknown letter value

I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...
4
votes
3answers
2k views

Hill Cipher known plaintext attack

I know a plaintext - ciphertext couple of length 6 for a hill cipher where its key is a [3x3] matrix. Based on what I've read and learned, to attack and crack keys of [n x n], if we know a plaintext ...
4
votes
1answer
1k views

What is “Implicit Authentication”?

What is “Implicit Authentication” in the context of authentication methods? I searched the Web but could not find any article that describes this. If anyone can describe it, that would be a great ...
4
votes
2answers
515 views

Can we use elliptic curve cryptography in wireless sensors?

Can we use elliptic curve cryptography in wireless sensors? If so, how do you map points to message characters?
4
votes
2answers
708 views

How to construct encrypted functions (with either public or private data)?

Homomorphic encryption is often touted for its ability to Compute on encrypted data with public functions Compute an encrypted function on public (or private) data I feel I have a good grasp of #1 ...

15 30 50 per page