0
votes
0answers
37 views

OpenSSL: do I need multiple EVP_CIPHER_CTX structures? [migrated]

This may need to be on StackOverflow instead. I have a single-threaded client/server application that needs to do both encryption and decryption of their network communication. I plan on using ...
1
vote
0answers
50 views

Hill cipher key space

Key space is the set of all possible keys that can be used to generate a key. We using the number of valid key to describe it. I've given a hill cipher of block size $k$ over alphabet of size $p$, ...
-1
votes
1answer
48 views

Pseudo Random Generator with fixed Hamming Weight [closed]

I'm searching for way to generate secure pseudo random sequence with a fixed Hamming weight using a seed. I found below code but I need a seed to generate a sequence ... (and need know if is possible ...
3
votes
1answer
77 views

Is email an example of public-key cryptography?

It seems like email is at least analogous to public-key cryptography, the public portion of the key being your email address, and the private portion of the key being the password to the email ...
2
votes
1answer
51 views

What does it mean for an adversary to run in PPT?

I've been reading this question where a detailed description of mine is given, I've understood that a polynomial-time adversary is an adversary for which the only feasible strategy are those that take ...
1
vote
1answer
51 views

DH “prime size” security in OpenSSL

There's a program that uses the following OpenSSL function... DH_generate_parameters(256, 5, NULL, NULL) ...to create DH parameters which are later used for ...
1
vote
0answers
63 views

Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature $s=\text{sign}(sk,m)$ (for a private key $sk$ and a message $m$) into a signature ...
1
vote
0answers
95 views

Unblind a RSA blinded signature

I have blinded $m = 16$ with $r= 13$, $e = 7$ and $n = 209$. This resulted in $m' = 464$, which led to a $s' = 8$. Now, I want to unblind this $s'$ by using $s = s' \times r^{-1}$ but im stuck at ...
1
vote
1answer
121 views

Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?

Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
30
votes
5answers
4k views

How big an RSA key is considered secure today?

I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
2
votes
0answers
72 views

how to truncate a PRF on n bits to PRF on t bits where t < n? [closed]

Dan Boneh's courersa lecture on format preserving encryption at 5.50 mins , talks about truncating a PRF on $n$ bits to PRF on $t$ bits. The approach is by appending $(n-t)$ zeros to input $t$ bits ...
1
vote
0answers
55 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
1
vote
1answer
60 views

Public and private key lengths

I am generating RSA Public and Private keys with node.js instead of reading them from pem/crt files as I can hide them inside a private object using this module https://www.npmjs.org/package/private ...
3
votes
2answers
93 views

Ballot box with multiple parties. All can read it, or none can read it

I am trying to create a decentralized moderation system for the game Diplomacy, a game for seven players. In each round of a face-to-face game, each player writes their moves on paper then puts it in ...
3
votes
1answer
86 views

Which concrete applications benefit from Oblivious RAM constructions?

The main motivation for Oblivious RAM (ORAM) is that, for instance, in the "cloud" setting a client outsources his data to a server in the form of encrypted blocks. Later on, he wants to perform read ...
1
vote
0answers
37 views

key-exchange with websockets in node.js

I do not see how someone would distribute a “key/key agreement” without exposing it to a MITM! I would consider it to be strange if the answer is “via a HTTPS or TLS connection” because – if this is ...
-1
votes
1answer
56 views

Where do I truncate the bits in SHA 256 hash algorithm?

I'm implementing SHA 256 in PHP using strings. Where do you truncate in the algorithm? There are a lot of places where there's binary addition happening so the no. of bits in the W(i) keep ...
2
votes
1answer
56 views

Is HMAC padding the same as bcrypt?

I have been watching Christof Paar on his YouTube lectures also I used bcrypt to store two passwords with salts and I find that I have a few questions. I am interested in what bcrypt does to the ...
4
votes
3answers
509 views

What algorithm would give the shortest ciphertext for very short plaintexts?

I have to encrypt some very short messages (approx. 5 characters) and I would like the ciphertext to be as short as possible. I am currently using AES but the initialization vector (IV) is making my ...
2
votes
1answer
44 views

User-specified PBKDF2 password, salt, and iterations limits

For a decentralized login where a user is left to select the password, salt, and iterations, what minimums for each should be enforced? In other words, because none are ever stored by the ...
4
votes
1answer
71 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
3
votes
1answer
130 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
0
votes
0answers
67 views

RSA: Common modulus attack problem [duplicate]

I understand in theory how the common modulus attack works (as described here: how to use common modulus attack?) Though, I did not understand completely how it worked with a negative $s_i$. Since ...
1
vote
1answer
125 views

SHA1 collision event probability after n iterations

There are String1 and String2 - some variables-strings. The probability of collision for different ...
0
votes
0answers
22 views

A Suitable Replacement for MCrypt? [migrated]

I hope this is the appropriate audience for my question. I'm rewriting a legacy PHP web application that makes heavy use of MCrypt. It's on a shared host and handles payment data as well as personally ...
6
votes
2answers
106 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
2
votes
1answer
52 views

Protocol composition

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
1
vote
2answers
71 views

Signing a document: which algorithm to use?

What I want to do is to digitally sign a document. I am new to cryptography and was wondering what issues to take into account. The only criteria is that a textual document signed should produce a ...
1
vote
0answers
52 views

Modes of Operations Exercise

I am currently stuck at an exercise for my Cryptography Class in University which is: Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). ...
4
votes
2answers
189 views

Authenticated encryption without padding

I want to encrypt data and protect its integrity and confidentiality. However, I cannot increase the length of the data. Are there any cipher modes of operation which provide confidentiality and ...
1
vote
1answer
49 views

LFSR and Markov chain question

This may seem an elementary question about LFSRs, and their link to Markov chains. LFSRs show Markov chain behaviour in that there can be a transition matrix defined over the LFSR, this follows from ...
3
votes
3answers
282 views

Third-party security issues with Shamir's secret sharing scheme

In Shamir's secret sharing scheme, we are trusting a third party who generates the secret polynomial. How can we ensure security here when we are involving a third party?
-1
votes
1answer
53 views

How does the Hashlet work?

DISCLAIMER: I don't know a lot about cryptography. I was reading about the Hashlet, and I had a couple questions. The Hashlet is described as: SHA256 hardware device with a hardware RNG, and ...
1
vote
1answer
40 views

Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be ...
-1
votes
0answers
49 views

What is “web of trust” in PGP and S-MIME? [migrated]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
0
votes
2answers
45 views

SHA1 multipart calculation

Is it possible to combine SHA1 digest values to get the SHA1 of the concatenated parts ? I know the "S1" SHA1 of "part 1" and the "S2" SHA1 of the "part 2" and I would like to know the SHA1 of the ...
3
votes
2answers
94 views

Does knowing multiple hash of the same content make it more likely to generate original plain text?

Say I'm trying to brute force the original plain text of an SHA256 hash, does knowing the RIPEMD160 hash of the same text help? In other words, does providing access to hash values of the same text ...
8
votes
2answers
179 views

Trial divisions before Miller-Rabin checks?

I'm trying to understand prime number generation (more correctly, the primality checking) as described in Handbook of Applied Cryptography. The context is circa pages 145 - 150, and specifically ...
1
vote
0answers
45 views

Mutual authentication with Public Key and session Key

I am trying to understand two protocols for mutual authentication and if they are secure or not. $K$ is the session key, and it's calculated $k=H(TimeStamp)$. Are the following both cases secure? ...
3
votes
1answer
79 views

Basic attacks on McEliece; finding S and P

Take a McEliece cryptosystem with public generator matrix $G' = S G P$ where $G$ is a generator of a secret code with known fast decoding (not necessarily a Goppa code over $\mathbb{F}_2$), $S$ is ...
2
votes
2answers
161 views

Can the premaster secret generated by SRP be used as a secure private key?

It seems like the pre-master secret generated during the SRP protocol would make a good source to generate a shared private key using a secure hash to compress it down into a 128/256 symmetric key. ...
4
votes
2answers
159 views

What are Cryptographic Multi-linear Maps?

I've encountered this term many times in the fields of Fully-Homomorphic Encryption and Obfuscation. I want to learn those subject and Cryptographic Linear Maps seems to be an obstacle in the way. ...
5
votes
1answer
64 views

Length-preserving all-or-nothing transform

Is there any known way to construct a length-preserving all-or-nothing transform? In other words, a secure all-or-nothing transform where the length of the output is the same as the length of the ...
3
votes
2answers
935 views

Is a 1024-bit DSA key considered safe?

I created my PGP key in 2000. I’ve revoked the older, weaker sub-keys in favor of a 4096-bit RSA one, but the primary key is 1024-bit DSA. I read on Wikipedia that… NIST 800-57 recommends lengths ...
3
votes
1answer
98 views

What are good combinations of public key algorithms or primitives for long term security?

There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden ...
0
votes
2answers
101 views

RSA decrypting of a huge file by parts [closed]

I need to decrypt a huge file that I own previously encoded by myself with a RSA public key (it's possible for this step using a symmetric algorithm key). Problem is that I can't load it in my ...
1
vote
1answer
45 views

Non-commutitive and nonassociative algebraic structures in cryptography

Are there any cryptographic algorithms or primitives that have been developed and studied that make use of non-commutative or non-associative algebraic structures such as quaternion integers or ...
4
votes
2answers
2k views

Why is asymmetric cryptography bad for huge data?

I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length. Why is this? I know about hybrid encryption, which uses symmetric encryption to ...
3
votes
1answer
313 views

Symmetric encryption mode where ciphertext size is plain text size

I've had many questions on Stackoverflow on how to minimize the output of a cipher - during encryption of course - to the same size as the input. Obviously this is possible for a single block of ...
-2
votes
1answer
128 views

What does it mean that a protocol realizes “strong mutual authentication”?

What does it mean that a protocol realizes "strong mutual authentication"? And What does it mean that a protocol realizes "weak mutual authentication"? Can you define them formally ? I have found a ...

15 30 50 per page