All Questions
5
votes
1answer
121 views
Correct way to map random number to defined range?
Say that we have a secure random number generation that outputs 32 bit random numbers, so it's output is a true random number between 0 and a MAX.
What is the best way to map this random number to a ...
5
votes
2answers
167 views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST ...
5
votes
2answers
287 views
Proof that lottery does not know outcome of draw
Could a variable participant lottery system cryptographically prove that they have zero knowledge of the outcome of a draw?
Participants do not choose numbers in this lottery and winning numbers are ...
5
votes
3answers
342 views
How to authenticate over open channel?
I am making an arduino project to open my garage door. I want to make it so users with the passphrase can open the door. Due to computational restrictions it is unlikely encryption is possible. ...
5
votes
4answers
991 views
What alphanumeric string length can be used to guarantee no hash collisions from CRC-64?
If I'm hashing alphanumeric strings (chars in the set 0-9, a-...
4
votes
3answers
391 views
CBC - a canonical mode, even though there are streaming modes
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
4
votes
4answers
1k views
How can one securely generate an asymmetric key pair from a short passphrase?
Background info:
I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
3
votes
4answers
1k views
PBKDF2 and salt
I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions.
Actually we use the derivation function together with the salt to provide ...
3
votes
3answers
487 views
RS Erasure Coding and Shamir's Secret Sharing
So I was trying to understand the basic difference between erasure coding and secret sharing, and I found this paper (that you can find here or here).
For what I understand, it states that Shamir's ...
2
votes
4answers
176 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
1
vote
1answer
110 views
Attack on DSA with signatures made with k, k+1, k+2
For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages ...
1
vote
2answers
175 views
One-way function and factoring
I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
12
votes
2answers
949 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
10
votes
2answers
267 views
Are safe primes $p=2^k \pm s$ with $s$ small less recommandable than others as a discrete log modulus?
I take the definition of safe prime as: a prime $p$ is safe when $(p-1)/2$ is prime.
Safe primes of appropriate size are the standard choice for the modulus of cryptosystems related to the discrete ...
10
votes
3answers
2k views
Why is public-key encryption so much less efficient than secret-key encryption?
I'm currently reading Cryptography Engineering. After giving a high level explanation of the difference between secret-key encryption and public-key encryption, the book says:
So why do we bother ...
10
votes
8answers
844 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
9
votes
2answers
534 views
Blum Blum Shub vs. AES-CTR or other CSPRNGs
Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
9
votes
2answers
418 views
I have a few questions about the random oracle model
1.) Proving the security of a scheme with the ROM takes two steps; first you prove that the sceme is secure in this idealized world where a random oracle exists and then you implement this scheme in ...
8
votes
1answer
556 views
Duration for attacking Two-Key Triple-DES Encryption using all RAM ever built?
I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32 Giga Bytes of ciphertext) by the method devised by Paul C. van Oorschot ...
8
votes
5answers
998 views
What is the post-quantum cryptography alternative to Diffie-Hellman?
Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption ...
8
votes
4answers
608 views
Properties of PRNG / Hashes
There are a lot of quite elaborate PRNG's out there (e.g. Mersenne Twister et.al.), and they have some important properties, especially when it comes to crypto applications.
So, I was wondering how ...
7
votes
1answer
275 views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
7
votes
2answers
240 views
What is the purpose of using different hash functions for the leaves and internals of a hash tree?
I just learned that the THEX hash tree specification which is widely used in P2P requires that two different hash functions be used: one for the leaf nodes (hashes of input data) and one for the ...
7
votes
2answers
480 views
Selecting a large random prime
Say I want a random 1024-bit prime $p$. The obviously-correct way to do this is select a random 1024-bit number and test its primality with the usual well-known tests.
But suppose instead that I do ...
6
votes
3answers
354 views
Security equivalence proofs for breaking RSA
It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring.
In otherwords, ...
6
votes
2answers
494 views
Can one implement AES on 4-bit microcontroller?
It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID.
I have yet to come across ...
6
votes
1answer
273 views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
6
votes
3answers
159 views
Number of intersections of two sets
Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
6
votes
3answers
381 views
What tests can I do to ensure my PRNG is working correctly?
In the past I have used the Chi-squared test to check the statistical randomness of my generator. Is this a good test to use? Are there other tests?
5
votes
1answer
335 views
How does a “Tiger Tree Hash” handle data whose size isn't a power of two?
Constructing a hash tree is simple enough if the data fits into a number of blocks that is a power of two.
...
5
votes
2answers
1k views
Use of salt to hash a password
In a few implementations of hashed passwords, I have seen that the length of the random salt is chosen to be, say, 10 or "some constant". Is there any specific reason why the salt is chosen to have a ...
5
votes
1answer
255 views
If the PSK is known, is it possible to decrypt traffic from other clients in a WPA2 wlan network?
If in a public WLAN WPA2-PSK is used, but the PSK is more or less publicly available, does this mean that an attacker with that PSK can easily decrypt wlan traffic from/to other clients of that WLAN?
...
5
votes
4answers
172 views
Changing algorithms during encryption
Inspired by "Guarding against cryptanalytic breakthroughs: combining multiple hash functions", I am curious if there is a cryptographic reason to use only one algorithm during encryption.
For ...
4
votes
5answers
326 views
Any efficient text-based steganographic schemes?
While there are sophisticated and efficient steganographic schemes with images as cover available, I am yet ignorant of the existence of any fairly efficient and secure schemes with texts as cover. ...
4
votes
1answer
222 views
Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid
When given p = 5, q = 11, N = 55 and e = 17, I'm trying to compute the private key d.
I can calculate phi(N) = 40, but my lecturer then says to use the extended Euclidean algorithm to compute d. ...
4
votes
3answers
520 views
What is the recommended replacement for MD5?
Since MD5 is broken for purposes of security, what hash should I be using now for secure applications?
4
votes
2answers
543 views
128 bit hash with least chance of collision
I'm building a storage system for JSON documents where they are looked up on a 128 bit key. These JSON documents have a timestamp within them, but apart from that are user-entered data. These JSON ...
4
votes
3answers
248 views
Is there some way to generate a non-predictable random number in a decentralised network?
Is there a way to generate a random number with given restrictions:
It will be used in a decentralised network with a big number of peers (no central authority to generate it)
Its generation should ...
4
votes
1answer
544 views
Example of CHI Square test on Caesar Cipher?
I am trying to get my head round the chi square test, when used with the Caesar cipher.
I started off using this formula,
$$ X = \sum_{i = 1}^k \frac{f_i · f'_i}{n · n'} $$
Where ...
4
votes
2answers
346 views
Random Coin Flip using ElGamal and a Trusted Party
An old exam question I am trying to figure out:
Consider the following protocol for two parties to flip a fair coin.
Trusted party T publishes her public key pk
A chooses a random bit ...
3
votes
2answers
95 views
How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?
I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity (0) if present in a signature. For example, r could be the x ...
3
votes
6answers
307 views
Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
3
votes
1answer
69 views
iterated discrete log problem
Consider the following problem: given $g_1 \ldots g_i,h_1 \ldots h_i \in G$, $\forall i$ find $x_i$ such that $g_i^{x_i}=h_i$
For $i=1$ this is the discrete log problem and is assumed to to have ...
3
votes
1answer
206 views
LFSR dynamic mutation
In normal LFSR, the state is a function of the initial seed, taps positions and time, nothing else. I've seen a modification of LFSR that works like this:
...
3
votes
5answers
818 views
Galois fields in cryptography
I don't really understand Galois fields, but I've noticed they're used a lot in crypto. I tried to read into them, but quickly got lost in the mess of heiroglyphs and alien terms. I understand they're ...
3
votes
2answers
268 views
are CFB and OFB really meant for streaming?
CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?
3
votes
3answers
398 views
What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman?
How are the three problems Discrete Logarithm, Computational Diffie-Hellman and Decisional Diffie-Hellman related?
From my understanding, since the Discrete Log (DL) Problem is considered hard, then ...
3
votes
2answers
831 views
Brute forcing CRC-32
I'm working on a cryptosystem which uses IDEA. The designer made the mistake of including a CRC-32B hash of the password unencrypted in the header, so that the system can quickly reject bad ...
3
votes
3answers
302 views
How can two different passphrases unlock the same content?
I have heard that in enterprises it is common that the IT admin has a master passphrase that can unlock any content that an employee encrypts.
It would be temping to think, that the IT admin's ...
