5
votes
1answer
597 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
5
votes
1answer
3k views

Padding methods for block ciphers - PKCS7 vs ANSI X.923

I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
5
votes
1answer
275 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
5
votes
1answer
408 views

Memory-hard operations in work-factor hash functions

I'm playing around with work-factor hash functions, and I'm looking for a memory-hard operation to make it resistant to GPU / parallel hardware attacks. I considered a very large (i.e. 64K) s-box that ...
5
votes
2answers
335 views

Is my HMAC secure if I have a complete series of HMAC'd prefix strings

Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ...
5
votes
1answer
221 views

One-way hash on encrypted data, result hidden from hasher

I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
5
votes
1answer
398 views

Can a digital money system exist, that's secure, anonymous and allows offline transactions?

I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
5
votes
1answer
2k views

Trouble with diffie-hellman groups

Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
5
votes
1answer
1k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
5
votes
1answer
651 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
5
votes
1answer
610 views

How close is homomorphic encryption to handling regular expressions?

Is there any reasonable homomorphic encryption protocol that supports some meaningful fragment of regular languages/expressions and/or edit distance bounds? I'm suspicious that homomorphic encryption ...
5
votes
1answer
202 views

Academic papers on ECDSA security

What are the most authoritative papers on the security analysis of ECDSAs? I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of ...
5
votes
1answer
185 views

Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
5
votes
1answer
349 views

How can I store confident data with OpenID?

I want to make a system that needs to store some confident user information in a database. I intend on using OpenID for user authentication. I would like encrypt the data in a way that it can only be ...
5
votes
1answer
236 views

Why isn't the IND-CCA property inherited when sending redundant ciphertext?

Suppose that in order to avoid loss in transmission, a secret key encryption scheme $(Gen, Enc, Dec)$ is modified to be $(Gen, Enc', Dec')$, such that the message m is encrypted independently ...
5
votes
3answers
344 views

Designing a key expander out of ciphers

Is it possible to compose or combine $n$ ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate $n$ ciphertexts from the same key, $k$, and that recovering the key, $k$, from ...
5
votes
1answer
86 views

Find collision in Ajtai's hash function using short vector

Background What is Ajtai's hash function? Given a matrix $A \hookleftarrow U(\mathbb{Z}_q^{n \times m})$ and a column vector $\vec{m} \in \mathbb{Z}_d^m$, the hash of the message $\vec{m}$ is given ...
5
votes
1answer
52 views

Padding password before SHA-512 hashing to avoid info leak via timing

I've noticed that SHA-512 password hashing leaks some information about the password length. There's a weak correlation between password length and time to hash. It's roughly linear, but in steps of ...
5
votes
1answer
134 views

Encryption scheme like RSA where encryption is the inverse of decryption

In RSA, it is basically equivalent to use the private key $d$ to encrypt as it is to use the public key $e$ to encrypt. They are exactly inverses: $e=d^{-1}$. I need to know, are there other public ...
5
votes
1answer
190 views

Zero-Knowledge Proof of a polynomial

I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and ...
5
votes
1answer
72 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
5
votes
1answer
113 views

Coin flipping with limited communication between participants

Alice and Bob want to play a coin flipping game. Alice wins if the coin flips head. They choose to trust a independent third party that generates a random beacon (such as NIST). There is no ...
5
votes
2answers
761 views

What are the strenghts and weaknesses of Whirlpool Hashing Algorithm

I want to find out if the Whirlpool hashing algorithm have any weaknesses. There are quite a bit of articles explaining the strengths of this algorithm, but for some reason I cannot find any on its ...
5
votes
1answer
128 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
5
votes
1answer
187 views

At what point does passphrase strength match the strength of the cipher?

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing: -AES -RIPEMD-160 Hash Algorithm Now let's say that for an arbitrary machine, the ...
5
votes
1answer
768 views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
5
votes
1answer
264 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
5
votes
1answer
148 views

cryptographically good random elliptic curves?

After an answer here, about generate elliptic curves, I've start thinking about the algorithm. The mentioned algorithm will produce curves in the Weierstraß Reduced Form (WRF) over finite fields: ...
5
votes
1answer
311 views

One-way permutation over a small interval?

I am wondering what concrete computable functions we know that are a permutation over an integer interval of parameterizable size $s$, for relatively small $s$ starting circa $2^{64}$, to perhaps ...
5
votes
1answer
509 views

What could “look for the constants that you might find in RC6” mean?

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"): look for the constants that you might find in RC6 ...
5
votes
1answer
855 views

Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
5
votes
1answer
470 views

What are the pros and cons of deterministic site-specific password generation from a master pass?

I've been reading up a bit on deterministic password generators. All the ones I can find basically do something like this: Pick a master username and a master passphrase. The username could be your ...
5
votes
1answer
506 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
5
votes
1answer
147 views

Using encryption schemes for identification

I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
5
votes
1answer
231 views

Questions on rank-attacks in Multivariate Cryptography

While reading this article on rank attacks on STS (a public-key scheme based on Multivariate Quadratic (MQ) equations), I stumbled upon some claims that I've also seen in other presentations on ...
5
votes
1answer
333 views

md5: is reverse length-extension attack possible?

If I know H = md5( SECRET_KEY | DATA ) then I can calculate H' = md5( SECRET_KEY | DATA | DATA' ) That's length-extension ...
5
votes
1answer
219 views

Pseudo preimage for a hash made from a cipher

Consider the Miyaguchi–Preneel construction: $H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros) $H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$ where $E(K,M)$ is a block cipher (for ...
5
votes
1answer
2k views

Is this design of client side encryption secure?

I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
5
votes
1answer
169 views

Digital signature for an expiring password

I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource. My idea is to digitally sign the current date with a private key ...
5
votes
2answers
542 views

Can I use guids / uuids as counters for key derivation?

I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers. For reference, The KDF I'm going to use is Hash( C | ...
5
votes
1answer
483 views

Are there any Implementations of Secure Indexes? [closed]

There are several papers about Secure Indexes, for Example "Searchable Symmetric Encryption: Improved Definitions and Efficient Constructions" and "Secure Indexes". ...
5
votes
3answers
852 views

How can I prevent a message replay with RSA?

I am using RSA to encrypt some data but I would like to eliminate the possibility of message replay. By message replay I mean sending a valid message multiple times to the original recipient. It is ...
5
votes
1answer
47 views

State of the art low memory arbitrary-domain PRP?

I am wondering what the state of the art is on low memory arbitrary-domain PRPs. That is, I'm looking for an algorithm that implements bijective function $PRP : \mathbb{Z}_n \times \{0, 1\}^b ...
5
votes
1answer
217 views

Why $e>n^{3/2}$ prevents Wiener's attack

Here's the Wiener's attack as I understand it. Suppose $n=pq$ with $q < p < 2q$, and $d < n^{1/4}/3$ where $ed=k\phi(n)+1$ and $e < \phi(n)$. $$\begin{align*} n-\phi(n) ...
5
votes
1answer
54 views

How to show CPA attacker does not need access to encryption oracle after receiving cyphertext

In the private key CPA game, the attacker has access to an encryption oracle anytime during the attack. However, I have seen this statement in lecture notes I downloaded "You can prove that for ...
5
votes
2answers
87 views

How many polynomials are used in Secure Multiparty Computation?

Secure Multiparty Computation based on Samir Secret sharing methods rely on Polynomials. Imagine corpus of data should be outsourced to bunch of untrusted servers for any computations. Now the data ...
5
votes
1answer
164 views

Why is only one oracle + challenge-response phase sufficient for IND-CPA security?

The CRYPTUTOR wiki from UIUC uses the following definition of the IND-CPA game: We (privately) choose a key K according to the key generation algorithm: K $\gets \mathsf{KeyGen}$. We ...
5
votes
1answer
256 views

Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
5
votes
1answer
115 views

Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?

I'm reading the ECDSA paper and they say you can only use ECDSA with odd-power fields $p$ or with binary fields $2^m$. Why not other power prime fields?
5
votes
1answer
125 views

EC: Why does $h>200$ need to hold?

From BSI-TR-03111 (PDF), on page 15: The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200. This value commonly is referred to as $h$ in that ...

15 30 50 per page