3
votes
3answers
217 views

Allowing the user to choose the hashing formula at the registration

I was thinking of a potential new way to increase someone's account security. The idea was allowing the user to choose one of the hash formulas available in the software (example: "MD5", "SHA512" and ...
3
votes
2answers
198 views

Is the polynomial reconstruction problem really “intractable”?

In the family of the believed (experts haven't come yet with a solution) intractable problems in cryptography belongs the Polynomial Reconstruction problem in which an attacker is given $n$ points in ...
3
votes
1answer
694 views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...
3
votes
1answer
231 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
3
votes
2answers
454 views

Encrypted counter as IV in CBC mode encryption using same key

I'm currently working with a secure transport protocol that defines the IV to be a counter (incremental nonce) to be encrypted with the same key. This is a followup to a protocol that did not provide ...
3
votes
1answer
98 views

Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
3
votes
1answer
836 views

What is U2FsdGVkX1?

Using CryptoJS 3.1 I noticed that using 3Des, the encrypted message always start with U2FsdGVkX1 Why is the first part of the encryption always the same? What information does this hold and ...
3
votes
1answer
1k views

How do I decrypt ciphertext with this cipher?

I have an encryption function $$E(p) = (ap + b) \mod{26}$$ where the parameters are $a=7$, $b = 10$, and $p$ is the plaintext letter. I was asked to decrypt the ciphertext ...
3
votes
1answer
229 views

Proofs of security methodologies

I'm looking for course material on the subject of proofs, reductions, and games, as used to prove cryptographic schemes secure. What are the methodologies? What are the preferred ones? In what cases ...
3
votes
1answer
106 views

Can substrings of a long string be efficiently authenticated?

Suppose one has a (strong) shared secret key and wishes to authenticate a very long string in a way that will allow the verifier to verify small substrings without reading much of the stored data and ...
3
votes
2answers
189 views

differential and linear cryptanalysis

I have been reading about differential and linear cryptanalysis. They were mainly introduced by Adi Shamir and Biham to show weakness of DES. However, many of articles state that they have been ...
3
votes
1answer
273 views

Alternatives to HMAC + CBC?

I'm looking at using HMAC + CBC. The combination looks like this: ciphertext = AES256(text, k1) data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext Where: ...
3
votes
1answer
139 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
3
votes
1answer
187 views

How to use salt if I am sending hashed password?

If have application that is sending username and hashed password to server for authentication, how would I use salt for this scenario ?
3
votes
2answers
855 views

Known-plaintext attack on Blowfish in ECB mode

The protection scheme I faced recently seems so weak nowadays that a simple exhaustive key search would be enough to recover the user key in an acceptable amount of time (it's OK, since almost no ...
3
votes
1answer
274 views

How to compute the dot product on encrypted values?

Is there a practical homomorphic encryption scheme that can give reasonable execution time results in computing a dot product: $$a_1*b_1 + a_2*b_2 +a_3*b_3 +\ldots+ a_n*b_n$$ I imagine the scheme will ...
3
votes
1answer
140 views

How to obtain a one-value share in Shamir's secret sharing

This is a trivial question, but I had to ask: since each generated share in a Shamir's secret sharing scheme initially consists of a pair of values (representing the coordinates of a point on the ...
3
votes
2answers
335 views

Timing attack on modular exponentiation

It is known that computing $a^x \bmod N$ takes $O(|x| + \mathrm{pop}(x))$ multiplications modulo $N$, where $|x|$ is the number of bits of $x$ and $\mathrm{pop}(x)$ is the number of $1$ bits (Hamming ...
3
votes
1answer
345 views

Symmetric encryption mode where ciphertext size is plain text size

I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of ...
3
votes
1answer
622 views

Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
3
votes
1answer
449 views

Visualization of cryptography

I think CrypTool is great software. And what I find most useful in it is visualization of algorithms such as Caesar, Vigenere, AES, DES. And my question is: does anyone know other tools which are ...
3
votes
1answer
206 views

How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
3
votes
1answer
114 views

Hashing a password with the password?

I was wondering if hashing a password with the password would be a good way of encrypting the password. So, the user must know his/her password to get the same result as the one in the database. Also, ...
3
votes
1answer
216 views

Mental Poker with untrusted server (i.e. no peer to peer)

The question of implementing peer to peer mental poker has already been asked on stackoverflow. And there appears to be an implementation called LibTMCG. Also on this site a question was asked about ...
3
votes
1answer
498 views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
3
votes
2answers
168 views

Security model for privacy-preserving aggregation scheme.

Suppose that $S=(E,D)$ is an additively homomorphic encryption scheme. Now I want to design a protocol $P$ such that given inputs $x_1,x_2,..,x_n$, the adversary $A$ (who can decrypt) can only learn ...
3
votes
2answers
183 views

Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ ...
3
votes
1answer
154 views

SSL Key Exchange

I read briefly over the TSL/SSL key exchange protocol. I have to wonder about the whole pre-master-key procedure. Wouldn't it be sufficient if the client or server encrypted a generated session key ...
3
votes
1answer
352 views

Efficient set up for a Montgomery multiplication

Montgomery described an efficient method to compute a modular multiplication. This works by using a special constant $R$ and assumes the inputs $a$ and $b$ have been made into a special representation ...
3
votes
2answers
442 views

Key derivation from a random seed

The main problem is to use a block cipher to generate a random key. I would like to generate 256-bits key which can be as random as possible. I generate it in the following way: Pick a plaintext ...
3
votes
2answers
311 views

Can I save space for short messages by using encryption with private key instead of a signature?

Let's say I have a message, a Private Key and a Public Key. Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you ...
3
votes
2answers
7k views

FIPS 140-2 Compliant Algorithms

Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ...
3
votes
1answer
1k views

Implementing AES encryption for firmware distribution system

I need to implement an AES encryption for firmware distribution system. I have a bootloader that can decrypt various AES variants (ECB,CBC,CTR). When I approached this I found few issues that aren't ...
3
votes
3answers
272 views

Existing works on pre-computing ElGamal ephermal keys

I was playing around with a problem in e-voting schemes that use additive homomorphic encryption to tally votes, namely that at the end of the day somebody (or somebodies, if the secret material has ...
3
votes
1answer
354 views

Is truncating a hashed private key with SHA-1 safe to use as the symmetric key for AES for data at rest?

I realize this is mixing the purposes between asymmetric and symmetric crypto, but I was wondering if it is safe to use a hashed, truncated private key (asymmetric) as the symmetric key for encrypting ...
3
votes
1answer
362 views

RSA algorithm's license free or paid?

I checked RSA's patent application, which was registered in 1983. As patents don't last more than 20 years, it seems to me it should be free. But my friend said to use RSA I have to buy a license from ...
3
votes
1answer
202 views

Stream ciphers based on discrete logs

Blum Blum Shub is a stream cipher that is provably reducible to the difficulty of factoring integers. I'm wondering whether there is a similar construction for discrete logs? For example, I could ...
3
votes
1answer
224 views

Where can i find relative software for differential cryptanalysis?

Is there any publicly known software for differential cryptanalysis over some cryptographic building blocks as blocks ciphers or cryptographic hash functions
3
votes
1answer
705 views

Okay to use OpenSSL to encrypt then sign a message?

I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong. My current plan is ...
3
votes
2answers
123 views

When to prefer exchanging cryptographic certificates over exchanging only public keys?

Let's think of the following case: A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
1answer
524 views

How do I generate a session key using the Diffie Hellman algorithm?

How to generate a session key between two nodes in two different subnets when the nodes don't know each other directly, using diffie hellman algorithm?
3
votes
1answer
456 views

Is XOR in a CBC-like mode secure?

Assuming that $K_{n}$, $P_{n}$, and $C_{n}$ are individual bytes of the key, plaintext, and ciphertext respectively. The first byte of ciphertext is computed like this: $C_{1} = K_{1} \oplus P_{1}$ ...
3
votes
1answer
158 views

DIfferent inner and outer hash functions for NIST Recommended HMAC?

The NIST recommended HMAC uses $$\operatorname{HMAC}_k(text) = H_\mathrm{out}( (k \oplus \mathrm{opad}) \operatorname\| H_\mathrm{in}((k \oplus \mathrm{ipad}) \operatorname\| text) )$$ Is it ...
3
votes
1answer
219 views

Is there a known vulnerability when using identical key and salt with PBKDF2?

For optimum security, a random salt should be chosen for PBKDF2. I came across a scenario where I produce a hash of a random file that serves as the "password". Due to the nature of files, this has ...
3
votes
1answer
318 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
3
votes
1answer
247 views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that ? Is there a ...
3
votes
2answers
509 views

Inverses in Truncated Polynomial Rings

I've been trying a long time to understand a thing which is obviously extremely simple, but I just can't get it. Read this, please: The NTRUEncrypt PKCS uses the ring of truncated polynomials $R$ ...
3
votes
1answer
546 views

KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
3
votes
1answer
139 views

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity?

Is appending the hash of the plaintext to the end of an encrypted message sufficient to ensure integrity? My reasoning is that the attacker doesn't know all the plaintext, so by having a hash, the ...
3
votes
1answer
101 views

How can I know when a file was signed?

I have been thinking about digitally signed documents (Word files and PDF files) and can not get over the fact about - how can I securely know when the file was signed? Scenario: If the date of the ...

15 30 50 per page