3
votes
1answer
67 views

Is this a proper PBKDF2 key derivation function algorithm?

I've started implementing PBKDF2 algorithm recently and since I'm new in crypto, I would like to ask if my implementation is good. I looked up some documentations and I tried to follow many of them ...
5
votes
1answer
62 views

Comparing two definitions of one-way function

I'm reading Rafael Pass's lecture notes on one-way function and came across two definitions. The first one is: A function $f$ is one-way if $f$ can be computed in P.P.T. and there exists no ...
2
votes
1answer
245 views

XTEA: patterns in plain text

I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a ...
0
votes
0answers
16 views

In the RSA encryption system, are there not multiple messages m that give the same cipher text c? [duplicate]

For example: p = 5, q = 11, n = 55 $\phi$(55) = 40 e = 3, $\phi$(55) and 3 are relatively prime m = 3, then: $3^3 mod(55) = 27$ m = 113, then: $113^3 mod(55) = 27$ I heard that e and $\phi$(n) ...
1
vote
1answer
153 views

How to determine the RSA Private key size from the Public.key file?

Question: How to determine the RSA Private key size from the Public.key file? Just roughly, how big it could be? ...
2
votes
1answer
351 views

Extending key sizes in Salsa20 and ChaCha?

I've written implementations of Salsa20 and ChaCha that accept 384 and 448 bit keys. It was fairly trivial to implement, the 'sigma' constant is replaced with key material, and the counter, (which was ...
5
votes
2answers
395 views

Where are the ChaCha20 test vectors/examples?

I see in the Salsa20 specification there are test examples throughout the document to help an implementer make sure every function works as designed. Consequently the whole algorithm would work ...
6
votes
1answer
218 views

Can I use the ChaCha core as a 256-bit to 256-bit one-way function?

I'm looking to implement Lamport signatures as a little fun project, and I need a fast one way function that maps $\{0,1\}^{256} \rightarrow \{0,1\}^{256}$. I was wondering whether I could safely use ...
3
votes
1answer
95 views

Distribution based integer factorization

The past week I've been looking into - and playing with - algorithms for factoring RSA moduli. From what I understand, it's important that the primes p and q are of the same magnitude as the square ...
5
votes
2answers
259 views

When is the Random Oracle model (not) necessary?

Hash functions are often used in cryptographic schemes and protocols, and that doesn't necessarily mean that their proofs are on the Random Oracle model. That leads to the following question: What is ...
3
votes
3answers
3k views

How to use HMAC-SHA1, HMAC-SHA2 in conjunction with AES

I understand how to compute HMAC-SHA1, HMAC-SHA2 etcetera. Please explain why/how is the resulting HMAC value is used in conjunction with AES for encryption/decryption and signing/verifying. In ...
4
votes
0answers
47 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
1
vote
1answer
131 views

How does the HOTP dynamic truncation function generalize to longer hashes?

HOTP, the HMAC-based One-Time Password algorithm from RFC 4226, uses a "dynamic truncation" function to turn the 20 byte HMAC-SHA-1 value into a 31 bit string. The dynamic truncation (from Section ...
3
votes
1answer
101 views

Secure content-defined chunking

I am writing an app that needs to split a stream of plaintext bytes into variable-sized chunks (for deduplication). The way this is traditionally done is using a rolling hash function defined over ...
3
votes
1answer
205 views

Encrypt with one cipher and decrypt with a different cipher?

I recently installed an android app called Secret Space Encryptor and think I found a serious flaw in it. Let me explain: This app provides a variety of different ciphers to use and I used Threefish ...
2
votes
1answer
63 views

A secure function evaluation problem and an alternative of 1 out of n oblivious transfer?

I am considering a "secure function evaluation" problem: Consider two parties: A and B. A has a one-to-one mapping function $f(x)=k$. Basically, the function $f(x)$ can be regarded as a table of two ...
3
votes
2answers
62 views

Hiding identifying data while allowing matching?

I do research with people about their illegal drug use, and for one project I'm doing surveys with them when they visit a needle exchange. So over time the same people get repeatedly surveyed as they ...
2
votes
3answers
76 views

Authenticate ephemeral key exchange

At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange. If both ...
2
votes
0answers
59 views

Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text. I suspect, the steganography changes (elevates) ...
1
vote
1answer
347 views

Precisely how does CBC mode use the initialization vector? [duplicate]

As I understand it, AES in CBC mode does an XOR of the 128-bit initialization vector and the first 128 bits of plain text. Is this correct? I am using the PHP 5.3 openssl extension in aes-256-cbc ...
2
votes
1answer
34 views

Leakage in Secure Two party Computation

Am trying to understand Garbled Circuit based approach for Secure Two party Computation. There isn't much leakage in the classic millionaire's problem where the comparison circuit is used. But ...
9
votes
3answers
1k views

Is there an encryption format that preserves length and only outputs alphanumerics?

I'm trying to design a promo code system for a server app I'm designing. Basically, I generate a promo code for a certain item and give the code out to someone, who then types it into the server. ...
11
votes
1answer
333 views

How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
1
vote
1answer
40 views

Security of a signature scheme based on both factoring and discrete logarithms

I have seen this paper: A New Signature Scheme Based on Multiple Hard Number Theoretic Problems by Ismail and Tahat: In this paper, we propose a new signature scheme based on two hard number ...
3
votes
1answer
114 views

Why can't garbled circuits be reused?

There are a bunch of papers do research on resizable garbled circuits. But I wonder why garbled circuits cannot be reused? For example, the constructor constructs a garbled circuit of "AND" like ...
2
votes
2answers
152 views

What if OT breaks in Yao's garbled circuit?

Two semi-honest parties are computing F with Yao's garbled circuit. Sender garbles it with his inputs baked in then sends it to the receiver. At this point the receiver must use OT to get his keys. ...
1
vote
2answers
683 views

garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data. I think I understand how (fully or partially) homomorphic ...
2
votes
3answers
354 views

homomorphic encryption special case of multi party computation?

I read that Fully Homomorphic Encryption schemes are special case of Secure MPC in page no 3. Especially , generalization of two party computation problems stated by Yao But is there any additional ...
0
votes
3answers
75 views

Computational indistinguishability: are function parameters known?

I would like to clarify something about the definition of computational indistinguishability and pseudorandom number generators. Suppose we wanted to show that linear congruential generators of the ...
6
votes
2answers
71 views

How to propagate error in variable-sized message?

I want to design a scheme to encrypt a variable-length message with a secret key, to provide confidentiality. The message is a short human-readable text string with byte granularity, let's say under ...
1
vote
1answer
91 views

Value of S and r in Fiat-Shamir Protocol

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
0
votes
1answer
233 views

Is RC4 +XOR secure for small data?

I need to encrypt transmission between my device (with AVR processor) and base. I create packet data - it will be encrypted into string: ...
1
vote
1answer
71 views

Distinguishing between two probabilities and the uniform probability

Say I have a polynomial adversary $A$ that can distinguish with a non-negligible adventage between $x$ generated from a probability $X$ and $y$ generated from a probability $Y$. Obviously, this ...
1
vote
2answers
162 views

Basic Encryption and Decryption related question

I recently started studying cryptography and got interested in the subject. But I got this doubt when I was studying the encryption scheme. Even though we encrypt our message and change it into ...
0
votes
1answer
41 views

What are the first 4 and last 2 bytes in DH parameter files?

when we generate DH parameters file in PEM format, like this: ...
2
votes
2answers
85 views

Why is ECIES complex?

Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice? What attack vectors does ECIES protect against, that an ...
2
votes
2answers
574 views

Usage of different size chunks during AES encryption/decryption

I want to encrypt user's files on our server. For this purpose I decided to use the PHP Mcrypt library. I chose to use the Rijandel-128 algorithm and CBC mode for encryption. Since files are quite ...
1
vote
0answers
21 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
0
votes
1answer
23 views

Lower defree annihilator of function

Suppose $f=x_0x_2(x_1+1)+x_1x_3(x_0+1)$, annihilator is such function $g$, so that $gf=0$ for all $x$ Intuitively solution(for some reason) is obvious - $g=x_0x_1$, which holds true. (Cloud sagemath ...
0
votes
0answers
29 views

Is it bad practice to use the message digest of the plaintext as the initialization vector? [duplicate]

Data is being encrypted in a database. A message digest is being created for deduplication purposes. Is it ok to use the message digest that will be the key of the table that houses the encrypted ...
0
votes
0answers
107 views

Simple two round feistel chiffre

I am currently learning for a exam in cryptgraphy. I now try to understand the Feistel Cipher with two rounds. I do not have any information on what the functions are actually doing. The following ...
1
vote
0answers
48 views

2 round GOST_28147-89 cipher distinguisher

So, here is the scheme of how this will look graphically: The deal is to present distinguisher for this cipher. First of all here is my drafts: Way 1 Assume that distinguisher displays in ...
5
votes
1answer
715 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
5
votes
1answer
156 views

Fast 128-bit MAC with second preimage resistance?

I have an application that needs a fast 128-bit MAC to guarantee message authenticity in a protocol. I would like to reuse this MAC value as a binding identifier, so that even those who know the key ...
0
votes
1answer
117 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
1
vote
2answers
92 views

Which data encryption mechanism to use for data transfer?

I have high performance nodes communicating with each other sending logs and data over network. The communication is heavy and over public network. I would like to know how to know which is the best ...
2
votes
1answer
57 views

Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and ...
2
votes
2answers
144 views

Definition of authenticity

I came across various definitions of what authenticity means in cryptography. I would like to know which one is correct. The first definition - the one I always used - is the following: Data ...
5
votes
1answer
124 views

Has there ever been more then a theoretical difference between preimage resistance and second preimage resistance?

In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?
2
votes
1answer
73 views

Reverse output of general Fibonacci LFSR

Suppose we have some Fibonacci LFSR, and it outputs some sequence. How to change starting LFSR so, that it outputs exactly same sequence, but in reverse order?

15 30 50 per page