4
votes
1answer
902 views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...
4
votes
1answer
150 views

Does security under ROM imply exactly what?

I'm not sure I understand really the implications of proofs of security in the random oracle model. Does a proof of security in ROM translate to a reduction of security of the crypto-system to the ...
4
votes
1answer
519 views

Can one group the SHA-256 outputs depending on partial inputs?

Is it possible to predict a hash key based on half key? Let's have some example: I have 100000000 hash results, and they are generated by either ...
4
votes
2answers
2k views

How to attack a general polyalphabetic cipher?

I am able to decrypt vigenere cipher text using the index of coincidence and chi test. However out of interested how do you go about attacking ciphertext that was encrypted using a mix alphabet ...
4
votes
5answers
1k views

Software implementation of a commutative cipher?

I've got an application (detailed below) that calls for the use of a cipher that is commutative. I've been doing some googling & reading, and there are two algorithms that seem to get mentioned ...
4
votes
2answers
505 views

How can one break a monoalphbetic substitution chipher at pseudorandom text?

Does anybody know how to break monoalphbetic substitution cipher, if it is applied to some pseudorandom text (for example to some surrogate key filed in a database)? Let us assume that we have only ...
4
votes
1answer
230 views

How common are SEED certificates outside of Korea? When is support required?

I'm looking at the SEED algorithm and would like to know if this is still in common usage. Can anyone tell me when I would need to implement this standard, either as a client or a server?
4
votes
1answer
112 views

EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient and I can't see how it adds any extra ...
4
votes
2answers
76 views

Brute-force attack given multiple hash prefixes

(Context: I'm auditing some code which I suspect to be insecure, but I'd like to be able to quantify this.) Suppose you have a 56-bit secret key ($secret), and ...
4
votes
1answer
147 views

Can the same random number be used in encryption and signing?

In several public key algorithms, the person running the algorithm must generate a random number (that's separate from the key). Can this random number be the same for an encryption and a signature? ...
4
votes
1answer
233 views

How hard is it to find plaintexts whose hashes satisfy $h(a)\oplus h(b)=h(c)$?

Given a cryptographic hash function $h$, for example SHA256, how hard is it to find plaintexts $a,b,c$ such that $$h(a)\oplus h(b)=h(c) \text?$$
4
votes
1answer
76 views

Can we run a probabilistic function on ciphertext with Functional Encryption (or Attribute Based Encryption)?

In the definition of functional encryption ($FE$): $FE.Setup(1^k)$ takes as input the security parameter $1^k$ and outputs a master public key $fmpk$ and a master secret key $fmsk$. $FE.KeyGen(fmsk, ...
4
votes
1answer
115 views

Generic group model: use of polynomials in the proof of the master theorem

I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ...
4
votes
1answer
74 views

Statistical tests for pseudorandom permutations

I'm implementing a format-preserving encryption scheme similar to those described in the literature. I want to sanity test my PRP using some statistical tests like TestU01. However, I'm not sure how ...
4
votes
1answer
825 views

Luby-Rackoff theorem confusion

The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF) then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP). PRPs are ...
4
votes
1answer
212 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
4
votes
1answer
102 views

OTT service using FPE

Would it be possible to create an Over-The-Top communication utility that will encrypt voice using format preserving encryption (voice clear-text to audio encrypted stream) and send that over an ...
4
votes
1answer
191 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
4
votes
1answer
473 views

Is there a generic attack on encrypted CRC32 when used as a MAC?

I am examining a protocol that uses CRC32 as a MAC (see note 1) the weaknesses of this method but I would nevertheless like to see if it is just weak or actually relatively easily to break. The ...
4
votes
1answer
69 views

Are HMACs based on hashes with larger bit-lengths also more secure?

When doing encrypt-then-mac, I can choose to use a hmac as the MAC. For example, I could use a hash like SHA-256 or SHA-512 (by using it as a keyed hash) to create that HMAC. Does it increase ...
4
votes
1answer
126 views

McEliece and cryptanalysis

What is the computational time to break McEliece on a quantum computer? I've seen that polynomial time algorithms exist, but for special conditions. What about the general case?
4
votes
1answer
297 views

Can a homomorphic encryption scheme be made CCA2 Secure?

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 ...
4
votes
1answer
151 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
4
votes
2answers
124 views

Use of less than secure random numbers for 'a' during an SRP proof of password

With Secure Remote Password protocol SRP6a random numbers are used for s, a and b. Where ...
4
votes
1answer
138 views

Hide message length in symmetric key cryptography

Is there any way to hide message length from adversary in symmetric key cryptography? Suppose we want to hide message length from active and efficient adversaries.
4
votes
1answer
166 views

Hash collision resistance of $\mathcal H^\prime(m) = \mathcal H(\mathcal H(m)|m)$

So far as I can find, every method better at producing hash collisions in cryptographic hashes than generic collision search involves finding some metric for the distance between two messages' hashes ...
4
votes
3answers
337 views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
4
votes
1answer
212 views

Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
4
votes
1answer
72 views

What is the Geometric Generalised T' Method?

This page by Nicolas T. Courtois mentions Geometric Generalised T' Method. It is described as an advanced geometric algorithm, never published, for finding extra linearly independent equations at ...
4
votes
1answer
731 views

Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example. My question is: is it still secure under the following conditions? Alice sends a ...
4
votes
1answer
167 views

Private set intersection, using a semi-trusted server

Alice has a set $S$ of words. Bob has a set $T$ of words. They want to compute the intersection $S \cap T$ of their words, with the help of a semi-trusted third party Trent. Trent runs a central ...
4
votes
1answer
847 views

Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
4
votes
1answer
153 views

Reason for difference in assumptions for practical private-key and public-key crypto

Theoretical cryptography tells us that everything in the world of private-key cryptography (CCA-secure symmetric encryption, message authentication codes, etc.) can be built from one-way functions and ...
4
votes
1answer
133 views

Encrypting a TCP connection between two unknown nodes

I'm writing an application for controlling computers from a client. I'd very much like it if the connection is secure and only authenticated clients are allowed access. The workflow will be ...
4
votes
1answer
1k views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...
4
votes
1answer
273 views

Brute Force on 3DES with Reduced Keyspace and Unknown IV

I'm trying to brute force a 3DES problem given a reduced keyspace (ie I know the first half of the key) but with an unknown IV. The code decrypts to plaintext. My first thought was that I could set ...
4
votes
1answer
163 views

Cryptanalysis of AES on SSD with TRIM enabled

Attack scenario: SSD physically retrieved from a computer that is turned off. The entire disk is encrypted with AES 256-bit (GNU/Linux, LUKS). The SSD has had TRIM enabled for several years and the ...
4
votes
1answer
187 views

Keyed digest function with odds of collision below the birthday bound?

I wonder if it is possible to devise a function $F(K,S,R_S)\mapsto D$ where: $K$ is some key (I have freedom on $K$, it could even be generated by a trusted party); $S$ is in $\{0,1\}^s$, say ...
4
votes
1answer
164 views

Can I use the ChaCha core as a 256-bit to 256-bit one-way function?

I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ...
4
votes
2answers
639 views

RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
4
votes
1answer
422 views

Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
4
votes
2answers
538 views

What is the definition of “security beyond the birthday paradox”?

I'm reading a paper about MACs and I would like to be sure about the meaning of a security beyond the birthday paradox. Is there a definition?
4
votes
2answers
168 views

Non-interactive proof that an element is in a subgroup

I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| ...
4
votes
1answer
107 views

What security do digital signatures provide (like used when signing PDFs)?

I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs. We know that if our document has a digital signature, we can detect if the original ...
4
votes
1answer
449 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
4
votes
1answer
160 views

Can a PRNG with a fixed amount of entropy always be detected?

Given a fixed seed (i.e. no ongoing source on entropy), is there (practically or theoretically) any PRNG algorithm that can generate an infinite sequence of random numbers such that an observer cannot ...
4
votes
2answers
309 views

Proof of elliptic curve difficulty

Are there any proofs that cryptographic functions on an elliptic curve are any more difficult than the analogues over modulo arithmetic? While at present, ECC appears to be more difficult, as it is ...
4
votes
1answer
366 views

How Were secp*k1 elliptic curve generators chosen?

The Koblitz elliptic curves specified in the SEC2 document https://docs.google.com/viewer?url=http%3A%2F%2Fwww.secg.org%2Fcollateral%2Fsec2_final.pdf all have the nice feature that the parameters are ...
4
votes
2answers
300 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
4
votes
1answer
188 views

Is my identity exposed when publishing my public key or encrypting with PGP?

Let's say I create my PGP keys with my appropriate name and email address. Will these personal information be exposed if I publish my public key? When I encrypt a message for sending it to my ...

15 30 50 per page