All Questions
4
votes
1answer
581 views
How can I encrypt + authenticate short strings into similar short ciphertexts?
I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ...
4
votes
3answers
231 views
Designing a key expander out of ciphers
Is it possible to compose or combine $n$ ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate $n$ ciphertexts from the same key, $k$, and that recovering the key, $k$, from ...
3
votes
2answers
719 views
Many time pad attack
I've already sent my correct solution to a programming question on an online class:
Let us see what goes wrong when a stream cipher key is used more than once. Below are eleven hex-encoded ...
3
votes
2answers
196 views
Why is h(m||k) insecure?
Here is the post that explains the failure for doing h(k||m) and I understand it.
But I don't understand how h(m||k) is subjected to collison attack, or birthday attack. Please explain?
3
votes
2answers
113 views
CPA Secure Chosen plaintext scheme
The example for IND-CPA secure schemes given is generally:
for a random r,
Enc_k(m) =(r|| E_k(r) XOR m) where E is a PRF
But does the role of r and k really matter--i.e. isn't this equally ...
3
votes
2answers
402 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
3
votes
2answers
306 views
How were the number of rounds for different key sizes of AES selected?
The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
3
votes
3answers
820 views
How does the key schedule of Rijndael looks for keysizes other than 128 bit?
It said in Wikipedia that:
[....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
3
votes
2answers
7k views
How secure is AES-256?
The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers.
In theory it's not crackable since the combinations of keys are massive.
Although ...
3
votes
3answers
269 views
Does the XML Encryption flaw affect SSL/TLS?
A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated:
XML Encryption Flaw Leaves Web Services Vulnerable.
Does this weakness of CBC-mode which is used here also ...
2
votes
0answers
154 views
Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]
Possible Duplicate:
Using CBC with fixed IV
Forgive me if this has been asked before, I looked but haven't seen any answers that suit.
Is there any danger in using CBC, encrypting a ...
2
votes
1answer
383 views
Advantage of AES(Rijndael) over Twofish and Serpent
I'm trying to figure out a suitable encryption technique and after reading a bit, I figured the current AES 128-bit encryption is suitable for what I'm trying to do. However, this is more due to the ...
2
votes
4answers
874 views
Why is padding used for RSA encryption given that it is not a block cipher?
In AES we use some padded bytes at end of message to fit 128/256
byte blocks. But as RSA is not a block cipher why is padding used?
Can the message size be any byte length (is the encrypting agent
...
2
votes
2answers
160 views
Security considerations for partially shared password databases
Programs like KeyPass and 1Password store password database files encrypted by a single password. If someone knows the protecting password ("Vault Key"), they can read the entire database ("secrets").
...
2
votes
1answer
303 views
How were the AES key and block length subsets of Rijndael selected?
My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
2
votes
1answer
1k views
How to solve MixColumns
I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this?
I found some topic in the internet about MixColumns, but I still have a lot of question to ...
2
votes
2answers
703 views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
2
votes
1answer
179 views
Shannon entropy calculation: is $H(A|R·A) = H(A)$?
Suppose I generate a random $m×m$ matrix $R$, where each of its elements belongs to $\mathbb Z_n$. I ensure that $R$ is invertible in $\mathbb Z_n^{m×m}$.
Now I take a non-random $m×m$ ...
2
votes
1answer
496 views
What is Implicit Authentication?
What is Implicit Authentication, in the context of authentication methods?
I searched the Web but could not find any article that describes this. If anyone can describe, it would be a great help.
...
2
votes
1answer
409 views
Is RSA of a random nonce with no padding safe?
Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
2
votes
3answers
328 views
Trying to find a different DES encryption system explanation
I need a mathematical explanation of what does the DES encryption system really do.
This means I need more explanation than the one that offers FIPS, which is more an explanation for computer ...
2
votes
4answers
619 views
Webapp password storage: Salting a hash vs multiple hashes?
For security's sake, of course it's blasphemous to store passwords in plain-text; using a hash function and then doing a re-hash and comparison is considered much better.
But, if bad guys steal your ...
1
vote
1answer
67 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
1
vote
5answers
271 views
Approach towards anonymous e-voting
I want to implement an internet-based e-voting system.
Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
1
vote
2answers
681 views
Symmetric vs. Asymmetric cryptographic approaches to data security
Ok. So, I now know the basic differences between them. But I'd love to know the deeper things, like:
Exactly why is the asymmetric approach slower than the symmetric?
Why does it make use of ...
1
vote
2answers
334 views
Can we use elliptic curve cryptography in wireless sensors?
Can we use elliptic curve cryptography in wireless sensors?
If so, how do you map points to message characters?
0
votes
1answer
91 views
ECKS-PS algorithm: searching in encrypted data; bilinear maps
I have found an encryption algorithm named ECKS-PS (published in the paper Efficient conjunctive keyword search on encrypted data storage system) that allows an user to search in encrypted data. All ...
0
votes
3answers
399 views
How does one calculate the scalar multiplication on elliptic curves?
I found this example online:
In the elliptic curve group defined by
$$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
0
votes
1answer
414 views
Calculating the inverse modularity of the determinant for Hill cipher
I'm trying to decrypt a message encrypted with Hill Cipher, but I don't understand how to find the determinant so it solves the equation det * 1/det = 1 mod 26. The determinant for my key matrix is ...
0
votes
1answer
155 views
How can the Diffie-Hellman key exchange be extended to three parties? [duplicate]
Possible Duplicate:
Can one generalize the Diffie-Hellman key exchange to three or more parties?
How can Alice, Bob, and Charlie share a common secret key using an extended version of the ...
0
votes
1answer
318 views
Cryptanalysing Affine cipher
I am trying to cryptanalyse a cipher–text encrypted by Affine cipher.
The encryption formula is: $c = f(x) = (ax+b)\bmod m$, where $a$ and $b$ are unknown constants; $x$ is a plain-text symbol, and ...
0
votes
1answer
397 views
Removing Padded Value in Decrypted Message
How to remove padded value in Decrypted Message?
I am using AES Algorithm..
ex:
this is the decrypted message..
"abcdefghijklmn "
there is a 2 space in that decrypted message which is equivalent ...
14
votes
5answers
5k views
How does asymmetric encryption work?
I've always been interested in encryption but I have never found a good explanation (beginners explanation) of how encryption with public key and decryption with private key works.
How does it ...
24
votes
3answers
3k views
What are the benefits of the two permutation tables in DES?
Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
20
votes
2answers
957 views
How do I apply differential cryptanalysis to a block cipher?
I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis.
I ...
17
votes
2answers
824 views
How are primes generated for RSA?
As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
9
votes
1answer
397 views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
8
votes
3answers
232 views
How to construct a good PRF from a block cipher?
We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
6
votes
2answers
375 views
Hash decrypts key, key decrypts cipher… why?
I noticed recently that a couple of pieces of encryption software (TrueCrypt being one of them) don't directly use a hash of the password as the key for the block cipher. Instead, they generate a ...
19
votes
3answers
882 views
Information leakage from the ecryptfs filesystem
I'm wondering what information might be leaked from the ecryptfs filesystem. This is what Ubuntu uses if you check the box for "encrypted home directory" when using the desktop installer, so is ...
11
votes
2answers
1k views
“SHA-256” vs “any 256 bits of SHA-512”, which is more secure?
In terms of security strength, Is there any difference in using the SHA-256 algorithm vs using any random 256 bits of the output of the SHA-512 algorithm?
Similarly, what is the security difference ...
10
votes
3answers
254 views
Purpose of outer key in HMAC
From what I know, the HMAC constructions has two strength:
It's resistant to length extensions
Since the key is consumed before the message, the attacker does not know the initial state, preventing ...
10
votes
2answers
412 views
Encryption scheme for social-network-like data sharing data via untrusted server?
I am thinking quite a lot lately abut the problem of secure, privacy-preserving social networking. Distributing the network among trusted, preferably self-hosted servers (like Diaspora, GNU Social ...
10
votes
5answers
632 views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key* by calling a pseudorandom function a bunch of times recursively:
...
9
votes
2answers
319 views
Is every output of a hash function possible?
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
6
votes
1answer
377 views
Why Addition Mod 32?
I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
5
votes
3answers
637 views
Security of simple xor and s-box cipher?
What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode?
A cipher's internal primitive might be a simple as this:
$C = S[M \oplus k]$, where ...
16
votes
3answers
2k views
Identifying encryption method from encrypted string
Is it possible to identify the encryption method or atleast rule out some, by looking at the encrypted text?
For example, if you have 3 encrypted strings where the first 10 characters are the same on ...
13
votes
2answers
963 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
