3
votes
2answers
171 views

Parallel-resistant proof-of-work scheme?

I am looking for a proof-of-work scheme which cannot be effectively parallelized. For example, in hashcash (and by extension bitcoin) you have some collision-resistant hash function $f()$, a target ...
4
votes
2answers
191 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
2
votes
1answer
111 views

Is generating public key inevitably slow in classic Diffie-Hellman if the private key is large?

Let's say I pick a 3000+ bit prime $p$ for which I also know that $q = (p - 1) / 2$ is a prime. If I've understood correct, then I can pick pretty much any $g$. Is generating $g^x$ now inevitably ...
4
votes
2answers
298 views

Can you break a multi language code using Frequency analysis?

Let say that I wrote a 26 letter alphabet, each letter of my alphabet represent a letter from the latin alphabet. I'm writing in 3 languages, only I know which languages. Grammar is the one from my ...
6
votes
1answer
160 views

multiple keys via HKDF - whats better, one or two applications of HKDF-extract

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256. Which alternative ...
2
votes
0answers
105 views

Jumblar: Using map locations as passwords

I had the idea of converting map locations into passwords. Basically Jumblar takes a hash of the user's location and stores this as a comment on the PGP network. The 'stored-hash'(Vague-Hash) ...
5
votes
1answer
104 views

repeated use of HKDF-extract on the same PRK

Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand. Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple ...
2
votes
1answer
95 views

using random encrypted RSA challenge as key material

Assume a simple protocol for authentication - one side sends a randomly generated challenge string and encrypts it with RSA. The receiver decrypts it and replies with a hash of the challenge, proving ...
5
votes
1answer
112 views

estimating entropy/randomness as fail-safe mechanism

Real-world encryption systems are often not broken algorithmically but because the implementation has a bug. Sometimes the bug only happens in circumstances that could not have been foreseen, such as ...
2
votes
1answer
111 views

Can you explain what the AES paper means by “sharing active S-boxes”?

I am reading the "Biclique cryptanalysis of the full AES" paper. What do they mean by "sharing active S-boxes"? How can this concept can be advantageous to make a bicycle? If there is someone who ...
4
votes
3answers
189 views

Secret sharing scheme with possibility to change the secret

Here's a scenario I want to handle with a secret sharing scheme: Alice wants to share the secret $S$ with Bob, Charlie and Dave. Alice generates private shares based on $S$ for Bob, Charlie and ...
4
votes
1answer
272 views

Why is asymmetric encryption IND-CPA?

According to Wikipedia, the IND-CPA game is: The challenger generates a key pair PK, SK based on some security parameter k (e.g., a key size in bits), and publishes PK to the adversary. The ...
3
votes
2answers
116 views

Why do fully homo-morphic constructions use 'ring' or 'lattice' structures?

Is there a significantly advantage to these data structures, or is it simply the status-quo and the easiest to use for describing constructions?
4
votes
1answer
213 views

What is meant by $\tilde\Omega(\lambda^4)$?

I'm currently reading the paper (Leveled) fully homomorphic encryption without bootstrapping , and the following paragraph was near the start: What is meant by the symbol used? Is it merely to ...
3
votes
2answers
81 views

Can CBC-encrypted files be modified in-place?

When changing a (small) part of the plaintext of a CBC-encrypted file, how much of the file will have to be rewritten? My suspicion is that everything after the modified block will have to be ...
3
votes
2answers
491 views

Why does Shamir's Secret Sharing Scheme need a finite field?

I read ampersand's question "Necessity for finite field arithmetic and the prime number p in Shamir's Secret Sharing Scheme", where he asked why Shamir's Secret Sharing Scheme uses arithmetic in a ...
2
votes
1answer
307 views

Solve a system of non linear equations over GF

I have the following set of equations: $$M_{1}=\frac{y_1-y_0}{x_1-x_0}$$ $$M_{2}=\frac{y_2-y_0}{x_2-x_0}$$ $M_1, M_2, x_1, y_1, x_2, y_2,$ are known and they are chosen from a $GF(2^m)$. I want ...
4
votes
2answers
151 views

Why is it said that if we have a duplicate ciphertext block it can leak our information?

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring ...
4
votes
3answers
125 views

using elliptic curve point multiplication as a key stretching method

My friend came up with the following idea: assuming we agreed on curve parameters, use the following algorithm for key stretching/derivation from user-entered password. Pad the ascii representation ...
4
votes
3answers
3k views

AES 256 Encryption - Is it really easy to decrypt if you have the key?

So this might sound like a crazy question but bear with me for a minute. I can't find any info on the internet and so am here, although this might have been a good place to start. I've recently ...
3
votes
1answer
66 views

Modes for encrypting small binary blobs?

Suppose I am building an encrypted document storage system. Suppose each user has a "user key": a symmetric key. Suppose each document is encrypted with a "document key". So, in order to give a ...
4
votes
1answer
158 views

Is asynchronous perfect forward secrecy possible?

DH key agreement protocols require the participation of both parties, so are only suitable for synchronous connections. Is it possible to implement PFS in a fashion usable for asynchronous protocols, ...
1
vote
1answer
80 views

Send a message to an entire group of recipients

I'm attempting to send a message to a group of recipients, through an untrusted intermediary. Each of the recipients will have been invited to the group by someone who already has a trusted public ...
2
votes
3answers
365 views

Questions about BCrypt and PBKDF2

I would ask you some questions about users' password storage in a login system. What algorithm do you suggest me to use? bcrypt or PBKDF2? I was looking for a way to implement them client-side and ...
3
votes
1answer
58 views

Applications of 3-collisions

I recently read Improved Generic Algorithms for 3-Collisions by Joux and Lucks (Asiacrypt 2009), available as http://eprint.iacr.org/2009/305.pdf. I was wondering about applications of this technique ...
4
votes
3answers
354 views

Birthday Attack

I am reading the birthday attack in wikipedia. We consider the following experiment. From a set of $H$ values we choose $n$ values uniformly at random thereby allowing repetitions. Let $p(n; ...
2
votes
1answer
904 views

Generating a secure random number in javascript

What I am trying to do is generate a large (4096bit) random number in JavaScript that is cryptographically safe to use. My approach is the following: I am creating a ...
1
vote
1answer
183 views

is this authenticated key exchange protocol sound? too complicated? obviously flawed?

(significantly reworded this question to fit better into crypto.se). I have static RSA keypairs for both sides and an encrypted transport that needs symmetric keys, and need to exchange session keys. ...
0
votes
1answer
150 views

What does the cipher-text overhead means?

I have two questions here. What does the cipher-text overhead means? Why we were suggested not to encrypts the plain-text itself instead just encrypts only the key (i.e random number)
1
vote
2answers
203 views

How can Alice prove that a message has not been tampered with?

In terms of the usual suspects. The problem I have is that Alice wants to send Bob a message M, which gives Bob permission to perform some actions. However Alice wants to verify, from time to ...
1
vote
2answers
341 views

why public key cryptography (RSA) is use in sites like Google, facebook (what is the need to ecode data in these sites)?

The RSA algorithm is used for encryption (plain text to cipher text) and decryption (cipher text to plain text) of data. What is the need for using public keys in these sites; why is data is encrypted ...
1
vote
2answers
232 views

Is it possible to generate a 6-digit number using 256-bit encryption?

Reading through some documentation on a piece of software, it claims that a 4-6 digit number is created using a 256-bit encryption process for the purposes of access control. The whole process works ...
1
vote
1answer
87 views

security amplification

Reading some papers on security amplification of weak-PRP written by Stefano Tessaro, I noticed the use of notion "epsilon-PRP" and the notion of "security amplification". These notions, in ...
2
votes
1answer
205 views

Primality testing (deterministic vs. non-deterministic)

I noticed that non-deterministic primality testing algorithms are more commonly used in practice while there is a deterministic algorithm e.g., AKS which runs in polynomial time? I am right? if so, ...
2
votes
2answers
110 views

What prevents continued hashing of a key from being used as a cipher when xored with plaintext? [duplicate]

This is just an idea I had while looking through some threads so take it as you will. Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention ...
3
votes
1answer
117 views

Are there any good examples of Contemporary Mechanical Cryptography?

Are there secure mechanical cryptosystems in use today? Not necessarily alphabetic either, ie digital but mechanical?
2
votes
1answer
216 views

How to prove a cipher resistant to differential cryptanalysis?

How do you prove that a cipher is resistant to differential cryptanalysis? It's said that Rijndael has been proven resistance to differential cryptanalysis. How do cryptographers do that?
5
votes
1answer
149 views

How does NaCL Poly1305 implementation do modular multiplication?

The NaCL ref implementation of Poly1305 performs modular multiplication to calculate a polynomial $\mod 2^{130} - 5$ using the following modular multiplication ...
-1
votes
2answers
179 views

How do I choose the best 3*3 s-boxes?

I've read about 20 papers about the criteria for choosing best $n$ * $n$ s-boxes. Now, I've got two problems: How to generate (2^24) s-boxes, and how to test them considering the criteria. ...
3
votes
2answers
354 views

Encrypted counter as IV in CBC mode encryption using same key

I'm currently working with a secure transport protocol that defines the IV to be a counter (incremental nonce) to be encrypted with the same key. This is a followup to a protocol that did not provide ...
50
votes
5answers
24k views

Technical feasibility of decrypting https by replacing the computer's PRNG

Intel has an on-chip RdRand function which supposedly bypasses the normally used entropy pool for /dev/urandom and directly injects output. Now rumors are going on that Intel works together with the ...
1
vote
0answers
51 views

OpenPGP tag 18/19 description confusion Continuation [closed]

After coming back to try to finish more of my OpenPGP implementation, I refound one of my questions http://stackoverflow.com/questions/6021360/openpgp-tag-18-19-description-confusion that I am still ...
1
vote
1answer
235 views

What operations are used in symmetric cryptography and why?

In continuation to Why are bitwise rotations used in cryptography?: what other operations are commonly used in symmetric cryptography? Are there particular operations on numbers that are good for ...
0
votes
1answer
78 views

Best hash size for hash trees

I want to know if having a 8-byte hash value is better than 16-byte hash value for use within hash trees. My mind tells me that the shorter the hash value, the better. But doesn't a smaller hash ...
8
votes
2answers
259 views

Efficient Incremental Updates to Large Merkle Tree

I have a data set with 300 Million entries and every 5 minutes 4000 random entries in this table change. I need to calculate the merkle root on this data set to validate integrity multiple times ...
4
votes
3answers
151 views

What is the purpose of update() in popular hash APIs?

E.g., in Python's hashlib, update() basically merges in string buffer functionality into the object. Several other digest APIs I've seen have this pattern. Considering this adds functionality that ...
6
votes
3answers
304 views

Building a hard to factor number without knowing its factorization

It is possible to find an efficient algorithm for constructing a provably hard to factor number $N$, together with a witness that shows that it is indeed hard to factor. EDIT, since it was not clear: ...
5
votes
1answer
227 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
4
votes
4answers
355 views

Compare two hashes with different salt

I'm storing the salted hash of a credit card number in a database. What I'd like to be able to do is determine if two different entries in the same database correspond to the same credit card. ...
2
votes
1answer
114 views

Probability for collisions of a one-way compression function

Given a one-way compression function $h:\{0,1\}^n \rightarrow \{0,1\}^m$ and an attacker that picks $x_1 \ldots x_t \in \{0,1\}^n$ (uniformly distributed), I have to show that the probability to find ...

15 30 50 per page