All Questions
5
votes
1answer
254 views
CBC key lifetime, or, “how big is too big?”
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
6
votes
1answer
545 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
2
votes
1answer
428 views
How to sign a message using RSA?
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.
I don't know much about cryptography, but I can get these numbers ...
3
votes
3answers
173 views
Are asymptotic lower bounds relevant to cryptography?
An asymptotic lower bound such as exponential-hardness is generally thought to imply that a problem is "inherently difficult". Encryption that is "inherently difficult" to break is thought to be ...
2
votes
2answers
197 views
Questions about Key Derivation Functions
My understanding is that a KDF is a function that takes a master secret and generates multiple keys. It is secure as long as the keys are "independent". If this is true, the following definition would ...
-3
votes
1answer
196 views
0
votes
2answers
158 views
Existing dictionaries of popular words to help solve a random substitution cipher?
I'm trying to find faster ways to solve this:
http://cryptogram.org/solve_cipher.html
Actually lists of common words are good, but they are often limited to 1000 words.
I found this, but I'm not ...
0
votes
0answers
54 views
cipher text only attack - how to know when to stop when brute-force attack? [duplicate]
Possible Duplicate:
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
My question is about a cipher text only attack - I have as input only the initialization ...
2
votes
1answer
126 views
Question about hash collisions
If we have a hash function $h(x)$ and then a hash function $H(X) = h(h(X_0) || h(X_1))$ where $X_0$ is the first half of $X$, $X_1$ is the second half of $X$ and $||$ is concatenation. Then assuming ...
3
votes
1answer
231 views
Is it safe to encrypt a public key alongside a message with AES?
If I have a message M and a public key P, and I encrypt them alongside one another:
CIPHER = AES(M + P, aes_key)
Is CIPHER now weakened if someone knows what P ...
4
votes
1answer
213 views
Can a digital money system exist, that's secure, anonymous and allows offline transactions?
I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
5
votes
1answer
289 views
XSL on serpent and rijndael - which is most affected?
So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
3
votes
1answer
200 views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
1
vote
1answer
160 views
ID-Secret Scheme
I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present.
Party 1 and Party 2 hold some credentials, an ID and a Secret.
Party 1 Creates this message:
...
0
votes
1answer
139 views
Block ordering and security in a MAC?
To authenticate a message $m = m_1 \,\|\, \dots \,\|\,m_n$ the tag $t := F_k(r) \oplus F_k(m_1) \oplus \dotsb \oplus F_k(m_n)$ is used, where r is uniform random number $(0,1)^n$ and $m=(0,1)^n$. Even ...
2
votes
1answer
185 views
Is this authenticated one-way communication protocol secure?
I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
1
vote
1answer
51 views
Proving item association without revealing one of the associated items
I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category.
I have two associated pieces of information:
tag — known by both parties. Unique per ...
1
vote
1answer
58 views
Distributed knowledge problem
I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
1
vote
1answer
136 views
How are the primes used to generate RSA keys?
I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
2
votes
8answers
784 views
Would it be secure to use random numbers from random.org in a cryptographic solution?
Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while ...
2
votes
2answers
703 views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
1
vote
0answers
140 views
Most frequently used digital signature schemes in the recent years
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.
I'm only really interested in what is employed recently (ie. last couple ...
6
votes
1answer
161 views
Useful pairings for cryptography
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
4
votes
1answer
421 views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
2
votes
2answers
253 views
Simple xor cipher extension
Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this:
...
3
votes
2answers
289 views
Can RSA encryption produce collisions?
In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.)
My question is, can $m^e$ be ...
1
vote
0answers
63 views
Is it possible to build an unfair noisy channel from 1 out of 2 oblivious transfer [closed]
For a fair channel, sender sends a bit b and receiver gets it with probability 1/2 and gets b's flipped value with probability 1/2. It is trivial to build a fair noisy channel from 1 out of 2 ...
2
votes
1answer
89 views
What “Tag Length” should be used for the EAX MAC?
Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
5
votes
1answer
348 views
Would RSA-encrypting a private key for itself constitute a vulnerability?
I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
9
votes
4answers
424 views
Can you make a hash out of a stream cipher?
A comment on another question made me wonder about something:
Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
3
votes
1answer
451 views
X9.62 Multiplying an elliptic curve point by a number
I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number.
As far as i understand X9.62 gives some recommendation for doing it but i ...
2
votes
1answer
597 views
AES-NI implementation examples
Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ...
8
votes
1answer
239 views
Making ECDSA public keys one bit shorter
In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it.
...
1
vote
2answers
175 views
One-way function and factoring
I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
2
votes
1answer
340 views
What is the correct way to generate cryptographically-secure pseudorandom numbers in C?
I am learning about crypto, purely for my own interest. As part of that I am implementing a simple 'one time pad' toolset in C.
Naturally I need to generate random numbers to create the pad, and they ...
1
vote
2answers
334 views
Can we use elliptic curve cryptography in wireless sensors?
Can we use elliptic curve cryptography in wireless sensors?
If so, how do you map points to message characters?
0
votes
1answer
202 views
Brute forcing Cardan grille
Having a "rotating" square Cardan Grill with sides long n cells, how could i determinate the cost of a brute-force attack?
How many configurations should be considered to perform an exhaustive ...
1
vote
0answers
101 views
Security of stream cipher based on Matrix multiplication GF(256) with randomized padding
The actual question is stated at the end of the text. Suppose you have a (grossly inefficient) confidentiality stream cipher with the following components:
The keyed function ...
2
votes
3answers
328 views
Trying to find a different DES encryption system explanation
I need a mathematical explanation of what does the DES encryption system really do.
This means I need more explanation than the one that offers FIPS, which is more an explanation for computer ...
3
votes
1answer
122 views
DIfferent inner and outer hash functions for NIST Recommended HMAC?
The NIST recommended HMAC uses
$$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$
Is it ...
3
votes
2answers
7k views
How secure is AES-256?
The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers.
In theory it's not crackable since the combinations of keys are massive.
Although ...
1
vote
1answer
656 views
Big-O Notation: Encryption Algorithms
I am currently completing a dissertation concerning the encryption of data through a variety of cryptographic algorithms.
I have spent much time reading journals and papers but as yet have been ...
2
votes
2answers
2k views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
5
votes
2answers
207 views
Is there a hash algorithm that is slow to calculate but relatively fast to check?
Or more generally, is there a function or algorithm that is slow to calculate/execute, has a reliable execution time, and has a result that can be tested much more quickly than the calculation took?
1
vote
1answer
741 views
Is AES restricted to only 64 characters for the key/password?
I am wondering if AES only supports 64 character passwords?
When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters.
...
2
votes
1answer
584 views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code ...
-2
votes
3answers
306 views
Crypto-Compression Algorithms?
I was wondering, whether there exist such algorithms/enciphering procedures which both compress and encrypt the input data. That means, for starters, the output will be both smaller in size and ...
0
votes
2answers
134 views
CPA distinguisher for matrix multiplication in GF(256) with randomized padding
What is the best CPA distinguisher for the function $F_k:\{0,1\}^{8n}\to\{0,1\}^{16n}$ described below?
Let $E_k$ be a $2n\times2n$ matrix with elements in $GF(2^8)$, selected by generating bit ...
1
vote
2answers
216 views
My custom handshake
I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements:
Requirements:
The handshake ...
