All Questions
4
votes
1answer
189 views
repeating-key xor and hamming distance
I read that to break repeating-key xor you can do the following: try a keysize $n$ and compute the hamming distance between the first $n$ bits of the encrypted string and the bits $n+1$ to $2n$ of the ...
1
vote
1answer
98 views
Password verification
I'm looking for feedback on whether or not this is the proper way to approach password verification without transmitting the actual password. Are there any problems with this scheme.
We are working ...
1
vote
4answers
142 views
Using the output of a stream cipher, how to guarantee the integrity of 4 bytes of data?
I am designing a simple and secure stream communication protocol. My idea was to build each message sent to the wire as:
(message size || clear text || UHASH(message size || clear text)) $\oplus$ ...
3
votes
1answer
109 views
Combining AEAD with RSA
'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.
To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
4
votes
2answers
180 views
Are cryptographic hash functions perfect hash functions?
For a cryptographic hash function and input values of shorter length than the hash function output, it's pretty obvious that there should be as few collisions as possible. But are there guaranteed to ...
2
votes
2answers
101 views
Keys required for cryptography
I am reading an article on cryptography at following location:
http://www.entrust.com/resources/pdf/cryptointro.pdf
Historically, encryption systems used what is known as symmetric cryptography. ...
10
votes
8answers
845 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
3
votes
2answers
301 views
How were the number of rounds for different key sizes of AES selected?
The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
1
vote
1answer
48 views
What does “securely realize” mean?
I was wondering what "securely realizes" means. I see this in some cryptographic papers but I don't know what it means for a protocol to "securely realize" a function $F$. Is it just a fancy way of ...
1
vote
1answer
74 views
Which public key was used. PGP
Is it possible to find out which public key was used to generate the message?
Scenario is like this :
I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and ...
2
votes
2answers
127 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
-1
votes
0answers
25 views
Create groups of keys [closed]
I looking for a solution to encrypt, sign documents or email a key group and send to one customers. The group of keys are had already created user keys and I would like to use them.
Is not an option ...
1
vote
1answer
55 views
What happen if a asymmetric crypto-system deals with only one key
Assume there is a crypto algorithm that deals with matrices to encrypt and decrypt. Regardless of the specification of such algorithm, what if the algorithm assumes that two parties can securely agree ...
-2
votes
0answers
58 views
Patterns in primes, listing? [closed]
Is there a listing of all the patterns people have found in prime numbers? I think I have found a new one and want to check against what is out there to make sure.
Yes I know this sounds very very ...
3
votes
2answers
141 views
Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
Is it a weakness to use a single shared secret for protecting messages using a Encrypt-then-MAC scheme?
Assuming a system is using AES-256-CBC and a SHA1-HMAC and the same secret key for both ...
2
votes
1answer
172 views
Extract private RSA key from USB cryptographic token using Bardou et al. attack (varian of “million message attack”)
There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
45
votes
7answers
15k views
How is CipherCloud doing homomorphic encryption?
Much of the literature and latest papers suggest that homomorphic encryption is still not practical yet.
How is CipherCloud able to achieve this? Does anyone have an idea? Their website does not ...
5
votes
2answers
127 views
Security of tokenization of plain text conversations - cryptanalysis
I came across a marketing video here. They claim to perform AES encryption and tokenization of sensitive data, at the corporate gateway, before it leaves the company firewall destined for the public ...
2
votes
3answers
165 views
The utility of elliptic curve cryptography
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
1
vote
1answer
69 views
Requiring a “supervisor” key pair and a “user” key pair to decrypt multiple-recipient messages
I've been toying with some encryption scenarios recently. One of the hard ones I came across is a multi-party system.
So we have
Bob -- The person who sends the message (and knows it's recipients)
...
0
votes
0answers
16 views
LT codes with Homomorphic hashing [duplicate]
I have been working on a project implementing LT codes with Homomorphic hashing (inspired from http://blog.notdot.net/2012/08/Damn-Cool-Algorithms-Homomorphic-Hashing and ...
1
vote
1answer
67 views
Connections between Instance Hiding and Fully Homomorphic Encryption
Another approach taken by researchers for carrying out computations over encrypted data is Instance Hiding.
In brief, If a user wants to outsource the computation of a function for a particular input ...
3
votes
1answer
127 views
Triple-DES Brute Force
Shannon's paper states:
A system is pure if all keys are equally likely and if for any three
transformations, $T_i$, $T_j$, $T_k$ in the set, the product
$T_iT_j^{-1}T_k$ is also a ...
1
vote
1answer
108 views
AES AddRoundKey
Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
4
votes
0answers
139 views
Prove that textbook RSA is susceptible to a chosen ciphertext attack
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.
So I use the fact that the ...
2
votes
1answer
70 views
Addition with Shamir secret sharing
When performing Shamir secret sharing I'm trying to find $z_i$, such that $z = x + y$. Where $n = 6$ and $t = 3$.
I believe this would be the correct solution (correct me if I'm wrong):
Each party ...
5
votes
1answer
186 views
A lower bound on the insecurity of CipherCloud?
CipherCloud claims to support , among other things, searchable encryption. A bunch of speculation seems to suggest they did this via some breathtakingly incompetent means( unfortunately such ...
5
votes
2answers
184 views
Is encrypting a single 128 bit block with AES ECB “safe”
I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
15
votes
1answer
400 views
Should I trust CipherCloud? [closed]
Should I trust CipherCloud's system for "homomorphic encryption" of data in the cloud?
Has the security of their system been subject to peer review or other cryptanalysis? Is there any known analysis ...
1
vote
1answer
65 views
How to learn the first bit of m in padded RSA
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
2
votes
1answer
69 views
What's the probable usage of Interlock Protocol
I've recently read some articles about the Interlock Protocol, Article by Ron Rivest and Adi Shamir.
I'm wondering if it is possible to protect Key-exchange under Public-Key cryptography from the ...
2
votes
1answer
99 views
Can prepending “junk” be equivalent to an IV when encrypting using CBC?
We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
1
vote
2answers
66 views
How secure is passing a MAC to Python's random.seed before using random.choice to generate a MAC?
I'd like to use Python's random.choice seeded with a HMAC-SHA1 tag to generate a MAC encoded in a variable set of chars.
...
0
votes
0answers
125 views
How can I become familiar with the logic syntax used in Cryptography papers? [closed]
I'm having to write a 5000 word essay on Cryptography, and many (if not all) of the papers I've read on the topics have logic syntax I simply don't understand.
How can I become familiar with the ...
1
vote
0answers
51 views
PKC McEliece + $S$ + $P$
I am trying implement the McEliece crytosystem in SAGE. My question is How I will be able to choose the appropriate matrix $S$ and $P$?. I ask this because when I trying obtain the vector $\hat{m}=mS$ ...
3
votes
2answers
68 views
GPG and PAR2 error correction data from the plain archive, will it compromise security?
I have the following scenario:
Archives compressed with 7z, hundreds of MiB in size
GPG to encrypt the archives (binary, without ASCII armor)
PAR2 to create error correction data
Question
1. ...
4
votes
1answer
202 views
Why exactly is Blowfish faster than AES?
I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
2
votes
2answers
131 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
3
votes
0answers
81 views
How can scrypt be improved to counter GPU mining
I know scrypt was designed to lessen the GPU/ASIC advantage.
We now have litecoin as a real-world example of this. However, it hasn't worked out perfectly. Most coins are mined by GPUs, although the ...
1
vote
1answer
49 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
8
votes
2answers
2k views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
0
votes
1answer
96 views
Ciphertext-only attack on Simplified DES
Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
2
votes
3answers
129 views
Is there a way to use Shamir Secret Sharing with updatable data?
I want to divide a system that maintains these properties, based on Shamir's Secret Sharing:
A secret key is split up to N pieces, where T of them are enough to reconstruct the key.
The original key ...
2
votes
1answer
75 views
Is it safe to assume Salsa20 to be a PRP?
Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20.
If limit ourselves ...
-2
votes
2answers
114 views
May the problem with DES using OFB mode be generalized for all feistel ciphers
There is a problem with using DES as the block cipher in OFB mode, eg: the feedback that goes back into the next round will be encrypted with the same key $k$ resulting back into the plaintext IV used ...
1
vote
0answers
49 views
Perfect secrecy and change of plaintext probability distributions
How to prove that if a cryptosystem has perfect secrecy for a given plaintext probability distribution then it will have perfect secrecy for all other possible plaintext probability distributions?
Do ...
1
vote
0answers
30 views
Encrypted Functions with Fully Homomorphic Encryption [duplicate]
While Fully Homomorphic Encryption schemes facilitate carrying out computations over encrypted data, can the function that has to be evaluated be encrypted too ?
For example, if i have some programs ...
5
votes
1answer
121 views
Correct way to map random number to defined range?
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.
What is the best way to map this random number to a ...
2
votes
1answer
106 views
DLP based crypto systems with multiple independent generators
One example of a DLP based crypto system (or rather DDH based crypto system) where the public key parameters include two independent generators of the subgroup, is Cramer Shoup. Since the security ...
