3
votes
1answer
237 views

Why not encrypt salt?

Assuming I had to distribute salt+ciphertext together over an insecure channel, isn't it better to store the salt encrypted? By encrypted I mean with a block cipher and with key and IV derived from ...
3
votes
1answer
805 views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
3
votes
1answer
409 views

bcrypt - collision-resistance against chosen salt and work factor?

Would it be difficult to find $\:$ cost,salt,input,password0,password1 $\:$ such that bcrypt(cost,salt,password0,input) = bcrypt(workfactor,salt,password1,input) and $\:$ password0 != password1 $\:$ ...
3
votes
1answer
300 views

Is symmetric encryption vulnerable to plain-text-attacks?

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
3
votes
2answers
166 views

MD5 implementation doubt

In MD5, there are four rounds. After every round, why do we need to add the computed Q values to the initial values and then take this value as input to the next round. For example after the first ...
3
votes
1answer
370 views

Is quantum key distribution safe against MITM attacks too?

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution ...
3
votes
2answers
477 views

are CFB and OFB really meant for streaming?

CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?
3
votes
1answer
382 views

Can I secure my key by XORing it with a hashed password?

I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows: The system creates a 256-bit key purely at random. The user chooses a ...
3
votes
2answers
567 views

Passwords with same SALT. What does this mean?

If the same SALT is used for many passwords on a Linux server, in what way is that a security risk? Does the mean, that a user (which can change his own password) can calculate other users passwords? ...
3
votes
1answer
1k views

RSA cracking: The same message is sent to two different people problem

Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ...
3
votes
2answers
213 views

How is de-synchronisation of HOTP solved?

From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong ...
3
votes
1answer
191 views

What is the property of RSA where N=e?

In RSA, suppose we know that $e=N$ and we are given the value of $e$. ($N = p\cdot q$ for some large primes $p$ and $q$; $\gcd(e, \varphi(N) = 1)$ Can we calculate $d$ ($d = e^{-1} \mod ...
3
votes
1answer
747 views

Encrypting (CBC) identical files with same key and different iv, is it less secure?

I would like to learn more about cryptography. Let's say you encrypt multiple files with CBC encryption using the same key, but each file has unique (and pseudo random) iv. Does this weakens the ...
3
votes
1answer
206 views

Protocol for Randomized Oblivious Transfer?

If we define Oblivious Transfer as following: Alice inputs $(x_0,x_1) \in F^2$, where $F$ is a field, and Bob inputs $b\in\{0,1\}$, then Alice gets a dummy output(for which she knows nothing about ...
3
votes
1answer
205 views

A set of key pairs and one hash to secure them

I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it ...
3
votes
2answers
97 views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
3
votes
2answers
96 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
3
votes
1answer
134 views

Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
3
votes
2answers
98 views

Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery?

In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message ...
3
votes
2answers
69 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
3
votes
1answer
109 views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
3
votes
1answer
83 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
3
votes
1answer
127 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
1answer
161 views

Proving the possession of signature in zero-knowledge

Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature ...
3
votes
1answer
80 views

Performance for Subbytes in AES

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set. For the Subbyte function i use movzx, having loaded ...
3
votes
1answer
94 views

Encrypting a short phrase into two keys. both with length of 32letters

It doesn't need to be crazy secure. I wanted to figure out if there's a popular practice when encrypting a short phrase (less than 32 letter long) into two keys (two strings 32 length). Doesn't need ...
3
votes
2answers
141 views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
3
votes
1answer
78 views

Has there ever been more then a theortetical difference between preimage resistance and second preimage resistance?

In other words, has there ever been a point in time in which having the content of a message has actually helped break a hash function?
3
votes
1answer
108 views

derangements and permutations in cryptography

Given a partial key for a mono-alphabetic substitution cipher (missing 11 letters), calculate the number $N$ of possible keys, given that no plaintext letter can be mapped to itself. ...
3
votes
1answer
180 views

RFC 3526 - What does pi mean?

In RFC 3526 there are a series of primes listed as standard parameters used for Diffie-Helman. The primes are list in two formats. One is the long format, where the number is given in hex. For ...
3
votes
2answers
316 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
3
votes
1answer
259 views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
103 views

Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt… Suppose I have 2 different keys: secretkey1 secretkey2 And a plain text: myReallySecretPlainText If I use AES128 ...
3
votes
2answers
130 views

ElGamal in private set intersection: how to handle negative numbers?

I am trying to implement the Efficient Robust Private Set Intersection using Additive ElGamal. For this, from the client side, my inputs are $C = \{1, 2\}$. So, the polynomial is $(x-1)(x-2)$ which ...
3
votes
1answer
435 views

Java's SecureRandom & plaintext attack?

Java's SecureRandom is meant to be cryptographically secure, and I know part of that means that the output should not be usable to predict further output. Though, ...
3
votes
2answers
160 views

Why have Nonce and why encrypt everything in step 2 for Needham-Schroeder?

Here is the protocol outline I am looking at (source: Foundations of Computer Security, Lecture 60: The Needham-Schroeder Protocol) $$ \begin{array}{ccl} 1.& A \to S \colon& A,B,N_a \\ ...
3
votes
2answers
229 views

How is the AEScrypt password related to the underlying AES key

AES uses a key that is at most 256 bit. I assume AESCrypt uses AES. When a file is encrypted with AEScrypt, there is no limit to the length of the password. What is the relation between the ...
3
votes
1answer
108 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
3
votes
1answer
96 views

Calculate entropy of key derived from PBKF2 function

I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived ...
3
votes
1answer
87 views

Diffie-Hellman for Encryption

In learning how DH works for cryptography applications, I'm coming across some confusing language. For starters, most of the time DH is discussed in the context of "generating" their shared secret. ...
3
votes
2answers
231 views

Encryption Key derivation from numeric PIN?

I want to store data encrypted within an Android application. Keeping an encryption key safe outside the app is not an option so I looked into password derived key algorithms. I found a nice example ...
3
votes
2answers
136 views

Why doesn't this dummy mutual authentication protocol provide mutual authentication?

I am a student taking a cryptography course so forgive me if this comes off as a silly question. This is an assignment question: $Alice \rightarrow R \rightarrow Bob$ $Alice \leftarrow [R]B ...
3
votes
2answers
62 views

Why do the outputs of parties in an MPC protocol have to be indistinguishable from the ideal / real world (as opposed to inputs)?

In this paper at the bottom of pg. 1235 and beginning of pg. 1236 it says: An MPC protocol is said to be secure, if for every real world leakage adversary A there exists an ideal world ...
3
votes
1answer
188 views

Fully Homomorphic Encryption over the Integers - Runtime Question

I have a question regarding the paper "Fully Homomorphic Encryption over the Integers" (http://eprint.iacr.org/2009/616.pdf): On page 6 after they set their parameters, it says "This setting results ...
3
votes
1answer
248 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
3
votes
2answers
210 views

Encryption of small messages

Some time ago, I asked how to encrypt small messages like e.g., four decimal digit numbers (banking PINs). I've got my answer, but also a warning like it makes no sense as it's easy to guess: Even ...
3
votes
1answer
2k views

Decrypting the password from SHA-512 hash value

I am currently studying AES algorithm and writing a Code using Python. I am trying to add 'Salt' into the user input password, Here is what I am doing, ...
3
votes
2answers
332 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
1answer
88 views

Hashing a message with a length that isn't a multiple of 8 bits

NIST FIPS 180-4. “5.1. Padding the Message.” Suppose that the length of the message, $M$, is $l$ bits. Is there any library that can receive a message of length (in bits) which is not a multiple ...
3
votes
2answers
321 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?

15 30 50 per page