2
votes
1answer
75 views

How does Web Cryptography API produce secure PRNG?

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Specifications: https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#RandomSource-interface ...
2
votes
1answer
72 views

Simplification of a pairing

The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification: $$e(C_i,\text{GPK}_{uid})\cdot e(D_i, ...
2
votes
2answers
94 views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
2
votes
0answers
37 views

Malicious KGC attack in the identity-based authenticated key exchange protocol

There are two users $A$ and $B$ who are in different domain. Let's assume that $A\in KGC_1$ and $B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ...
2
votes
0answers
45 views

Deterministic Rand function for Winternitz One Time Signatures

Suppose you are implementing a Generalized Merkle Signature Scheme, using the Winternitz One-Time Signature Scheme for the node signatures. Furthermore, suppose the implementation is to be stateless ...
4
votes
1answer
239 views

Adi Shamir's secret database of all primes

I was going through these presentation slides (PDF) on Crypto 2013. It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild. In the last slide, it was ...
2
votes
0answers
37 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
0
votes
0answers
86 views

Convergent encryption has dictionary attack, but why hash function doesn't?

Convergent encryption (CE), $E_k(d)$, is a way to encrypt the data $d$, with the characteristic that the encryption key $k$ is $k=h(d)$, where $h(\cdot)$ is a cryptographic hash function. Consider a ...
1
vote
0answers
42 views

Type 2 to Type 1 pairing transformation - why not considered?

How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) ...
1
vote
1answer
68 views

Generate Finite Field power of g

consider the field $\mathbb{F}_{2^4}$, defined by using polynomial representation with the irreducible polynomial $f(x) = x^4 + x + 1$. Given element $g = (0010)$ as a generator for the field, How ...
1
vote
1answer
115 views

CBC-MAC length extension attack with IV simulation

I'm doing Matasano's challenges and struggling with second part of 49th problem where I'm asked to do the length extension attack with CBC-MAC without IV manipulation. There is a hint that I can ...
2
votes
2answers
123 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
1
vote
1answer
64 views

Use ElGamal to solve Diffie-Hellman problem

Say we are able to decrypt a Elgamal ciphertext $c$ using only the public key. Apparantly it is now possible to solve the Diffie-Hellman problem (given $g^a, g^b$ calculate $g^{ab}$). How? I know how ...
1
vote
0answers
38 views

In symmetric searchable encryption are the algorithms public?

If a user (other than the data owner) possesses the secret key in symmetric searchable encryption scheme are they able to run the trapdoor algorithm, or is this not publicly available?
2
votes
1answer
120 views

Getting 88bytes cipher output from 48bytes input in AES

The other day I saw this Hybrid Cryptographic Algorithm in the Google and felt curious about it. I am trying to understand this Hybrid Algorithm. And hopefully its not so hard to understand whats ...
2
votes
1answer
65 views

Cryptool - DES (ECB and CBC ) - double encyption

So, I uploaded a text file in Cryptool and encrypted it with DES-ECB with the key FF FF FF FF FF FF FF FF. I encrypted the cipher text again, with DES-CBC using ...
2
votes
1answer
95 views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
4
votes
2answers
250 views

Is SipHash cryptographically secure?

I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks. SipHash seems ...
4
votes
3answers
167 views

SHA256 output to 0-99 number range?

Is it mathematically possible to take a SHA256 hash and turn it into a 0-99 number where each number in 0-99 range is equally likely to be picked? As a 256 bit hash means the highest value possible ...
2
votes
0answers
75 views

Public and Private key encryption in simple math

Can anybody show me (or point me to resource) how to generate public key and private key with simple math? Steps which can be reproduced in a simple calculator – so the message, keys all can be ...
4
votes
3answers
122 views

Algorithm for computing square roots in $GF(2^n)$

Short question: is there an algorithm for efficiently computing square roots in $\mathbb{F}_{2^n}$?
5
votes
1answer
102 views

Is SHA256 good enough to shrink a key?

I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do ...
2
votes
1answer
95 views

Pseudorandom permutations on domains of arbitrary (i.e. not a power of 2) size

The Feistel cipher algorithm produces a pseudorandom permutation with domain size equal to $2^{2m}$ (for some $m \in \mathbb{Z}^+$). That is, a one-to-one function $\pi$ of the set $\{0, 1, 2, \dots, ...
2
votes
1answer
81 views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
3
votes
0answers
34 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...
0
votes
1answer
36 views

Problem with Python Implementation of Key Exchange part OTR Protocol

Being new to software development and crypto in general, I thought I would write a simple p2p encrypted chat app using the otr protocol detailed here: https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html ...
3
votes
1answer
94 views

Math to replace s-boxes - Good or bad idea?

The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie ...
2
votes
1answer
62 views

Is a keyed PRF a MAC?

I remember I read that a MAC can be considered as a PRF. Can a variable-length input keyed-PRF be considered as a MAC?
5
votes
1answer
138 views

Determine LFSR phase quickly?

I know it's possible with work backwards from the output bits of an LFSR to determine its feedback polynomial in a O(n) fashion. I'm also curious if, given an LFSR state and polynomial, is it ...
3
votes
1answer
78 views

Client authentication on limited hardware

I'm developing a authentication and authorization protocol for a Bluetooth device. The device should communicate with an Android app and needs to be able to authenticate the app during the connection ...
1
vote
0answers
125 views

Can I get a public key from PGP signature? [migrated]

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
3
votes
1answer
105 views

Attacks on AES-128 (ECB) based on some knowledge of plaintext

I'm working with a third party protocol which employs AES-128 in ECB mode of operation to encrypt a packet composed of 16-byte blocks (it encrypts each block independently). I'm trying to determine if ...
1
vote
0answers
29 views

Does OpenTSA support PKCS11 to talk to HSMs?

We are planning to implement the time-stamping service (RFC 3161) using OpenTSA wanted to know: Does OpenTSA support PKCS-11 (Cryptoki) to talk to HSMs? BTW: I did not find documentation or much ...
2
votes
1answer
111 views

generate hash of all handshake messages for verify data (DTLS)

I am trying to create a DTLS client finished packet, where I need to generate verify data for handshake hash is need. And here I want to know how to generate handshake hash. As of now I am doing like ...
1
vote
0answers
72 views

Types of cryptography

We have cryptography based on hard problems from number theory, like DDH. When we speak about symmetric cryptography with AES, a mode of encryption (CBC, ...), what is the type of problem ? What is ...
4
votes
2answers
386 views

Exactly two of the four roots must be greater than N/2

Theorem: Let $y$ be a quadratic residue in $\mathbb{Z}_N$* where $N=pq$. There are exactly four integers $x_1, x_2, x_3, x_4$ where $0 < x_1 < x_2 < \frac{N}{2} < x_3 < x_4 < N$ ...
-1
votes
0answers
56 views

how to rememeber passwords securely? [migrated]

Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
0
votes
2answers
120 views

Pi Message Encryption [duplicate]

I created a simple yet efficient message encrypting page that will encrypt messages using Pi. Though not being an expert in this area, I am nowhere near sure how secure this is and how easy it would ...
3
votes
3answers
107 views

Encrypting text file line by line with stable encryption

I want to store files in a secure manner (i.e. no one should be able to decrypt the contents of the file without the secret key) but I also want a diff tool to be able to show me which lines changed ...
3
votes
2answers
257 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
-2
votes
1answer
50 views

How to find out the method used to encrypt [closed]

How to find out the method used to encrypt the string 123456 which results in the value: 6g9SkDLIKa8l2VhafFnHvg==?
9
votes
0answers
95 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
5
votes
1answer
161 views

Does collision resistance imply (or not) second-preimage resistance?

I've seen contradictory results. Sometimes hash functions are collision-resistant but not necessarily second-preimage resistant. I've seen this kind of things in papers from Bart Preneel: “Security ...
5
votes
1answer
90 views

Condensed ElGamal + AES

In normal ElGamal encryption, the encrypted message is a pair (gb, gabM) - that is, the actual "encryption" is simply multiplication by the shared secret ...
1
vote
1answer
86 views

How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
1
vote
1answer
62 views

Public Key Cryptography: Diffie-Hellman Key Exchange

Please watch this video it's very short. If you already know cryptography and really good at it please start from 3:51. I didn't understand the step at 4:39, can someone here to explain? Why is ...
2
votes
1answer
89 views

Empty message Hash length

I am learning Hash Algorithms and in a presentation (PDF) about these algorithms I read that: Length of $h(m)$ much shorter then length of $m$. Now my question is: What if we talk about an ...
1
vote
1answer
108 views

Combining Random Hashes - avoiding collisions and ensuring randomness

I have a series of integers which I want to convert to random integer (64 bit). The idea here is to produce random numbers very quickly. The issues that good quality random numbers are required with a ...
2
votes
3answers
131 views

Do sites store login password with hash? If so, can people can use hash collision to log in?

I was researching about hash, and I thought, If sites store passwords with hash algorithms, then can't this happen: User A has the password 'hello' User B finds out the hash code of the password of ...
-2
votes
1answer
47 views

moduli in SSL certificates [closed]

this is normally seen in a typical SSL certificate. For the modulus, I know that it is represented in hexadecimal form, but why is there a semicolon (:) after every group of 2 digits? ...

15 30 50 per page