8
votes
3answers
2k views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
3
votes
2answers
210 views
How can I solve the discrete logarithm modulo 2q+1 if I can solve it in the subgroup of order q?
As part of my cryptography course I came across an exercise that neither me or my friends could figure out.
The problem statement is as follows:
Let $p$ be a large prime of the form $p = 2q + 1$ ...
5
votes
0answers
380 views
How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$? [duplicate]
Possible Duplicate:
How does one attack a two-time pad (i.e. one time pad with key reuse)?
I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first ...
1
vote
1answer
330 views
Why must IV/key-pairs not be reused in CTR mode?
Many sources mention that IVs must not be reused with the same key in CTR mode, for encrypting 2 different pieces of data, because that totally destroys security - but I haven't found an explanation ...
2
votes
1answer
183 views
Regarding matsui's Paper on Linear Cryptanalysis of DES
I's going throught the the Paper by Matsui on Linear Cryptanalysis of DES . In that he says
$NS_{5}(16,15)=12$
And then in the next paragraph he says considering the expansion and permutation phases ...
1
vote
1answer
200 views
OpenPGP Public-Key Encrypted Session Key Packet Key ID generation
Im probably just not reading something again, but:
RFC 4880 says that a OpenPGP Public-Key Encrypted Session Key Packet (tag 1) is made up of
...
1
vote
3answers
212 views
two public keys with same passphrase insecure? | can two hashes be compared?
Suppose someone had generated a 2.048-Bit RSA GPG/PGP key pair and published the public key on the usual key servers. Then he withdraws this key and generates a new one in 4.096-Bit RSA using the same ...
6
votes
4answers
507 views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
2
votes
2answers
118 views
Is the “Signed on date” of a PGP Signature Verified?
I noticed that PGP signatures have a "signed on" field. I was wondering if this is "trustworthy" information and if so how is it accomplished.
For example, I can't see how it could be trusted ...
1
vote
2answers
287 views
How exactly are GPG keys mathematically related, and prime numbers inside of GPG general
Before anyone suggest it, I've yet to pick up "Applied Cryptography" I'm planning on picking it up the next time I visit amazon.
I know that the keys are somehow mathematically related, and I know ...
1
vote
2answers
440 views
RSA Proof of Correctness
Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm?
And why is it needed?
I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
2answers
422 views
Are there standards for transport layer security using only symmetric keys?
I have an embedded system with AES-128 implemented in hardware. There is very little flash/RAM and the (8-bit) CPU runs relatively slowly. Public key crypto isn't a viable option. This system is ...
1
vote
2answers
229 views
Is it possible to use the RSA algorithm, or a variant, for software licensing?
I'm almost a newbie about RSA encryption, so my question could it be banal.
I'm beginning to create a licensing system for my software.
I need to distribute a crypted license file to many customers.
I ...
0
votes
2answers
96 views
Distinguishing Encryption Methods from the Output
Suppose that you see all IP communication packets between two computers for a day, as they pass through a connecting router, and this amounts to 10MB. You additionally know that all data transmission ...
3
votes
2answers
236 views
Is ECB mode secure if plaintexts guaranteed to be unique?
I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few ...
4
votes
3answers
118 views
Are there any differences between PIR, oblivious transfer and differential privacy?
I am trying to make a taxonomy of different purposes of some cryptographic protocols. Generally speaking the purpose of PIR, oblivious transfer and differential privacy it sounds like being invented ...
2
votes
1answer
95 views
Why are there $ signs in my passwd file?
I am trying to get access to my eReader and I managed to get the passwd file.
...
8
votes
1answer
587 views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
3
votes
1answer
163 views
Does Identity-Based Encryption actually solve any problem?
Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
2
votes
2answers
747 views
Digital Signatures, Standard Hash Functions and MACs
I'm studying Hash functions and Digital Signatures in sequence, and came up with some doubts about their usage.
First of all:
What is the difference between hashing a document and signing it?
And ...
5
votes
1answer
141 views
Goldreich-Goldwasser-Micali Construction
The Goldreich-Goldwasser-Micali construction allows to build a (cryptographically secure) pseudo-random function from of a (cryptographically secure) pseudo-random generator.
More formally, let $G: ...
2
votes
3answers
452 views
Hash function in PBKDF2
From this excellent answer I learned (correct me if I am wrong) that when writing a block cipher with say key size 128 bit, one has to pad the password given (variable size) so that it becomes exactly ...
2
votes
1answer
187 views
Is symmetric encryption vulnerable to plain-text-attacks?
Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
3
votes
2answers
253 views
Why would anyone use an elliptic curve with a cofactor > 1?
In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
5
votes
4answers
506 views
What is the signature scheme with the fastest batch verification protocol for multiple signers?
I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible.
Modified ECDSA allows batch verification for different signers with ...
6
votes
1answer
399 views
Why Addition Mod 32?
I was looking at the algorithm for Twofish, and I noticed that in some places a XOR is used, but in others, they use "addition modulo-32." What makes modulo-32 special? Why not always use XOR? Why not ...
6
votes
2answers
269 views
Toy cipher — does it have a name?
When I was perhaps nine years, I borrowed a book from the library on various maths and CS topics. It outlined various simple ciphers, including one that I used a lot, just for fun. I can't remember ...
5
votes
1answer
2k views
HMAC vs MAC functions
I've read definitions of MAC and HMAC, but can't say I've completely grasped the differences.
What are principle differences?
When to use one and when the other?(Typical Use Cases)
3
votes
2answers
101 views
How can the Schmidt–Samoa cryptosystem uniquely decrypt large messages?
Suppose I choose $p=7$ and $q=11$.
This gives a public key of $p^2·q = 539$.
However, decryption occurs using a modulus of $p·q=77$.
If a person chooses to encrypt $500$ using my public key, how ...
3
votes
1answer
128 views
DGK Cryptosystem Key Generation and Decryption Issues
I detailed here the DGK (Ivan Damgård, Martin Geisler and Mikkel Krøigaard) cryptosystem, and I managed to get it to work, most of the time...
The BIG problem that I am facing at the moment is that ...
6
votes
4answers
1k views
Difference between encrypting something and hashing something
What is the difference between encrypting something and hashing something? in what situations would I want one or the other?
4
votes
1answer
147 views
Where can i find relative software for differential cryptanalysis?
Is there any publicly known software for differential cryptanalysis over some cryptographic building blocks as blocks ciphers or cryptographic hash functions
3
votes
2answers
806 views
How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?
Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
3
votes
2answers
620 views
How key materials are generated in SSL V3 from master secret
The generation of key materials is given by
...
24
votes
3answers
3k views
What are the benefits of the two permutation tables in DES?
Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
2
votes
1answer
195 views
Padding for the TEA
Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++.
My question is what to do about padding the key and the plaintext? I know that ...
1
vote
3answers
170 views
Looking for cipher that uses one ciphertext
I'm new to Cryptography so please free to edit my question for clarity and add the appropriate tag.
I'm trying to research if the following is possible. Suppose
John has a message that he ...
2
votes
1answer
62 views
Separate Read and Write Keys in TLS Key Material
Why does the TLS protocol use different symmetric keys for receiving and sending data?
Isn't it enough to have a single key used for both reading and writing?
1
vote
1answer
72 views
Incorporating known ciphertext into new message
Which ciphers $c_k$ enable one to define a joining function $f_{c,k}$ such that:
$$
f_{c,k}(c_k(p_1), p_2) = c_k(p_1 + p_2)
$$
That is, the result of joining some known ciphertext $c_k(p_1)$ with a ...
2
votes
1answer
130 views
Transparent cipher
I'm trying to implement this protocol:
Alice has her permanent key $K_1$. She computes $E(K_1, P)$.
She wants to share $P$ with Bob, Carol and Dave. For each of them she:
2.1. Generates $K_2$.
...
1
vote
1answer
192 views
How to represent a 32-byte SHA2 hash in the shortest possible string?
I'm calculating a SHA2 hash of a certain sensitive key value. I need to store files on disk using this hash a directory path prefix. So lets say I hash the key value 150023, I get a 32-byte value ...
2
votes
2answers
141 views
MD5 implementation doubt
In MD5, there are four rounds. After every round, why do we need to add the computed Q values to the initial values and then take this value as input to the next round. For example after the first ...
2
votes
1answer
185 views
Does ShaCrypt have the properties which make BCrypt slow on GPUs?
Sha256Crypt / Sha512Crypt are designed based on ideas of BCrypt but use SHA instead of Blowfish because of political requirements.
The Sha*Crypt algorithms have the advantage that they are used in ...
3
votes
2answers
403 views
How did LinkedIn “salt” all their passwords?
First, just to make sure I understand "salting" correctly:
You randomly generate a string to append to the password before hashing it, so as to increase its length and make precomputed tables much ...
4
votes
2answers
642 views
Is HMAC-DRBG or Hash-DRBG stronger?
Out of the two deterministic random bit generators defined in section 10.1 of NIST SP 800-90 (i.e. based on hash functions), which one is cryptographically stronger?
Hash-DRBG (Section 10.1.1)
...
2
votes
1answer
378 views
Okay to use OpenSSL to encrypt then sign a message?
I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong.
My current plan is ...
2
votes
1answer
206 views
Verilog simulation & synthesis of Diffie-Hellman key exchange
Is there any freely available verilog implementaion of Diffie-Hellman key exchange?
I couldn't find anything using google. So, assuming its not there I started implementing on my own.
The code is ...
3
votes
1answer
230 views
What's the reason for applying the hash twice when hashing with salt?
One of the typical approaches to computing a salted hash is this:
hash(salt+hash(secret))
where hash is something like SHA-256 hash function - taking any size ...
2
votes
2answers
132 views
Does a hash function in chaining mode or in counter mode make a better pseudo-random number generator?
I have two pseudorandom generators:
$f_1$ takes a random seed $l_0||r_0$ $\in \{0,1\}^{160}$ as input and outputs $r_1||r_2|| \dots ||r_k$, where $l_i||r_i = \operatorname{SHA-1}(l_{i-1}||r_{i-1})$ ...
3
votes
1answer
171 views
Attack vectors introduced by compilers
I have a question about attacks on the
implementation of cryptographic code that are enabled by compilation and compiler-optimisations. I am aware of this. Would
anyone be able to point me to other ...
