4
votes
1answer
332 views

How safe is it to derive MAC key from a hashed password?

Imagine I have a blob that I want to encrypt-then-MAC. Now, what I can realistically ask my users for (out of UX considerations) is just an encryption password. Naturally, I bcrypt original password ...
4
votes
3answers
870 views

Malleability of ElGamal and Hashed ElGamal

Question: Suppose A encrypts a number $x$ which indicates her bid on a contract, using ElGamal encryption. Say that the encryption of $x$ produces a ciphertext $c$. Explain how E can modify $c$ to ...
4
votes
3answers
315 views

Derived Shared Key vs Distinct Keys?

I've seen a lot of 2-party applications that derive a shared key from distinct keys created by each party. Why is this technique employed? Would it not be better to use those two distinct keys for ...
4
votes
1answer
179 views

When all shares of a secret are given to adversary as a permuted matrix

Suppose we have a secret $\sigma$. The secret comes from a universe in which the elements are not necessarily distributed uniformly. We split $\sigma$ into $n$ shares $[\sigma_1,...,\sigma_n]$ ...
4
votes
3answers
91 views

Proof of non-membership on a merkle tree

Assume a user U and a server S. User uploads its data and wants later to perform an authenticity check. It also sends a merklee tree to the server. Lets say we would like the user to ask for a ...
4
votes
2answers
197 views

Why is 2048-bit RSA always paired with 320-bit ECC?

You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
4
votes
2answers
223 views

Can Grover's Algorithm be combined with a meet-in-the-middle attack?

We all know and love the meet-in-the-middle attack which basically makes double encryption pointless using a time-memory-tradeoff. Now there was recently the recommendation by the NSA to use double ...
4
votes
2answers
344 views

Secure method for encrypting 32 byte private keys

I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the ...
4
votes
2answers
382 views

ElGamal against chosen ciphertext attacks

In Hoffstein, Pipher, and Silverman's book An Introduction to Mathematical Cryptography, the authors make the following remark: An attack in which Eve has access to an oracle that decrypts ...
4
votes
1answer
233 views

Ciphertext and tag size and IV transmission with AES in GCM mode

I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
4
votes
1answer
173 views

Why have round constants in hashes?

This may seem like basic crypto knowledge, but why do hash functions like SHA-2 and Whirlpool have round constants that are absorbed into their respective states? I can understand that in a cipher ...
4
votes
3answers
200 views

Source for PKCS#11 Header Files

Is there a known authoritative source for the ANSI C header files for PKCS#11 Cryptoki? Specifically, I am having trouble locating pkcs11.h, pkcs11t.h, and pkcs11f.h for v2.30 and v2.40. Are there ...
4
votes
2answers
320 views

Brute-force attack given small search-space and hash prefix

Suppose we have a value $secret which is a random 56-bit (7-byte) string. Suppose an adversary wishes to discover $secret. The ...
4
votes
1answer
198 views

What is the “compression function” in Merkle-Damgård?

Is the "compression function" in Merkle-Damgård just a collision-resistant, one-way hash function but one that operates only on fixed size inputs? If so, is MD just a way to extend it to work on ...
4
votes
1answer
348 views

Reusing the random exponent for ElGamal encryption with different plaintexts

In the basic ElGamal encryption scheme, we encrypt a message $m$ as $(g^r, h^r m)$, where $g$ is the group generator and $h$ is the public key of the recipient. If the sender has another message $m'$ ...
4
votes
2answers
281 views

Signing Files vs. Signing File Hashes

What are the security pitfalls that may occur by signing a list of file hashes, versus signing individual files? In short, the security trade-offs between: ...
4
votes
2answers
7k views

Twofish vs. Serpent vs. AES (or a combo)

I've seen some posts and info online, but they are from 2009, 2010, 2011 or 2012, which is 3-6 years ago, which is a very long time. So I'm looking for an up-to-date answer about which of these is the ...
4
votes
2answers
265 views

Share encrypted files without giving master key

Imagine I have four files I want to encrypt. I have master key, and from that master key I derive four keys, one for each file: ...
4
votes
3answers
1k views

SHA-1 collisions - what about practical attacks?

I understand the theoretical problem with hash collision but when it comes to practice, I get very confused. Suppose a attacker would like to forge a certificate (or any kind of structured piece of ...
4
votes
4answers
4k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
4
votes
1answer
320 views

How does Random Oracle and Standard Model differ? [duplicate]

I am new to Crypto field. Many papers are boasting of not using Random Oracle model. Instead, those prove security in Standard Model. I am surprised how do these models differ. Can anyone please ...
4
votes
1answer
147 views

What's the consequence of having a short IV? Is one mode better in that case?

I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
4
votes
1answer
678 views

What characters are valid in PGP encrypted and signed messages?

What characters may be present in a PGP encrypted message or a PGP signature? For example, do encrypted messages only use the Roman alphabet + some numbers and symbols? Can the character set be ...
4
votes
2answers
8k views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
4
votes
2answers
791 views

Is there a standard way to use a nonce with HMAC?

Many protocols use HMAC on messages that include a nonce, but they don't seem to do it in a consistent way. For example, in OAuth the nonce is in the middle of an URL-encoded key-value string, like ...
4
votes
1answer
2k views

RSA example-calculation: Public Key = Private Key (e = d)

I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong. ...
4
votes
2answers
518 views

Update to “Cryptographic Right Answers”

I'm a big fan of Colin Percival's "Cryptographic Right Answers" post. This was written in 2009, which is a long time ago in Internet years. Is the advice still valid or, if not, can someone point me ...
4
votes
1answer
176 views

Understanding hash entropy

I have been told that one advantage of using a hash function is that it spreads entropy over all input bits. But it also seems to be true that a bad hash algorithm can make things less random. But how ...
4
votes
1answer
204 views

Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain ...
4
votes
1answer
396 views

Why are collision attacks important when talking about MAC schemes?

I'm reading Ferguson, Schneier, and Kouno's Cryptography Engineering, and it has a section on MACs. It discusses different types of MACs, but it seems to claim that to acheive 128-bit level security, ...
4
votes
2answers
2k views

Randomness test question from FIPS 140-1 and comparison with 140-2

In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the ...
4
votes
1answer
251 views

Long-term data protection, storage of old encrypted traffic and quantum cryptocalipse

Tony Arcieri makes an interesting point in his Imperfect Forward Secrecy article which basically boils down to: large entities such as NSA are storing encrypted internet traffic, also what's to stop ...
4
votes
1answer
502 views

Proofs by reduction and times of adversaries

I have some difficulties to understand, when we construct a reduction, how we determine the time for the constructed adversary to break a target security property. In general these details are not ...
4
votes
1answer
214 views

a doubt in Rijndael's key expansion sizes

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a ...
4
votes
2answers
547 views

Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of ...
4
votes
2answers
611 views

What does “Worst-case hardness” mean in lattice-based cryptography?

In the wiki page of Lattice-based Cryptography the "Worst-case hardness" is defined as below: Worst-case hardness of lattice problems means that breaking the cryptographic construction (even with ...
4
votes
2answers
1k views

Why is the discrete logarithm problem assumed to be hard?

This might be a quite stupid question: since a naive brute force algorithm to solve the discrete logarithm problem will only take O(n) time for a group G with order ...
4
votes
1answer
491 views

Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
4
votes
2answers
99 views

Threshold cryptosystem with a required share

I am trying to find an implementation or variant of a (k, n) threshold cryptosystem (as described here Shamir's Secret Sharing) where we can fix at least one of the k key parts, i.e., instead of ANY k ...
4
votes
1answer
225 views

Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
4
votes
2answers
493 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
4
votes
2answers
502 views

Which crypto libraries/programs do we have the most confidence in? [closed]

I have recently begun studying crypto. If it's one thing I have learned it's that we should not implement our own crypto. Therefore we should look to using existing software and libraries. When I ...
4
votes
1answer
403 views

Security considerations on “expand 32-byte k”-magic number in the Salsa20 famility of stream ciphers?

I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma: ...
4
votes
2answers
432 views

What (precisely) is a block cipher?

If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher. Now I thought what would ...
4
votes
2answers
146 views

post-quantum threshold secret sharing

I am looking for a references for post-quantum threshold secret sharing schemes. I am especially interested in knowing whether any one based on one-way compressor functions or cryptographic hashes ...
4
votes
1answer
886 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
4
votes
2answers
491 views

Using SHA3 as an entropy pool

Has any work been done on analyzing the SHA3 sponge construction for use as an entropy pool (e.g. /dev/random)? All the use cases I've heard of consts of a ...
4
votes
2answers
369 views

Hash function based on block cipher (and proof of security in the PRP model)

Do there exist proofs of security for primitives like hash functions (based on a block cipher) in the PRP model. I often see proofs in the random oracle model (for hash function based on compression ...
4
votes
2answers
261 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
4
votes
1answer
705 views

Recent attacks on RSA

At Blackhat 2013 this week, there was a talk saying RSA is (essentially) doomed in the near future. networkworld.com ~ “Black Hat: Elliptic curve cryptography coming as smarter algorithms threaten ...

15 30 50 per page