All Questions
9
votes
3answers
399 views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity ...
9
votes
2answers
1k views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is pubic?
What ...
9
votes
2answers
250 views
Is RC4 a problem for password-based authentication?
This is a follow-up question to Does TLS use RC4-drop[n]?.
As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that ...
9
votes
2answers
318 views
Is every output of a hash function possible?
Is every output of a hash function (e.g. SHA1, MD5, etc) guaranteed to be possible, or, conversely, are there any output values that cannot possibly be created from any input? If so, what guarantees ...
9
votes
5answers
482 views
How do I construct a 256-bit hash function from 128-bit AES?
I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?
9
votes
2answers
930 views
What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?
For the purposes of signing and verifying signatures, what is the value of the hash function?
Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
9
votes
7answers
1k views
Is calculating a hash code for a large file in parallel less secure than doing it sequentially?
I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size.
Normally, you sequentially hash the bytes of the files using a hash function (say, ...
9
votes
1answer
345 views
Does unbalancing a feistel cipher always improve security? Does it improve security at all?
So according to wikipedia unbalanced feistel ciphers provide greater provable security. Specifically, they state:
The Thorp shuffle is an extreme case of an unbalanced Feistel cipher in which one ...
9
votes
1answer
1k views
Why do we use encrypt-decrypt-encrypt (EDE) in 3DES, rather than encrypting three times?
I'm wondering why we use encrypt-decrypt-encrypt sequence in 3DES with three keys instead of three times encryption with three different keys?
9
votes
2answers
270 views
Bitcoin Research
I have recently been assigned to advise a student on a senior thesis in math. She has taken linear algebra, introductory real analysis, basic cryptography, and abstract algebra. Her interest is in ...
9
votes
2answers
420 views
I have a few questions about the random oracle model
1.) Proving the security of a scheme with the ROM takes two steps; first you prove that the sceme is secure in this idealized world where a random oracle exists and then you implement this scheme in ...
9
votes
4answers
424 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
9
votes
1answer
219 views
What is the theoretical and practical status of mental poker?
I'm able to find a lot of scattered papers on the development of mental poker since RSA proposed the initial solution but no recent report (i.e. after 2005) on what is the status of the problem, eg:
...
9
votes
2answers
317 views
Proving knowledge of a preimage of a hash without disclosing it?
We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256.
Alice discloses a value ...
9
votes
2answers
517 views
Design properties of the Rijndael finite field
So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other ...
9
votes
1answer
396 views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
9
votes
2answers
254 views
Why is the salt used only once in PBKDF2, while the password is used often?
The purpose of PBKDF2 is to create a derived key (DK) from a master password (PW) and a salt, often using a function like HMAC-SHA256. I have read that the salt should be as random as possible. But ...
9
votes
1answer
184 views
Which MACs can be converted into a secure unkeyed hash function?
It is known that setting the secret key to a fixed, public value does not make MACs like CBC-MAC or GMAC into secure unkeyed cryptographic hash functions that could be used - for instance - for ...
9
votes
2answers
301 views
How should one implement a delegated shared trust protocol?
Consider the following (probably naive) scenario.
Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
8
votes
5answers
2k views
Are there two known strings which have the same MD5 hash value?
Is there an example of two known strings which have the same hash (MD5) value, i.e. an MD5 collision?
8
votes
4answers
294 views
Should DES be avoided when developing new systems?
According to wikipedia "DES is now considered to be insecure for many applications".
However, since it can be broken relativily simply, should it not just be avoided for all applications?
8
votes
5answers
422 views
Is it feasible to build an index of prime factors?
Would it be possible to break an RSA key, in for example 1 week of time, if the cracker have already spent X number of years building an index of primes by performing every permutation of existing ...
8
votes
2answers
764 views
Can two different pairs of RSA key have the same modulus?
Can $n=pq$ be part of two different pairs of RSA keys?
If such keys exist, say $(e_1,n)$ and $(e_2,n)$, how are they related?
What will be the security concerns for the two users?
8
votes
3answers
948 views
Which algorithms are used to factorize large integers?
Even if RSA decided to cancel the Factoring Challenge, it seems that some teams keep working on it. According to Wikipedia, RSA-768 has been factored in late 2009.
What are the current large integer ...
8
votes
4answers
640 views
Does RSA work for any message M?
I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
8
votes
4answers
612 views
Properties of PRNG / Hashes
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
8
votes
2answers
470 views
Why RSA can't handle numbers above 76?
I'm going to encrypt the characters Zhu, and decrypt them using RSA. I'm using the public key $\{e, n\}$ and private key $\{d, n\}$. The values of $e$, $d$ and $p$ ...
8
votes
5answers
265 views
Reduction from signatures to encryption?
Is it possible to construct an (asymmetric) encryption scheme from a signature scheme?
If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes ...
8
votes
3answers
1k views
How can a random salt for a hash function work in practice?
I understand the theory behind the use salts in hash functions, but when I see it implemented, the implementations always generate the salt on the fly and the salt appears to be different for every ...
8
votes
4answers
1k views
How can rainbow tables be used for a dictionary attack?
I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length.
The maximum length I can enforce is 14 characters. ...
8
votes
3answers
595 views
What is the use of REAL random number generators in cryptography?
I understand the use of pseudo-random number generators. I am not getting mixed up between these and "real" random number generators.
However, I don't understand for what a real random number ...
8
votes
2answers
355 views
Do I have to have a different salt for each password?
Should I use a different salt for each password?
In my system, there are no user names, only passwords. When a user logins in, he types in one or more passwords and the server compares the results ...
8
votes
2answers
6k views
How does one attack a two-time pad (i.e. one time pad with key reuse)?
My question might appear the same as the question Taking advantage of one-time pad key reuse?, but actually I did read all the answers and none of them helped me with the details I need.
I am new to ...
8
votes
3answers
2k views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
8
votes
3answers
224 views
PBKDF2 for key diversification
I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
8
votes
3answers
456 views
Can I use a one time pad key twice with random plaintext?
I understand the basics of OTP: $|\text{key space}| = |\text{plaintext space}|$ implies perfect security, key reuse destroys this.
Cryptanalysis on the $N$-Time Pad for $N > 1$ involves finding ...
8
votes
3answers
389 views
UMAC: to what extent is it in use today?
Inspired slightly by the Encrypt-then-MAC question. The most obvious message authentication code is probably HMAC or RFC 2104 which is basically a hash of the input, an xor with a key... you get the ...
8
votes
5answers
1k views
What is the post-quantum cryptography alternative to Diffie-Hellman?
Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
8
votes
1answer
207 views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to infer that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
...
8
votes
3answers
372 views
Is it reasonable to assure that p-1 and q-1 aren't smooth?
I came across the requirement that, in RSA, $p-1$ and $q-1$ shouldn't be smooth, shouldn't consist of lots of small factors. Therefore my question:
How complicated is it to check whether $p-1$ is ...
8
votes
4answers
192 views
Tactics available to help prove security of a new system?
I believe that the accepted tactic to "prove" a system as secure is to allow the crypto-community to review it and if no vulnerabilities are found over a long period of time (5 or 6 years), then a new ...
8
votes
2answers
509 views
Salting when encrypting?
I was attending a database encryption session at a developers conference. The presenter (who was a published author on the subject) said that MS SQL Server did not support salted hashes in the ...
8
votes
3answers
230 views
How to construct a good PRF from a block cipher?
We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as ...
8
votes
2answers
2k views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
8
votes
3answers
240 views
Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?
Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ...
8
votes
2answers
194 views
Why would you expect to find a collision in a hash function after approximately $\sqrt{n}$ hashes?
I can't get an intuitive understanding of why it's $2^{(\frac{n}{2})}$ and not $2^n$, where $n$ is the number of bits of which the key consists.
8
votes
1answer
329 views
Why did NIST remove The Lempel-Ziv Compression test from the Statistical Test Suite?
NIST removed "The Lempel-Ziv Compression" test from the Statistical Test Suite in revision 2008 and above and has not incorporated it since – see revision 2010.
Why was it removed? Does it no longer ...
8
votes
2answers
311 views
Why is there an enormous difference between SAT solvers?
SAT solvers are very important in algebraic attacks, for example walksat and minisat.
However, when solving the benchmark problems available here there is an enormous performance difference between ...
8
votes
3answers
446 views
What is the best way to put a backdoor in an encryption system?
How can you put a backdoor into an encryption algorithm? Are there any techniques that can be used to reduce the time it takes to break a key?
I am looking for practical examples encryption schemes ...
8
votes
1answer
401 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
