1
vote
1answer
155 views
Public Key Encryption with forward secrecy
Is there a known non-trivial system with plausibly secure public key encryption where:
1. $\;\;$ the $\:$ time $\:$ function is efficiently computable
2. $\;\;$ [pubkey,privkey] $\:$ pairs are ...
2
votes
1answer
326 views
How many RSA keys before a collision?
I was wondering how many possibilities of private/public keys there are? If a million people for whatever reason tried to generate 5keys each in the same minute (on the same date and time) is there a ...
0
votes
1answer
199 views
Recovering the key in an ElGamal Signature Scheme variant
From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3:
Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that ...
1
vote
2answers
170 views
How do I demonstrate that a PRNG not designed for cryptography is not suitable for generating passwords?
This is a replication of this question on Stack Overflow. There's class Random in .NET runtime which is designed for use as a cheap fast source of pseudo-random ...
0
votes
0answers
104 views
Search tool to identify which algorithm is in use [closed]
I'm trying to identify what algorithm is encrypting / encoding / hashing passwords in a client system. I have samples of matching plaintext and ciphertext. Is there a search engine somewhere that will ...
1
vote
3answers
311 views
RSA finding the inverse of the public exponent
I have a very basic doubt in RSA key generation and its usage.
In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
4
votes
1answer
106 views
Do public/private pairs work both ways?
Public/private key algorithms such as RSA encrypt a message with a private key but only decrypted with another (mathematically related) key.
Can the public key decrypt the messages encrypted with ...
6
votes
1answer
591 views
Generating Random Primes
Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version".
I'm implementing some homomorphic encryption ...
6
votes
1answer
127 views
Message space in security definitions
What is the message space in the following example and how does a message space relate to a security definition?
I mean, what difference does it make to such a definition if your message space is ...
3
votes
1answer
300 views
Elliptic curves for ECDSA
i'm trying to implement parameters generation for ECDSA according to SEC1 v2.0:
Input: The approximate security level in bits = t is {80, 112, 128, 192, 256}
...
6
votes
3answers
370 views
Security equivalence proofs for breaking RSA
It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring.
In otherwords, ...
3
votes
2answers
510 views
What is the smallest plaintext/ciphertext size for an algorithm like?
When I read about a choosen plaintext attack, for example on AES the block size is always 128 bits, does it mean the attacker will only supply 128 bits data words as "plain text" ?
11
votes
6answers
360 views
Can I encrypt user input in a way I can't decrypt it for a certain period of time?
I run a baseball league and would like to do silent auctions for free agents. This would require teams to enter their highest bid and the highest bidder at the end of the auction period would win. ...
5
votes
2answers
310 views
Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
3
votes
1answer
168 views
Has there been any cryptanalysis of RC4-52?
Several websites ( such as Is there a secure cryptosystem that can be performed mentally? ) briefly mention RC4-52 as a modification of standard RC4.
RC4-52 has only with 52 instead of 256 elements ...
5
votes
1answer
126 views
Digital signature for an expiring password
I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource.
My idea is to digitally sign the current date with a private key ...
5
votes
1answer
161 views
One-way hash on encrypted data, result hidden from hasher
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
3
votes
3answers
863 views
How does the key schedule of Rijndael looks for keysizes other than 128 bit?
It said in Wikipedia that:
[....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
-4
votes
2answers
147 views
Any techniques for evading frequency based crypt analysis without encrypting?
Are there any general techniques for evading frequency based crypt analysis without using any encrypting techniques
6
votes
1answer
213 views
A fair peer-based coin-flipping protocol?
I found this question on the game programming site and was intrigued. I came up with an answer off the top of my head but I'm no cryptanalyst so it is probably not water-tight.
This is how my idea ...
16
votes
4answers
668 views
How to fairly select a random number for a game without trusting a third party?
Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.)
Can this be done such that each player has the power to be ...
4
votes
1answer
457 views
advantages of a static ECDH key
What are the advantages of using static-ephemeral ECDH over ephemeral-ephemeral ECDH?
7
votes
2answers
437 views
Does AES have any fixed-points?
Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?
If yes, how do I go about (efficiently) finding such a pair?
6
votes
1answer
398 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
3
votes
3answers
504 views
Why hash or salt when signing?
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?
5
votes
1answer
269 views
CBC key lifetime, or, “how big is too big?”
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
6
votes
1answer
553 views
In which situations is a length-extension attack a problem?
A lot of hash functions, including the SHA-2 family(but not the SHA-3 candidates and SHA256d) are vulnerable to length extension attacks. But when is this property a problem?
I guess certain naive ...
2
votes
1answer
454 views
How to sign a message using RSA?
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.
I don't know much about cryptography, but I can get these numbers ...
3
votes
3answers
175 views
Are asymptotic lower bounds relevant to cryptography?
An asymptotic lower bound such as exponential-hardness is generally thought to imply that a problem is "inherently difficult". Encryption that is "inherently difficult" to break is thought to be ...
-3
votes
1answer
199 views
0
votes
2answers
165 views
Existing dictionaries of popular words to help solve a random substitution cipher?
I'm trying to find faster ways to solve this:
http://cryptogram.org/solve_cipher.html
Actually lists of common words are good, but they are often limited to 1000 words.
I found this, but I'm not ...
0
votes
0answers
54 views
cipher text only attack - how to know when to stop when brute-force attack? [duplicate]
Possible Duplicate:
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
My question is about a cipher text only attack - I have as input only the initialization ...
2
votes
1answer
129 views
Question about hash collisions
If we have a hash function $h(x)$ and then a hash function $H(X) = h(h(X_0) || h(X_1))$ where $X_0$ is the first half of $X$, $X_1$ is the second half of $X$ and $||$ is concatenation. Then assuming ...
3
votes
1answer
233 views
Is it safe to encrypt a public key alongside a message with AES?
If I have a message M and a public key P, and I encrypt them alongside one another:
CIPHER = AES(M + P, aes_key)
Is CIPHER now weakened if someone knows what P ...
4
votes
1answer
220 views
Can a digital money system exist, that's secure, anonymous and allows offline transactions?
I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
7
votes
3answers
764 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
5
votes
1answer
293 views
XSL on serpent and rijndael - which is most affected?
So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
3
votes
1answer
205 views
Blind signature with openssl
I'm trying to understand (to reproduce in practice) how does blinded tokens work. Currently i'm lacking examples. According to Wiki the blinded signature protocol is the same as ordinary signature ...
1
vote
1answer
161 views
ID-Secret Scheme
I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present.
Party 1 and Party 2 hold some credentials, an ID and a Secret.
Party 1 Creates this message:
...
0
votes
1answer
140 views
Block ordering and security in a MAC?
To authenticate a message $m = m_1 \,\|\, \dots \,\|\,m_n$ the tag $t := F_k(r) \oplus F_k(m_1) \oplus \dotsb \oplus F_k(m_n)$ is used, where r is uniform random number $(0,1)^n$ and $m=(0,1)^n$. Even ...
2
votes
1answer
196 views
Is this authenticated one-way communication protocol secure?
I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
1
vote
1answer
51 views
Proving item association without revealing one of the associated items
I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category.
I have two associated pieces of information:
tag — known by both parties. Unique per ...
1
vote
1answer
59 views
Distributed knowledge problem
I need a way to distribute knowledge among multiple parties - lets start with two. The idea is while the knowledge is originally created by one party I need to transform it into a situation where no ...
2
votes
1answer
143 views
How are the primes used to generate RSA keys?
I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
2
votes
8answers
826 views
Would it be secure to use random numbers from random.org in a cryptographic solution?
Random.org provides true random numbers through an unsecured web service. Since these numbers would be transmitted in plaintext could they still be considered useful as true random numbers while ...
2
votes
2answers
738 views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
1
vote
0answers
143 views
Most frequently used digital signature schemes in the recent years
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.
I'm only really interested in what is employed recently (ie. last couple ...
6
votes
1answer
165 views
Useful pairings for cryptography
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
4
votes
1answer
438 views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
2
votes
2answers
255 views
Simple xor cipher extension
Probably the simplest cipher is the xor cipher with a single integer. One can extend this to use more than one integer by several means. I'm wondering if there is any benefit to doing more than this:
...
