5
votes
1answer
132 views

Authentication protocols for authenticating devices to a server

The requirement is to authenticate 1000s of devices to a server when the devices try to contact the server. The problem I face is that all authentication protocols require some kind of shared secret ...
5
votes
2answers
2k views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
5
votes
1answer
475 views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
5
votes
2answers
169 views

Current Status of mixnets for voting

I am currently doing some research on universally verifiable mixnets, but it seems to me that there are too few papers about them after 2006 or so and most of them come from the team of Douglas ...
5
votes
1answer
1k views

Should the secret key of Shamir's secret-sharing algorithm be interpreted byte by byte?

Should the secret message of Shamir's secret-sharing algorithm be interpreted and processed byte by byte? Interpreting it byte by byte makes it easier to process, but in case one of the shareholders ...
5
votes
1answer
443 views

Question about why RSA is hard to attack

I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
5
votes
1answer
145 views

Any implication of a Yale result to security of quantum cryptology?

Quantum key distribution depends, if I don't err, on (irreversible) damages done by MITM's measurements on qbits. Now news.yale.edu/2013/01/11/new-qubit-control-bodes-well-future-quantum-computing ...
5
votes
2answers
902 views

Hill cipher, unknown letter value

I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...
5
votes
1answer
263 views

Why does Schnorr's Digital Signature scheme necessitate two prime numbers?

One of the necessary components to the Schnorr Digital Signature scheme is a pair of prime numbers $p$ and $q$ such that $q$ divides $p-1.$ However, there is never a modular inverse taken of q so why ...
5
votes
1answer
470 views

Is this a good way to encrypt a file?

I need to encrypt a file, distribute it over an insecure channel, and decrypt it later. Using a symmetric-key algorithm. Here's what I intend to do: Get a password P from the user. Generate a 16-byte ...
5
votes
1answer
605 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
5
votes
1answer
3k views

Padding methods for block ciphers - PKCS7 vs ANSI X.923

I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
5
votes
1answer
283 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
5
votes
1answer
416 views

Memory-hard operations in work-factor hash functions

I'm playing around with work-factor hash functions, and I'm looking for a memory-hard operation to make it resistant to GPU / parallel hardware attacks. I considered a very large (i.e. 64K) s-box that ...
5
votes
2answers
347 views

Is my HMAC secure if I have a complete series of HMAC'd prefix strings

Let's say I have a long sentence, like "The quick brown fox jumped over the lazy dog." Let's further say that I need to keep this string encrypted, so I use an HMAC. Let's further further say I want ...
5
votes
1answer
253 views

One-way hash on encrypted data, result hidden from hasher

I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
5
votes
1answer
1k views

Is this authenticated one-way communication protocol secure?

I am looking to see if this one-way communication protocol is secure. Assume Alice wants to send Bob a message (and doesn't need Bob to reply in the same session/channel - think email). Bob knows ...
5
votes
1answer
410 views

Can a digital money system exist, that's secure, anonymous and allows offline transactions?

I just read Offline anonymous electronic money systems and their cryptographical base , which asks for anonymous offline systems. The OP claims eCash is such a system, and the answer claims that ...
5
votes
1answer
2k views

Trouble with diffie-hellman groups

Is anyone able to point me towards a known-to-be-good diffie-hellman group? I currently use group 24 (RFC5114, 2048-bit MODP Group with 256-bit Prime Order Subgroup). It came to me that this group is ...
5
votes
1answer
678 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
5
votes
1answer
626 views

How close is homomorphic encryption to handling regular expressions?

Is there any reasonable homomorphic encryption protocol that supports some meaningful fragment of regular languages/expressions and/or edit distance bounds? I'm suspicious that homomorphic encryption ...
5
votes
1answer
202 views

Academic papers on ECDSA security

What are the most authoritative papers on the security analysis of ECDSAs? I`m mainly looking for comparisons of how secure different curves are considered to be, what potential methods are there of ...
5
votes
1answer
188 views

Is there a group of prime order which could fit the CT-Computational Diffie-Hellman assumption?

I'm trying to choose a group that is hard under the Chosen-Target Computational Diffie-Hellman assumption, according to the definition in this paper, in order to implement the oblivious transfer ...
5
votes
1answer
355 views

How can I store confident data with OpenID?

I want to make a system that needs to store some confident user information in a database. I intend on using OpenID for user authentication. I would like encrypt the data in a way that it can only be ...
5
votes
1answer
239 views

Why isn't the IND-CCA property inherited when sending redundant ciphertext?

Suppose that in order to avoid loss in transmission, a secret key encryption scheme $(Gen, Enc, Dec)$ is modified to be $(Gen, Enc', Dec')$, such that the message m is encrypted independently ...
5
votes
3answers
347 views

Designing a key expander out of ciphers

Is it possible to compose or combine $n$ ciphers ($cipher_0, cipher_1, ... cipher_n$) in such a way that they generate $n$ ciphertexts from the same key, $k$, and that recovering the key, $k$, from ...
5
votes
1answer
68 views

Are there any high level memory-hard PBKDF constructions?

The PBKDF2 construction from PKCS #5 v2 has the convenient feature that it can be implemented using only standard interchangeable cryptographic primitives. Specifically, it only requires the ...
5
votes
1answer
70 views

How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed. ...
5
votes
1answer
57 views

Padding password before SHA-512 hashing to avoid info leak via timing

I've noticed that SHA-512 password hashing leaks some information about the password length. There's a weak correlation between password length and time to hash. It's roughly linear, but in steps of ...
5
votes
1answer
139 views

Encryption scheme like RSA where encryption is the inverse of decryption

In RSA, it is basically equivalent to use the private key $d$ to encrypt as it is to use the public key $e$ to encrypt. They are exactly inverses: $e=d^{-1}$. I need to know, are there other public ...
5
votes
1answer
274 views

Zero-Knowledge Proof of a polynomial

I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and ...
5
votes
1answer
79 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
5
votes
1answer
258 views

How long does it take to decrypt an RSA/ECB encrypted message?

I am working on assignment where I have specific scenarios and I am little bit struggling with this one. Alice sends and email to Bob.For this e-mail, she uses the following method of encryption: ...
5
votes
1answer
113 views

Coin flipping with limited communication between participants

Alice and Bob want to play a coin flipping game. Alice wins if the coin flips head. They choose to trust a independent third party that generates a random beacon (such as NIST). There is no ...
5
votes
2answers
972 views

What are the strenghts and weaknesses of Whirlpool Hashing Algorithm

I want to find out if the Whirlpool hashing algorithm have any weaknesses. There are quite a bit of articles explaining the strengths of this algorithm, but for some reason I cannot find any on its ...
5
votes
1answer
138 views

Why is the whole initial state used in the final addition of Salsa20 and ChaCha?

Both Salsa20 and ChaCha basically work like this: Put the key, the nonce, the sequence number and a constant into a 4x4 matrix of 32-bit words. Transform the matrix invertibly with a number of ARX ...
5
votes
1answer
191 views

Secure content-defined chunking

Intro For deduplication purposes, I need to split a stream of plaintext bytes into variable-sized chunks. The way this is traditionally done is using a rolling hash function defined over some window $...
5
votes
1answer
830 views

Merkle hash tree updates

It seems that merkle hash tree (MHT) traversals have been discussed somewhat in the literature, but there does not appear to be much written on inserting, deleting, and updating leaves. Is this lack ...
5
votes
1answer
204 views

At what point does passphrase strength match the strength of the cipher?

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing: -AES -RIPEMD-160 Hash Algorithm Now let's say that for an arbitrary machine, the ...
5
votes
2answers
319 views

Hash or compression function in Merkle tree nodes?

Wikipedia says about a Merkle tree: Nodes further up in the tree are the hashes of their respective children. Usually, a cryptographic hash function such as SHA-2 or SHA-3 is used for the hashing. ...
5
votes
1answer
890 views

Paillier can add and multiply, why is it only partially homomorphic?

I've seen that it's widely accepted that before Gentry's breakthrough (which is not practical yet) in 2009 there were no known full homomorphic encryption scheme. I've read here in another answer ...
5
votes
1answer
268 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
5
votes
1answer
151 views

cryptographically good random elliptic curves?

After an answer here, about generate elliptic curves, I've start thinking about the algorithm. The mentioned algorithm will produce curves in the Weierstraß Reduced Form (WRF) over finite fields: $...
5
votes
1answer
318 views

One-way permutation over a small interval?

I am wondering what concrete computable functions we know that are a permutation over an integer interval of parameterizable size $s$, for relatively small $s$ starting circa $2^{64}$, to perhaps $2^...
5
votes
1answer
514 views

What could “look for the constants that you might find in RC6” mean?

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"): look for the constants that you might find in RC6 I'...
5
votes
1answer
889 views

Can cryptocurrency mining devices be used for cryptanalysis?

In the past year or so we have seen production of ASIC devices designed for mining of cryptocurrencies. These devices can perform SHA256 hashing at rates much higher than was seen in the past and are ...
5
votes
2answers
1k views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
5
votes
1answer
226 views

How HOTP values are validated according to RFC 4226

In Section 7.2 "Validation of HOTP Values" of the HOTP spec (RFC 4226) it says, in part, The HOTP client (hardware or software token) increments its counter and then calculates the next HOTP ...
5
votes
1answer
149 views

Using encryption schemes for identification

I've been researching how to implement a post-quantum SSL-like connection authentication, especially correct identification&authentization of the server/client. Because good post-quantum digital ...
5
votes
1answer
233 views

Questions on rank-attacks in Multivariate Cryptography

While reading this article on rank attacks on STS (a public-key scheme based on Multivariate Quadratic (MQ) equations), I stumbled upon some claims that I've also seen in other presentations on rank-...

15 30 50 per page