2
votes
1answer
99 views

With Encrypt-then-MAC, and flexible protocols, do I need to authenticate the authentication?

Sorry, the question is not easy to state (or wasn't for me, anyhow). So I'm writing a very flexible format for security. It allows for full choice of cipher, key size, and so on, along with key ...
4
votes
1answer
167 views

How does a backdoor in the RNG enable an attacker to break encryption protocols?

I'm wondering how a backdoor in a random-number generator (as rumored the NSA have placed), actually compromises the security of things like VPNs or TSL/SSL. What I understand is that, if such a ...
4
votes
2answers
170 views

Can we say that if $P=NP$ there is no CPA secure public key encryption?

I've learned that public key encryption is based on the problem of Discrete Log (as regard to group theory) which believed to be hard. But, can we say that it doesn't matter on which problem our ...
3
votes
1answer
228 views

Single Party Encryption, Multi Party Decryption

I am looking for an adequate protocol for public key decryption, which would allow $n$ parties to jointly decrypt a cipher text. The usage scenario for such a protocol would be a mixnet that wouldn't ...
4
votes
1answer
168 views

Solve a Modular Exponentiation

It might be common, but if we had to solve an equation like this $m=s^{e}$ mod $n$ where $m,e,n$ are known. How can we find $s$. What optimisations could be applied? And what would the complexity of ...
3
votes
1answer
167 views

ECB weakness and its exploitation

Lets say that I have a server which encrypts information at the server side using ECB mode with the blocksize of 16. If the server appends data that I control with a secret and sends back the ...
5
votes
2answers
530 views

What happens to entropy after hashing?

What happens to entropy after hashing? Suppose you have a key with entropy $k$. Can entropy $k$ be increased by hashing the key?
9
votes
3answers
521 views

Can we ensure the security of a crypto-algorithm and -implementaton against acoustic cryptanalysis?

Like people always say: “Attacks only get worse…” — which is why I'm asking early. I have been reading the paper “RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis” published December 18, ...
6
votes
1answer
182 views

How can uniformity of hash functions (e.g. SHA-256) be proved?

In reading about the Bitcoin protocol I noticed how much its proofs-of-work apparently depend on uniformity of the SHA-256 hash function. And so presumably do many other applications. How do ...
4
votes
1answer
156 views

Brute Force on 3DES with Reduced Keyspace and Unknown IV

I'm trying to brute force a 3DES problem given a reduced keyspace (ie I know the first half of the key) but with an unknown IV. The code decrypts to plaintext. My first thought was that I could set ...
2
votes
2answers
99 views

Is this algorithm demonstrating “proof of work”

Is this algorithm demonstrating proof of work? This is a algorithm where a "token" is combined with a time stamp and then a cryptographic hash is generated from the combination, next the objective is ...
3
votes
1answer
128 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
3
votes
1answer
105 views

Calculate entropy of key derived from PBKF2 function

I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived ...
6
votes
3answers
295 views

Is SSL broken? If so, what can I do about it? [closed]

But recently, with the scandals about the (in)filtrations, I read that the NSA (and of course others, but I'm not particularly worried about NSA) is able to break SSL and track your data. It is true? ...
-1
votes
1answer
175 views

Guessing encryption algorithm based on key and ciphertext

Is it possible to tell which encryption algorithm was used, assuming I have a key and a encrypted text? To not complicate the situation let assume we are speaking about symmetric algorithms only. ...
4
votes
3answers
459 views

How to perform authentication without central server in P2P?

How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority? ...
1
vote
2answers
95 views

How to use HKDF to combine two keys

I have heard that to combine two keys HKDF is better than using XOR function. But if you look at the HKDF RFC I could not figure out how to use it for concatenating two keys. What I can see is HKDF ...
1
vote
1answer
221 views

Pollard’s Rho Method

I can't get my head around Pollard’s Rho Method for solving discrate log problem I have read in a book: The basic idea is to pseudorandomly generate group elements of the form α^i · β^j ...
1
vote
1answer
170 views

Outsourcing arbitrary computations securely

Consider the following scheme. Alice wants Bob to make some computations for her, but she doesn't want to reveal the data on which he's going to do it. So, she encrypts the data, sends them to Bob, he ...
1
vote
1answer
57 views

Are those two distributions indistinguishable?

The Decision composite residuosity problem problem states that is impossible two distinguish between those two ensembles: $\{x^N \mod {N^2} | x \in \mathbb{Z^*_{N{^2}}}\}$ and $\{r \in ...
3
votes
3answers
210 views

Is the following authentication protocol insecure?

I am a student taking cryptography this semester. I was just wondering why can't we use this simple protocol? Alice → Open Connection → Bob Alice ← Cert$_b$ ← Bob Alice → {K$_{AB}$}$_{Bob}$ → Bob ...
4
votes
1answer
363 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
4
votes
1answer
169 views

Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
1
vote
1answer
88 views

Can I use the cipher text ouput of only one DES rotation as plaintext to check validity?

I have made a python code for one DES rotation. Can I use the resulting cipher text as a plain text for the same rotation with the same key? I think the answer is no, I can't do so. But I need to be ...
6
votes
2answers
307 views

RSA Signature Weak Padding Attack

Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
2
votes
1answer
1k views

What is the difference between CSPRNG and PRNG?

Is there performance differential between them? For example: we use PRNG for key generation which is very expensive and CSPRNG for IV/nonce in block ciphers which is fast? What is the difference ...
3
votes
1answer
53 views

What vulnerabilities would open up if PGP authentication didn't have integrity checking?

It is my understanding that PGP has both an integrity check and an authentication check. What vulnerabilities would open up if it didn't have that integrity check? It seems like the authentication ...
6
votes
1answer
1k views

Zero knowledge proof protocol example?

Alice is color blind. She never knows if her gloves are matched. Her brother Bob always teases her saying her gloves are mismatched and she should go change them. Alice wants to know if ...
-3
votes
1answer
89 views

What is the best (thoroughly covering) textbook for application of LFSRs in cryptography? [closed]

What is the best (thoroughly covering) textbook for application of LFSRs in cryptography? (Beside Cipher Systems by Beker & Piper)
0
votes
4answers
1k views

Is a Mersenne-twister cryptographically secure if I truncate the output? [closed]

I want to create an online roulette game. Is it OK if the PRNG is seeded only once, when the user starts the game, or is it recommended to re-seed sometimes during game? Maybe just seeded once a day ...
8
votes
1answer
355 views

Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?

I am currently experimenting with ed25519 and I noticed that on secret key creation, bit 254 is always set and the lower 3 bits are always cleared. I found that bit 254 is always set to protect ...
1
vote
1answer
170 views

Is this the mathematical equation for the Vigenere Cipher

Is this the mathematical equation for the Vigenere Cipher or something else and if something else what is it? Where t is the letter of plain text and n is the position of t within the text and c is ...
1
vote
1answer
52 views

Type A Curves of Supersinglular

In the Type A curve used in Pairing based Cryptography, what is meant by sign0 & sign1 in the expression below? ...
4
votes
1answer
134 views

Private Messaging

Suppose Alice and Bob wants to send messages through Sue without revealing to Eve that the exchange took place. Slightly more formally, I don't want Eve to have any advantage telling if Alice is ...
5
votes
1answer
740 views

Multi-party encryption algorithm

To give some foreground information: I acknowledge that I am a cryptography newb and not by any means an expert (and probably never will be). In a recent CS class we had several assignments writing ...
3
votes
1answer
108 views

Logical OR operation in a homomorphic additive cryptosystem

Suppose we have a cryptosystem homomorphic for addition (say Paillier's). Is there a way to perform a logical OR operation between two binary values (with a binary result). We can, of course, obtain ...
3
votes
2answers
109 views

Diffie-Hellman insecure on addition modulo $n$

Assume that the group $G$ is the set $\mathbb{Z}_{n} = \{0,\ldots, n-1\}$ for a 1024 bit integer and $+$ is addition modulo $n$. Then why would Diffie-Hellman key exchange in this group be insecure?
1
vote
1answer
106 views

Which data to share in CTR mode?

Suppose I've got two clients $A$ and $B$. Client $A$ encrypts data in CTR (Counter) mode to get a ciphertext. What information will client $B$ have to receive from $A$ to decrypt the ciphertext? Just ...
2
votes
1answer
119 views

Elliptic Curve Verifiable Secret Sharing

I'm reading this paper, which on page 3(Section IV.C) presents a Jointly Random Verifiable Secret Sharing Scheme for Elliptic curves. The algorithm makes sense to me save for this part: "Each ...
1
vote
1answer
111 views

Diffie-Hellman on additive group

Given the finite cyclic, additive group (G, +), with |G| = n and generator = g, what are the computations and exchanged messages for Diffie-Hellman? What I tried myself: Alice chooses a private $a$ ...
0
votes
2answers
163 views

Scrypt's maximum strength to increase entropy of lame passwords

The developers claim that a 6 letter long password hashed with 3.8 second's of scrypt would cost $900 to brute-force. If we use more cycles, how quickly will the brute force cost increase? What ...
5
votes
1answer
238 views

RSA exhibits symmetrical properties — is it possible to form a cryptanalytic attack?

This question is broken into two sections really: Symmetry in RSA I have been analyzing raw RSA and I have noticed some interesting symmetrical properties of the algorithm. Assume that $M$ is a ...
2
votes
1answer
870 views

Calculation of time to crack SHA-256 hash

A problem is given: 1 million users are authenticated with 9-digit PIN codes (e.g. 343534643). The PIN values are stored as hash values in a database. The hash is SHA-256, and is computed as: ...
0
votes
3answers
357 views

Would it be possible to create a game where one would need to decrypt a simple encryption?

This might sound pretty weird, but I was thinking of a game a person could play alone with a pen and paper. I got this idea where the person would write a random four letter string on a paper, and ...
1
vote
2answers
180 views

Attacks against El Gamal private key

El Gamal encryption involves picking $(p,g,b)$ which is our public key. We compute $b=a^x$ $mod$ $p$. Here, $x$ is the private key which we don't know. What are some efficient and strong algorithms ...
0
votes
1answer
64 views

Authentication mechanism for low memory, low computing power device

I am looking for an authentication mechanism that works best with low memory, low computing power devices. I came across a paper "A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor ...
1
vote
1answer
202 views

What exactly is inside a private key?

May sound stupid to many, but I would like to have some pointers on what exactly is contained inside a private key. I have decent understanding of public/private keys/certificates (have created them ...
5
votes
1answer
119 views

What does pseudo pre-image of a hash function mean?

So finding a pre-image means given the hash value, one tries to find a message that gives this value using the function's standard IV. What about pseudo-preimage?
2
votes
1answer
190 views

Hierarchical Encryption

Is there a way to setup a hierarchical encryption using public key encryption? Let's say a higher level user can decrypt messages encrypted by lower level users. Is that possible? I guess it is only ...
3
votes
1answer
116 views

How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...

15 30 50 per page