8
votes
4answers
836 views

What tests can I do to ensure my PRNG is working correctly?

In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?
10
votes
6answers
2k views

How exactly is “true randomness” defined in the realms of cryptography?

Especially in relation to stream ciphers, I frequently read about (sometimes theoretical, sometimes practical) attacks that are able to "distinguish a ciphertext from a truly random stream". What's ...
-1
votes
0answers
55 views

Determining if a stream of bits is statistically random [duplicate]

Suppose I would like to build a hardware RNG. The details aren't important but let's say I've found a way to generate theoretically random bits, and I want to test to see if they are in fact "random ...
-1
votes
0answers
56 views

how to rememeber passwords securely? [migrated]

Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
2
votes
3answers
160 views

How can a Vigenère cipher be broken if the message is short?

I was watching a Stanford lecture on Vigenère cipher and in it the professor said that – to break the cipher – we assume the length of the key is known. We then break the cipher into groups of this ...
15
votes
7answers
2k views

Is calculating a hash code for a large file in parallel less secure than doing it sequentially?

I would like to improve the performance of hashing large files, say for example in the tens of gigabytes in size. Normally, you sequentially hash the bytes of the files using a hash function (say, ...
2
votes
1answer
89 views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
0
votes
0answers
57 views

What is a proof of data possession that accounts for fake mirrors?

Alice pays Bob $5/month to host a gigantic file for her. She wants to occasionally verify that Bob is actually hosting the file. To do this, she selects random blocks from the file, and ...
2
votes
1answer
29 views

Calculating IHVs from known message and hash output

Here is a somewhat silly and atypical problem I am currently facing. Usually, when it comes to hashes, one is bothered with finding collisions and preimages. My problem is, I need to find the IHV used ...
-2
votes
0answers
11 views

Could remailers achieve their goals under conditions of ubiquitous (total) surveillance? [migrated]

I am not certain but I am afraid that the answer to the question would be negative, if the following arguments couldn't be clearly refuted: A sender of a message has to choose a (first) node of the ...
5
votes
2answers
595 views

When only using one-way hashing, is it possible to tell the number of characters changed between the old and new password?

The other day when changing my password on a Solaris 10 system I was surprised that Solaris was able to detect that I hadn't changed enough characters between the new and current passwords. MINDIFF ...
4
votes
2answers
466 views

Attacks on the RSA Cryptosystem

I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem. Theorem (Coppersmith). Let $N=pq$ be an $n$-bit RSA modulus, where ...
4
votes
3answers
170 views

SHA256 output to 0-99 number range?

Is it mathematically possible to take a SHA256 hash and turn it into a 0-99 number where each number in 0-99 range is equally likely to be picked? As a 256 bit hash means the highest value possible ...
-2
votes
2answers
269 views

How do I choose the best 3*3 s-boxes?

I've read about 20 papers about the criteria for choosing best $n \times n$ s-boxes. Now, I've got two problems: How to generate $2^{24}$ s-boxes, and how to test them considering the criteria. ...
3
votes
1answer
81 views

Is there a practical upper limit for password rehashing?

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security? Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, ...
-4
votes
0answers
58 views

RSA Key and RSA Security

Is there any relationship between the RSA keypair standard and RSA security? Keypair: http://en.wikipedia.org/wiki/RSA_(cryptosystem) Security: http://en.wikipedia.org/wiki/RSA_Security If not, ...
5
votes
1answer
326 views

What is Attribute Based Encryption?

Can someone explain what attribute based encryption is? I was searching for a book or something that can help me in this regard but so far I have found none. Google also returns practically nothing ...
1
vote
1answer
94 views

DH key exchange with only one end authenticated

We know there is a man in the middle vulnerability with unauthenticated DH key establishment. And the way to negate that is to use authenticate the keys used. But what if I only verify the signature ...
1
vote
0answers
39 views

Trapdoor permutation / hardcore predicate [closed]

I'm trying to understand the basic scheme of deniable encryption based on the “Deniable Encryption” paper by Ran Canetti, Cynthia Dwork, Moni Naor and Rafail Ostrovsky (1997). Is there any source ...
3
votes
1answer
78 views

Client authentication on limited hardware

I'm developing a authentication and authorization protocol for a Bluetooth device. The device should communicate with an Android app and needs to be able to authenticate the app during the connection ...
1
vote
1answer
43 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that ( length($p$) == length($q$) )$\implies$ gcd$(pq,(p-1(q-1)))$=1 where length($k$) = # bits in ...
4
votes
1answer
121 views

An unpredictable PRG is secure (Theorem Yao'82)

in the Mr Boneh's online course is stated the following theorem: Let $G:K \to \{0,1\}^n$ be a PRG. “Thm”: if $\forall i \in \{0, … ,n-1\}$ the PRG $G$ is unpredictable at pos. $i$, then ...
5
votes
2answers
945 views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
2
votes
2answers
90 views

How is this affine function a pair wise independent permutation?

Can anybody explain how the below is true ? $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$. (..) Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$, ...
2
votes
2answers
117 views

What exactly does a key do?

I am getting to grips with cryptography as a total newbie, and am struggling with encryption "keys" and how to visualize them. From http://computer.howstuffworks.com/encryption.htm/printable: ...
3
votes
1answer
102 views

Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
2
votes
2answers
124 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
3
votes
1answer
118 views

Skein state size advantages

Skein is defined for three different internal state sizes: 256 bits, 512 bits, and 1024 bits – with Skein-512 as the “primary proposal”. Is there any advantage – other than potential memory or speed ...
1
vote
1answer
87 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
2
votes
2answers
168 views

Password-based encrypted key storage?

RFC 5959 specifies the encrypted storage of private keys based on PBKDF2-HMAC-SHA-256 and AES encryption (in ECB mode). Is there a particular reason AES is used, instead of simply XORing the key ...
2
votes
1answer
77 views

How does Web Cryptography API produce secure PRNG?

How does Web Cryptography API (eg window.crypto.getRandomValues) produce secure PRNG? Specifications: https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html#RandomSource-interface ...
2
votes
1answer
74 views

Simplification of a pairing

The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification: $$e(C_i,\text{GPK}_{uid})\cdot e(D_i, ...
4
votes
1answer
239 views

Adi Shamir's secret database of all primes

I was going through these presentation slides (PDF) on Crypto 2013. It summarizes the paper, Factoring RSA keys from certified smart cards: Coppersmith in the wild. In the last slide, it was ...
4
votes
2answers
252 views

Is SipHash cryptographically secure?

I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks. SipHash seems ...
6
votes
6answers
2k views

Where can I begin to study the math behind modern cryptography?

I've been studying crypto for almost a year now, implementing algorithms, reading books, studying code, etc. The deeper I go in, the more I realize there is; I feel like I've just barely scratched the ...
3
votes
1answer
192 views

What should I be aware of when implementing algorithms myself?

I plan to build my own crypto library. The project will be primarily for me to learn (and if useful for no other purpose, that is fine). In the past I have implemented a few hashes, and AES quite a ...
2
votes
2answers
94 views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
2
votes
1answer
120 views

Getting 88bytes cipher output from 48bytes input in AES

The other day I saw this Hybrid Cryptographic Algorithm in the Google and felt curious about it. I am trying to understand this Hybrid Algorithm. And hopefully its not so hard to understand whats ...
2
votes
0answers
37 views

Malicious KGC attack in the identity-based authenticated key exchange protocol

There are two users $A$ and $B$ who are in different domain. Let's assume that $A\in KGC_1$ and $B\in KGC_2$. If they want to establish secure session, then they must run an identity-based ...
2
votes
0answers
37 views

Comparing n-multiple amount of merkle trees?

I would like to know what best steps are there in finding differences between a high order amount of merkle tree's or if a better associative structure should be used. I ask this questions because ...
1
vote
1answer
69 views

Generate Finite Field power of g

consider the field $\mathbb{F}_{2^4}$, defined by using polynomial representation with the irreducible polynomial $f(x) = x^4 + x + 1$. Given element $g = (0010)$ as a generator for the field, How ...
0
votes
0answers
86 views

Convergent encryption has dictionary attack, but why hash function doesn't?

Convergent encryption (CE), $E_k(d)$, is a way to encrypt the data $d$, with the characteristic that the encryption key $k$ is $k=h(d)$, where $h(\cdot)$ is a cryptographic hash function. Consider a ...
2
votes
1answer
96 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
1
vote
0answers
43 views

Type 2 to Type 1 pairing transformation - why not considered?

How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) ...
3
votes
3answers
109 views

Encrypting text file line by line with stable encryption

I want to store files in a secure manner (i.e. no one should be able to decrypt the contents of the file without the secret key) but I also want a diff tool to be able to show me which lines changed ...
2
votes
1answer
66 views

Cryptool - DES (ECB and CBC ) - double encyption

So, I uploaded a text file in Cryptool and encrypted it with DES-ECB with the key FF FF FF FF FF FF FF FF. I encrypted the cipher text again, with DES-CBC using ...
1
vote
1answer
67 views

Use ElGamal to solve Diffie-Hellman problem

Say we are able to decrypt a Elgamal ciphertext $c$ using only the public key. Apparantly it is now possible to solve the Diffie-Hellman problem (given $g^a, g^b$ calculate $g^{ab}$). How? I know how ...
1
vote
0answers
38 views

In symmetric searchable encryption are the algorithms public?

If a user (other than the data owner) possesses the secret key in symmetric searchable encryption scheme are they able to run the trapdoor algorithm, or is this not publicly available?
5
votes
1answer
108 views

Is SHA256 good enough to shrink a key?

I have a key that is the combination of two shorter keys generated by PBKDF2, which together are long more or less 64 bytes. Now I need to shrink it down to 32 bytes and I'm not sure what to use to do ...
3
votes
0answers
34 views

Feasible way to check n-dimensional equidistribution of PRNGs

I am currently gathering some test methods and test suites for random number generator qualities, and am a bit stuck at finding something feasible to test for n-dimensional equidistribution. As input ...

15 30 50 per page