-1
votes
1answer
74 views

How to create PSK key? [closed]

I'd like to create a PSK key to use with TLS-RSA-PSK-WITH-AES-256-CBC-SHA - what is the format of this key?
3
votes
1answer
95 views

Quadratic Sieve: what's the next step after it fails?

Factoring some 20-45 digit values n with a (simple) quadratic sieve, the quadratic sieve may end up with pairs of x and y s.t. $x^2 \equiv y^2 \pmod n$, but neither x+y nor x-y has a nontrivial gcd ...
-2
votes
1answer
97 views

Zero Knowledge Proof for Correctness of the product of additive ElGamal Ciphers [duplicate]

Suppose we use Additive ElGamal defined as follows: Let $(K,E,D)$ be a triple. The key-generator $K$ outputs the description of a finite multiplicative group $G$ of prime order $q$, with three ...
0
votes
2answers
202 views

Should an AES byte key generated with OpenSSL be converted to hex?

I am generating a key & iv with Ruby's OpenSSL wrapper for an AES CBC 256 setup: ...
1
vote
0answers
77 views

Public-key based on roots of polynomial

In general it's hard to calculate the roots of a given polynomial P(x). But the other way back calculating the coefficients is much easier (Vieta's formulas). If this is a one-way function, is it ...
1
vote
0answers
71 views

Does a dynamic accumulator exist yet? [closed]

I’m looking for a one-way accumulator which can safely add new members (deletion is not necessary) and does not rely on a trusted party in any way. I’ve been looking for one, I need it for this ...
3
votes
1answer
77 views

What is the importance of the $r$ and $c$ values for the Sponge Construction?

What is the importance of the $r$ and $c$ values? Keccak[r=1600,c=0] is stated on a calculator on the Keccak website to be a checksum. But I figured if c=0, then there's only one possible output? ...
1
vote
0answers
125 views

Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
0
votes
2answers
78 views

Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$

Consider the accepted answer to the question: Why are elliptic curves better than cyclic groups? It seems to suggest there are subexponential algorithms (i.e., algorithms with running time $$ ...
1
vote
1answer
135 views

Is the term “Elliptic Curve Discrete Logarithm Problem” a misnomer?

I have just started studying Elliptic Curve Cryptography, and I have this doubt. In ECC the group operation is addition (and not multiplication). So, why is ECDLP stated as a variation of the discrete ...
4
votes
0answers
225 views

Odds of false error detection in a randomness test using the chi-squared test?

Common Criteria classifies the requirements for true Random Number Generators, and specifies how these should be tested against failures (these can occur accidentally, or following deliberate attack, ...
1
vote
1answer
111 views

Why concatenate the key a second time in HMAC? [duplicate]

On Wikipedia it is said that HMAC is basically (without taking into account padding): $H(key\ \Vert\ H(key\ \Vert\ message))$ where $\Vert$ denotes concatenation. I understand the need to hash ...
1
vote
1answer
124 views

Hash functions with or without secret key

The classical definition of hash functions (found in books) are OK, but when studying a little more there is a lot of notions that seem ambiguous (contradictory) to me : Sometimes we have hash ...
-1
votes
1answer
53 views

Meet in the middle attack - message and key

I clearly understand the story of Alice and Bob: Alice and Bob are going to use double DES. They know the keys K1 and K2. Alice sends to Bob the encrypted message c= EK1(EK2(m)). Bob decrypts the ...
-1
votes
1answer
141 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
4
votes
0answers
117 views

How can I create an RSA modulus for which no one knows the factors?

It's easy to create an RSA modulus where almost no one knows the factors: for example, I can generate two 1024-bit primes $p$ and $q$ and set $n=pq$. If I publish $n$, I will be the only person in ...
4
votes
1answer
340 views

What prevents a padding standard to cause a data loss?

In here different byte padding standards are listed as ANSI X.923, ISO 101.26, PKCS7, ISO/IEC 7816-4 and zero padding. All of them seems to apply padding to the last byte blocks. Odds are rare but ...
2
votes
2answers
4k views

Cipher Feedback Mode

I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC. Can someone explain to me how CFB works. Such as how ...
-1
votes
1answer
129 views

Hash Based Encryption (fast & simple), how well would this compare to AES? [duplicate]

First of all, I know it's a very bad idea to invent your own encryption algorithm. It's better to use existing known, trusted, extensively tested and studied algorithms with a proven track record. The ...
1
vote
2answers
72 views

counter to indicate hotp count

I was trying to figure out how HOTP kept from wrapping over, when I saw this explanation of how it works, by Thomas Pornin [source]: The intended scenario is the following: the client has a ...
2
votes
1answer
169 views

Is this an acceptable implementation of ARC4 encryption for my system?

I am building an open source hardware system that will be used to control things over the internet. The system consists of a Base Station and Modules which use wireless communication at 2.4GHz to ...
1
vote
1answer
147 views

Difference between known-plaintext attack and forward search attack

I am looking at the different attacks on RSA. I came across known-plaintext attack where the public key can be used to encrypt all possible messages until it finds a match on the sent encrypted ...
1
vote
1answer
952 views

How is input message for SHA-2 padded?

I read about how is an input message prepared to be hashed by MD4,MD5 or SHA-1: Step1 Append padding bits The input message is "padded" (extended) so that its length (in bits) equals to 448 ...
2
votes
1answer
96 views

Why do we apply the concept of circuit in homomorphic encryption schemes?

I am a beginner to the concept of homomorphic encryption. One thing that makes me very confused is why we use the circuit concept or approach to homomorphic encryption. Gentry's paper does not discuss ...
4
votes
1answer
106 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
4
votes
1answer
158 views

Difference RSA keypair creation openSSL and openPGP?

Creating a 2048bits RSA keypair I figured that doing this using openssl takes as an input 32bytes of "randomness" from /dev/urandom gpg (openGPG) takes as input ...
1
vote
2answers
485 views

RSA problem if i choose two specific small prime numbers?

I know that rsa normally is made to make it with big integers, but i trying to make the algorithm myself (with the help of wikipedia) and I´m making it with small numbers to track the problems easily. ...
2
votes
1answer
112 views

distribution for a subset of md5

I need to uniquely assign a 32 bit integer to a collection of human readable strings (i.e. they will not be generated with hash collision in mind). I don't expect more than a few thousand strings. I ...
2
votes
1answer
115 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
5
votes
2answers
289 views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
1
vote
0answers
80 views

Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has ...
-1
votes
1answer
40 views

Affine encryption function

Let $f(x) = ax + b$ be an affine encryption function. $a$ and the cardinal of the field of our keys $K$ (in English, 26) must be coprime so that the encryption ...
1
vote
1answer
80 views

Modular protocol design

What does modular protocol design mean? Why does TLS not have modular protocol design? What protocols have modular design? (IPSec, SSH)
1
vote
4answers
134 views

Are there use cases where a signature itself needs to be signed?

I'm writing some code to digitally sign certain files (JSON, if you must know), and I'm trying to understand the use cases, not being a crypto guy myself. I understand there are use cases where ...
0
votes
4answers
435 views

Is the One Time Pad (OTP) considered a cryptographic hash function?

As the title states, would the One Time Pad (OTP) be considered a cryptographic hash function?
2
votes
0answers
59 views

Obfuscating point-like functions

There are standard schemes for obfuscating a point function; I'm wondering if we know how to obfuscate a slight generalization of a point function. I'll elaborate more precisely. Definition 1. A ...
1
vote
1answer
4k views

How to solve MixColumns

I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this? I found some topic in the internet about MixColumns, but I still have a lot of question to ...
2
votes
4answers
428 views

How to perform Multiplicative Inverse Modulo in IDEA

How to perform the Multiplicative Inverse Modulo in International Data Encryption Algorithm? I don't understand on how to perform it… For example, let's say I have a value of ...
3
votes
3answers
271 views

Is it possible to work out the hash algorithm from a list of known message-hash pairs?

For example, in my situation I know hash(20) = 486e9638177faf1f34e49910491b77af. I also know the hashes for all values from 0 to 20. Is it possible to work out the ...
-1
votes
3answers
218 views

Padding of Original Message in MD5

what should I do if my original message is greater than 64 bits? what is the process of padding in MD5? As described in Internet Security: Cryptographic Principles, Algorithms and Protocols, page ...
5
votes
4answers
567 views

Is this a pseudo random function (PRF)? F(k,x) = f(k,x) - f(k,x-1)

I have a question about Pseudo Random Functions. Let $f:\{0,1\}^m \times \{0,1\}^n → \{0,1\}^n$ be a secure PRF. Define $F(k,x) = f(k,x) - f(k, x-1 \bmod 2^{n}) \bmod 2^{n}$. Is $F$ is a secure ...
1
vote
0answers
315 views

Which eliptic curves in OpenSSL 1.0.1f meet all / most of the SafeCurves requirements? [closed]

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, ...
5
votes
2answers
224 views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
-3
votes
1answer
53 views

Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?
12
votes
3answers
1k views

Why does SHA-1 have 80 rounds?

Why does SHA-1 algorithm have exactly 80 rounds? Is it to reduce collisions? If yes, then why do SHA-2 and SHA-3 have a lower number of rounds?
1
vote
1answer
90 views

Is there need for message authentication if a public key is transmitted and then used to encrypt a symmetric key?

First I'd like to note that I'm really a beginner at cryptography, and while this interests me and while I have researched it in the past few months, there is still a lot of things that simply aren't ...
2
votes
1answer
100 views

How can I show that the DDH problem is self-reducible?

I have trouble to understand how I can show that the Decisional Diffie-Hellman problem (DDH) is self-reducible. I found this as a description of a random self-reducible problem. ...
2
votes
1answer
132 views

ElGamal with elliptic curves I

It is very interesting to see @tylo's answer on ElGamal with elliptic curves. Instead of mapping the message to the elliptic curve point it just reduces an elliptic curve point to its $x$ coodrinate. ...
-2
votes
2answers
103 views

How to best mix two arbitrary/random n-bit words? [closed]

Given two arbitrary/random $n$-bit words, how could one best mix them to get one $n$-bit word for general crypto usages? I suppose that one should have an adequate measure of goodness of the mix ...
2
votes
2answers
86 views

Linear Cryptanalysis - possible without plaintext?

If Linear Cryptanalysis exploits the fact that the plaintext and ciphertext are not completely unrelated, is the attack possible without having access to the plaintext?

15 30 50 per page