4
votes
1answer
655 views

Correctly generating cryptographically secure pseudorandom numbers (in C)?

I am learning about cryptography, purely for my own interest. As part of that, I am implementing a simple one-time-pad toolset in C. Naturally, I need to generate random numbers to create the pad, ...
3
votes
1answer
798 views

Theoretical attack on RSA

The high security of RSA is granted, because it is very hard to factorize $$ N = p * q $$ Nevertheless, there is actually no need of factorizing $N$, in order to generate the $Private$ $Key$, but the ...
28
votes
1answer
1k views

How is the MD2 hash function S-table constructed from Pi?

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are ...
3
votes
1answer
277 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has it's security based on the one-way ...
11
votes
1answer
1k views

How to break an arbitrary XOR and Rotation based encryption?

I heard encryption based purely on XOR and Rotation is inherently weak. The paper Rotational Cryptanalysis of ARX says: It is also easy to prove that omitting addition or rotation is devastating, ...
2
votes
1answer
48 views

run length testing [closed]

Looking for guidance/references with/about calculations: I am designing a widget that creates N-bit binary sequences. My customers target spec for the sequence's minimum entropy is X bits/bit. I plan ...
3
votes
1answer
137 views

Simple proof of work example?

Can anyone show me a simple proof of work algorithm that I can use to stop spammers? I've looked at hashcat, but i think there's a bit too much specialized hardware for bitcoin mining. That is, the ...
2
votes
1answer
70 views

Composing and Inverting Symmetric Encryption Keys

Using a symmetric encryption algorithm $E$ on a message $M$, users usually send $E(M)$ to the recipient and then the recipient will compute $E^{-1}(E(M))=M$ to retrieve the message. For what symmetric ...
8
votes
2answers
2k views

Why is CBC with predictable IV considered insecure against CPA

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ...
9
votes
1answer
1k views

How many RSA keys before a collision?

I was wondering how many possible private/public keys exist? If a million people – for whatever reason – would try to generate 5 keys each in the same minute (on the same date and time) is there a ...
4
votes
1answer
162 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
2
votes
1answer
47 views

Symmetric-key login protocol

I'm trying to analyze a login protocol based on symmetric key cryptography. I'm just starting out, so this may very likely be a very bad idea, but nonetheless I'd like to hear your thoughts on it. ...
5
votes
0answers
85 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
-1
votes
1answer
98 views

Questions on FHE over the Integers - the question modified!

I modified my question since it is not as specific as I wanted. I'm studying FHE over the Integer which is https://eprint.iacr.org/2009/616.pdf I got questions about the proof of Lemma A.1. In page ...
4
votes
0answers
413 views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
3
votes
1answer
110 views

Is this an acceptable All-or-Nothing Transform?

I was thinking about AONTs, and designed the one below, I call it CHANT for Chained-Hash All-or-Nothing Transform; it's my very first shot at something of the sort, and was hoping I could get your ...
6
votes
3answers
312 views

Rainbow table for DES with all-zero plaintext?

Consider the function $F$ from $\{0,1\}^{56}$ to $\{0,1\}^{64}$, mapping the operative bits of a DES key to the ciphertext for all-zero plaintext. How could we organize a rainbow table to invert that ...
2
votes
1answer
178 views

Where can I download a database of RSA keys?

I'm looking to do some research into how RSA is used in the wild. I've read through a few papers and it seems other researchers have had no trouble collecting millions of keys to perform analysis on. ...
7
votes
4answers
228 views

Encrypting or HMACing password digests

Assuming I'm using bcrypt to digest passwords, is any additional security gained by either encrypting or HMACing the resulting digests? By requiring a key to compare password hashes, I would expect ...
3
votes
2answers
158 views

What are good combinations of public key algorithms or primitives for long term security?

There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden ...
11
votes
5answers
2k views

How can rainbow tables be used for a dictionary attack?

I'm putting together a password policy for my company. I very much want to avoid requiring complex passwords, and would much rather require length. The maximum length I can enforce is 14 characters. ...
2
votes
0answers
110 views

Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i): Identification based on PK decryption and witness. Consider the following protocol: $A \leftarrow B: h(r), B, P_A(r,B)$ ...
2
votes
1answer
58 views

Encrypted files in an encrypted partition or folder

Recently I started wondering about multiple encryption and found pages upon pages of posts and debates about the security of cascades. Now, don’t worry – I'm not looking for someone to discuss a ...
1
vote
2answers
154 views

Public key Issue - same key pair as existing one? [duplicate]

My question is a bit naive, but what if someone generates the same RSA key pair as someone else? This person would have the same private key and so would be able to decrypt messages not intended to ...
3
votes
1answer
142 views

Test Vectors for ciphers

While implementing ciphers (/hash functions, ...), I often face this problem: Where to find test vectors for it; so that I can guarantee my program is correct. It is generally a tedious job to find ...
2
votes
2answers
140 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
4
votes
1answer
88 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
8
votes
1answer
214 views

PAK Diffie-Hellman vs. sharing high-entropy key

In order to setup an authenticated shared secret key between two clients, I am faced with the choice between two possibilities: Let users set a (low-entropy) shared password and then perform some ...
8
votes
2answers
352 views

What current authenticated key exchange standards exist?

If neither of the 'big two' of TLS Handshake and IKE are appropriate in a given situation, what alternative Authenticated Key Exchange (AKE) standards exist and are recommended? Many protocols have ...
4
votes
3answers
192 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
7
votes
2answers
862 views

How does a rolling code work?

I have general questions regarding rolling codes. Basically there is a sender and a receiver. Both have a sequence generator. The receiver checks if the received sequence matches the newly generated. ...
2
votes
1answer
145 views

Significance of repetition in XOR cipher text

I'm attempting to recover plain-text ($P_1, P_2$) from two uneven cipher-text strings ($C_1, C_2$) that I suspect used the same key ($K$). When I XOR $C_1$ and $C_2$ together to obtain ($P_1 + ...
4
votes
1answer
116 views

Key Derivation from random salted seed, HMAC and HMAC based KDF

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing ...
3
votes
2answers
113 views

CSPRNG that cannot be used as random extractor

Are there any specific CSPRNG's that cannot be used as randomness extractor within a TRNG? In other words, can you simply provide enough entropy gathered from a good entropy source as seed in any ...
4
votes
1answer
157 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
16
votes
9answers
2k views

Why not the one-time pad with pseudo-number generator

I am very new to cryptography (so be kind), but I have a question that may seem silly. If the one-time pad is the perfect cipher and impossible to crack, why would the following algorithm not be one ...
6
votes
1answer
87 views

The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme ...
0
votes
1answer
186 views

Vigenère cipher: Security when key length and plaintext length are the same

I have read the Vigenère cipher is secure as long as the key length is the same as the length of the data to be ciphered. Is this true in cases where the same key is used multiple times. In that case ...
1
vote
1answer
134 views

Whitening and randomness extraction

The Von Neumann randomness extractor is explicitly mentioned in the randomness extractor page of Wikipedia, but strangely enough that page does not contain any reference to whitening the results of an ...
2
votes
0answers
96 views

Understanding Lattice based cryptosystem [closed]

I have heard that there is one paradigm of Public key cryptosystem, called Lattice based crytography. Further, its security claims are such that it will not be affected even if the quantum computers ...
2
votes
1answer
231 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
5
votes
1answer
231 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
4
votes
1answer
139 views

Compression function to guarantee randomness of one time pads?

First of all, I would like to note that I am not building my own crypto. I am simply curious and would like to learn. What I am wondering is this: if we are worried about randomness of something ...
-5
votes
1answer
90 views

RSA Key and RSA Security

Is there any relationship between the RSA keypair standard and RSA security? Keypair: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Security: http://en.wikipedia.org/wiki/RSA_Security If not, ...
2
votes
0answers
84 views

Can you help me understand this “Message Modification by Meet-in-the-Middle” related to Tiger Hash? [closed]

I found this paper that explains how to attack a reduced round tiger hash, but I'm having a hard time understanding some of the mathematical notation. Could someone explain the section "Message ...
0
votes
1answer
120 views

How to implement a Cryptographic Pseudo Random Function

I need three pseudo random functions which all take a seed S (t-bits long). The functions should map from $d$ bits to $d$ bits $d$ bits to $1$ bit $d$ bits to $t$ bits $d$ is $10$ bits $t$ is ...
2
votes
2answers
618 views

Digital Signature using symmetric key cryptography

Generally digital signature is a public key cryptography concept.But it needs high overhead. So is there any publication or link available where 'digital signature using symmetric key' has been ...
3
votes
1answer
272 views

True Random Number Generator by milliseconds per keystroke (TRNG-Kms)

The simplest way to generate truly random numbers for OTP keys is to measure the time in milliseconds between each keystroke on a keyboard. The randomness depends on the user typing in various speeds. ...
2
votes
1answer
70 views

Should I calculate two CMACs over two different strings that share common bytes?

I am trying to secure my RF communication in which one RF package consists of two separate segments. I need to make sure that one segment of one packet is not replaced with a valid segment of some ...
37
votes
5answers
10k views

Is AES-256 weaker than 192 and 128 bit versions?

From a paper via Schneier on Security's Another AES Attack (emphasis mine): In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...

15 30 50 per page